Skip to content

Rules

Rules allow you to steer the agent's behavior to match your organization's needs and individual preferences. You can use rules to influence the agent's writing style, teach it about data domains and purposes, set preferences for dashboard layouts, and more.

Rules are processed by the agent at the start of every conversation, providing consistent guidance across all interactions.

System Rules

System rules are configured by administrators and apply to all users within the organization. They establish organization-wide standards and behaviors for the agent.

System rules are defined in the ai.conf configuration file using the [systemRules] stanza:

[systemRules]
RULE-emdash = Avoid using em dashes (—) in responses
RULE-timepicker = Dashboards must always include a time picker

Each rule uses the format RULE-<name> = <rule text>, where:

  • <name>: A unique identifier for the rule (alphanumeric and hyphens only).
  • <rule text>: The instruction or guideline for the agent to follow.

See ai.conf for complete configuration details.

User Rules

User rules are set by individual users and apply only to their own conversations with the agent. They allow each user to customize the agent's behavior according to their personal preferences and workflow.

Under the hood, user rules are stored in Splunk's KV store. They use a separate document for each user and are private to that user. Administrators can view user rules for all users through the KV store.

Editing User Rules

You can access your user rules in the agent's settings section. In the app's navbar, click Settings and look for the User Rules section.

Add a new rule by clicking the + Add button. You can add as many rules as you want.

Delete a rule by clicking the Delete button next to the rule.

Finally, click the Save button to apply your changes.