Splynx

Inspiration

We were inspired by GitHub Copilot's ability to eliminate friction for developers — we wanted to bring that same experience to Splunk users who spend hours crafting SPL queries manually, using Splunk AI as the intelligence layer.

What it does

Splynx is an AI-powered query assistant for Splunk that lets security analysts and developers type plain English and instantly get production-ready SPL queries — powered by Splunk AI — with built-in explanation, optimization, debugging, and threat investigation modes.

How we built it

We built Splynx with a Python FastAPI backend integrated with the Splunk AI Toolkit (AITK) as the primary AI engine, using its OpenAI-compatible endpoint to power natural language to SPL generation, query explanation, optimization, and security investigation. The frontend is built with React and Tailwind CSS, featuring a GitHub Copilot-style chat interface, live SPL editor with syntax highlighting, and an AI Insights panel showing confidence scores, MITRE ATT&CK mappings, and performance recommendations — all connected to the Splunk REST and Search APIs for live query execution.

Challenges we ran into

The biggest challenge was making Splunk AI responses structured enough to extract clean SPL, confidence scores, and actionable recommendations reliably.

Accomplishments that we're proud of

We were able to create the app using Splunk AI.

What we learned

We learned how powerful Splunk AI becomes when paired with a conversational interface. Most users don't struggle with Splunk's capabilities, they struggle with SPL syntax, and Splunk AI bridging that gap unlocks the platform for a much wider audience.

What's next for Splynx

We want to integrate deeper Splunk AI capabilities including Splunk SOAR, saved search scheduling directly from chat, multi-turn investigation workflows, and a VS Code extension so developers can generate SPL queries without ever leaving their editor.

Built With

• fastapi
• pydantic
• python
• react
• splunk
• splunk-ai
• tailwind
• typescript