Natural-language FLX tracker generation¶
Overview¶
Flex Objects (FLX) is the most powerful TrackMe component — it turns any Splunk search into a set of tracked entities with custom KPIs, thresholds and anomaly detection. It is also the one with the steepest learning curve, because you have to author SPL that satisfies the FLX search contract.
Natural-language FLX tracker generation collapses that curve. From the Flex Objects tracker-creation wizard you describe what you want to monitor in plain language, and the AI FLX Threshold Advisor drafts the tracker for you: it grounds the SPL on the closest of the 60+ Flex Objects use-case templates, proposes scheduling and starter thresholds, dry-runs the search against your live data, and fills the wizard with a validated proposal you review before anything is created.
This is the showcase of TrackMe’s AI layer: it does not just detect problems, it now helps you build the monitoring in the first place — grounded in real data, with the operator firmly in the loop.
Note
Trust by design. The AI never silently creates anything. SPL hallucination is structurally mitigated by two rules: every proposal is grounded on the use-case template library rather than written from scratch, and the candidate search is dry-run against your live data before you ever see it — you always review real entity counts and sample results first. The advisor only proposes; the tracker is created through the wizard’s own create step, with your credentials, on your explicit click.
Requirements¶
An AI provider must be configured — the feature (like the whole AI layer) is opt-in and inert until then. See Configuring AI Provider accounts. The Generate with AI button only appears once at least one provider is available.
The advisor runs on the same Splunk 10.2.x+ / Python 3.13.x requirement as the rest of the AI Advisors. See Artificial Intelligence in TrackMe for compatibility.
Your role must be allowed to create Flex Objects trackers in the tenant (the create step uses your own credentials, exactly as the manual flow does).
Where to find it¶
Open the Flex Objects tracking — create a new tracker wizard (Tenant Home → Flex Objects → create a new tracker) and go to step 2 — Use case & search logic. Alongside the manual options (pre-load a use case from the library, or write the search by hand) you will find the Generate with AI button.
Walkthrough¶
1. Choose a provider and describe what to monitor¶
Clicking Generate with AI opens the generation panel as a side drawer, so the wizard stays visible underneath. At the top, pick the AI provider / model to use for this run — a deliberate choice, because drafting and dry-running SPL is a token-heavy operation and different models trade off cost against quality.
Then describe, in plain language, what you want to monitor: the data source, the metric(s) that matter, what “bad” looks like, and any silence/inactivity concern. The tracker settings shown as controls below the description (account, earliest, latest, cron, name prefix) are the starting constraints the dry-run will use — they are fully editable here, exactly as if you set them on the wizard’s own steps.
In this example the operator asks to monitor the number of SSH sessions from a sourcetype, per index, and to use outlier detection to flag an abnormal number of sessions.
2. Generate¶
Click Generate tracker. The agent works in front of you: a live tool-call feed shows it pulling
the closest use-case template (get_flx_use_case_definition) and then dry-running the candidate
search (run_flx_tracker_dry_run). Each dry-run is capped and read-only — you can Cancel run at
any time.
3. Review the validated proposal¶
When the agent finishes you get a complete proposal whose evidence comes from the last successful dry-run of the exact SPL being proposed — never a proposal without live results. It includes:
a summary of what the tracker monitors and which template it was grounded on;
the dry-run evidence — the number of entities found and a sample of them (object / group / status / metrics), so you can confirm the search behaves as intended before creating it;
the proposed tracker search (the SPL), and grounding/schedule chips (template used, account, cron, earliest, latest, name).
Scrolling down, the proposal also surfaces starter threshold recommendations and confidence notes (what was assumed, what could not be verified — e.g. a field name that may need adjusting), and a collapsible reasoning trace.
Note
The proposed thresholds are recommendations to apply after creation — the Flex Objects create step does not take thresholds directly. They give you a calibrated starting point you (or the AI FLX Threshold Advisor later) can apply on the new entities.
4. Refine (optional, repeatable)¶
If the proposal is close but not quite right, you do not start over. Use Not quite right? at the bottom of the result: type what should change (for example “use a different field for the distinct count” or “aggregate over 15 minutes instead of 5”) and click Re-generate with feedback. The agent iterates on the previous proposal — keeping everything you did not contest, applying your feedback, and re-validating with a fresh dry-run. Repeat until you are happy.
5. Apply to the wizard¶
When the proposal is right, click Apply to wizard form. The drawer closes and the wizard jumps to step 4 — Test and Configure, pre-filled with the proposed search, metrics, default metric and schedule, and it re-runs the wizard’s own simulation so you immediately see the live entities in the wizard’s own panel.
From here it is the standard Flex Objects creation flow — review the metrics and thresholds, adjust anything you want, set the cron schedule, and create the tracker. Nothing about creation is AI-driven; you are simply finishing the wizard you would have used manually, with the hard part already done. See Creating a Flex Tracker for the manual steps.
6. The tracker is live¶
Once created, the new Flex Objects tracker behaves like any other — its entities appear on Tenant Home, are scored and alertable, and participate in the full TrackMe feature set.
Because the description in this example asked for outlier detection, the generated tracker is configured for it: the entity overview shows the live KPI, and the Outliers anomaly detection tab shows the native ML model already tracking the per-index session counts.
Good to know¶
The AI proposes, you create. The advisor never calls the tracker-create endpoint. Creation always happens through the wizard’s own create step, with your credentials — so license limits, name sanitisation and the audit trail all flow through the proven path.
Always dry-run-validated. A proposal’s entity counts and samples always come from a real dry-run of the exact SPL being proposed. If the data is sparse or a field name is uncertain, the agent says so in the confidence notes rather than hiding it.
Editable settings. Account, time window, cron and name prefix are editable in the panel and mirror straight into the wizard form. The AI may still adjust the schedule/window to fit the chosen use case; whatever the final proposal returns is what Apply writes.
Provider choice matters. Generation is token-heavy and iterative — pick the model that fits your cost/quality preference at the top of the panel.
Interactive only. Tracker generation is a wizard-time, human-in-the-loop capability — there is no unattended/automated generation path. (The AI Advisors automation schedule covers inspect/act remediation, not creation.)
Audited. Like every AI action, generation runs are recorded. In the Review AI Advisor activity dashboard they appear under their own FLX Generation category (distinct from FLX threshold tuning). See Auditing AI activity.