Aviz Network Copilot and Splunk outline integration for AI query to SPL

Splunk and Aviz Network Copilot are presented as an integrated approach that pairs Splunk’s telemetry indexing and real-time analytics with an AI assistant that converts natural-language questions into Splunk queries and summarized results for network operations teams.

Research Overview

The white paper describes an integration between Splunk, an operational intelligence platform, and Aviz Network Copilot (NCP), an AI assistant for network operations.

It frames the combination as a way to use Splunk’s data ingestion, indexing, and real-time analytics alongside NCP’s reasoning and predictive capabilities to support troubleshooting and proactive network operations across multi-vendor environments.

Key Findings

The paper characterizes Splunk as a centralized system of record for operational telemetry, with Network Copilot acting as an interaction and reasoning layer.

In the proposed workflow, NCP translates natural-language questions into structured Splunk queries, retrieves relevant results, and returns summarized insights, charts, and recommended next steps.

Technical Breakdown

Operational data visibility is described as covering logs, metrics, flows, and security events collected from routers, switches, firewalls, and servers, then made queryable through Splunk indexing and search.

The integration architecture includes Splunk ingestion and indexing, an AI integration layer where NCP queries Splunk APIs, and an AI reasoning stage using LLM-driven reasoning and machine-learning pipelines to convert Splunk search outputs into contextual insights, summaries, and recommended actions.

Operational Impact and Scale Testing

The paper reports performance testing of the integration using real network flow data at four scales (50 flows as a baseline, 1 million, 5 million, and 10 million flows) on Splunk 9.x Enterprise with one search head and two indexers.

It states that direct SPL queries remain under half a second for simple lookups and time-filtered searches at 5M flows, while the slowest operation is described as field extraction combined with aggregation at 8–15 seconds at 5M; for the end-to-end AI pipeline, it reports total response times of 5–10 seconds at 1M flows, with Splunk query execution taking 1–5 seconds, MCP overhead at 0.2–0.5 seconds, and the remainder attributed to LLM inference steps.

Blog Signals brief is a fact-based summary of the vendor blog.