Rules
Rules allow you to steer the agent's behavior to match your organization's needs and individual preferences. You can use rules to influence the agent's writing style, teach it about data domains and purposes, set preferences for dashboard layouts, and more.
Rules are processed by the agent at the start of every conversation, providing consistent guidance across all interactions.
User Rules
User rules are set by individual users and apply only to their own conversations with the agent. They allow each user to customize the agent's behavior according to their personal preferences and workflow.
Under the hood, user rules are stored in Splunk's KV store. They use a separate document for each user and are private to that user. Administrators can view user rules for all users through the KV store.
Editing User Rules
You can access your user rules in the agent's user settings section. In the app's navbar, click User Settings and look for the User Rules section.
Add a new rule by clicking the + Add button. You can add as many rules as you want.
Delete a rule by clicking the Delete button next to the rule.
Finally, click the Save button to apply your changes.
System Rules
System rules are configured by administrators and apply to all users within the organization. They establish organization-wide standards and behaviors for the agent.
See ai.conf for complete configuration details.
Each rule uses the format RULE-<name> = <rule text>, where:
<name>: A unique identifier for the rule (alphanumeric and underscores only).<rule text>: The instruction or guideline for the agent to follow (one-line only).
Editing System Rules
Admins can manage system rules from the Admin Settings page in the Splunk app. Under the System Rules section, use the + Add button to create rules, and click Save to apply changes.
Alternatively, system rules can be edited directly in the ai.conf configuration file under the [systemRules] stanza: