Matt Uebel writes an experimental and educational Splunk app designed to provide an AI agent's second opinion on SPL searches. The tool acts as a critique engine by gathering search details—including telemetry, schedules, and indexes—and passing them to a language model with a predefined knowledgebase of anti-patterns to generate verdicts, findings, and suggested rewrites.
- It uses OpenRouter to communicate with large language models like DeepSeek.
- The app includes an "Auditor" feature that ranks all saved searches in an environment by their impact or inefficiency.
- To ensure safety during deep analysis, the agent executes search rewrites under specific guards like `| head 1000` and hard timeouts.
- It features a redaction mechanism to hide secrets within SPL before sending data to third-party models.
- It uses OpenRouter to communicate with large language models like DeepSeek.
- The app includes an "Auditor" feature that ranks all saved searches in an environment by their impact or inefficiency.
- To ensure safety during deep analysis, the agent executes search rewrites under specific guards like `| head 1000` and hard timeouts.
- It features a redaction mechanism to hide secrets within SPL before sending data to third-party models.
