Configuring AI Provider accounts

Overview

Every TrackMe AI capability — the AI Assistant, the AI Advisors, the AI Concierge, AI Agents automation, and the AI status report in stateful-alert emails — runs through an AI provider account: a stored connection to an LLM endpoint. This is the foundational step of the AI journey.

You can configure one or more provider accounts (for model comparison, cost optimisation, redundancy, or data-residency reasons), and TrackMe is provider-agnostic — the same AI code runs across OpenAI, Azure OpenAI, Anthropic, Google Gemini, Mistral AI, Ollama, any OpenAI-compatible endpoint, and Splunk’s own hosted models.

Important

Opt-in only — Until at least one provider account is configured, the entire AI layer is completely inert: no data is sent to any external service and no LLM calls are made. The choice of provider is yours — from fully air-gapped on-premises models to managed cloud services — and no data is ever shared between configured providers.

Tip

Full control over your AI infrastructure — Organisations with strict data privacy, data sovereignty, or regulatory requirements retain complete control over which AI provider is used and where data is processed. TrackMe can be connected to:

• Splunk’s own hosted LLMs via the Splunk Hosted (SLIM API) provider type on Splunk Cloud, with zero configuration beyond selecting the provider and model — no API keys, no base URL, fully managed by the Splunk platform

• Self-hosted open-source LLMs via Ollama, keeping all data entirely on-premises with zero external API calls

• Private or corporate LLM deployments via the Custom (OpenAI-compatible) provider type, enabling integration with any internally hosted endpoint that implements the OpenAI chat completions format

• Cloud providers of your choice, including region-specific deployments (e.g. Azure OpenAI in a specific geography) to meet data residency requirements

Managing provider accounts

In TrackMe 2.4.0, provider accounts are managed from a dedicated page reachable from the top navigation: Artificial Intelligence > Manage AI Provider accounts.

The page lists every configured provider account with its provider type, enabled state, model, base URL, and last connectivity test result. From here you can Add provider, Test all, and — from the per-row actions menu — Edit, Clone, Test connectivity, or Delete an account.

When you click Add provider, the Add AI provider modal opens. Give the account a unique name, pick the provider backend, and fill in the fields that apply to that backend — only the relevant fields are shown for the selected provider. The example below configures an Anthropic (Claude) account using the claude-haiku-4-5 model; the Pick a suggested model dropdown shows common values for convenience.

Note

The account Name is the unique stanza identifier (lower-case letters, digits and underscores only) and cannot be changed after creation. Disabled accounts stay configured but are hidden from the AI Assistant provider selector and skipped by the stateful-alert AI status report.

Provider Fields

Field	Default	Description
AI Provider	OpenAI	The AI provider type. Supported values: OpenAI, Azure OpenAI, Anthropic (Claude), Google Gemini, Mistral AI, xAI (Grok), Ollama (local / self-hosted), Custom (OpenAI-compatible), Splunk Hosted (SLIM API).
Base URL	(optional)	The base URL for the AI provider API. Required for all providers except Splunk Hosted, which auto-discovers its endpoint from the Splunk Cloud platform. See the Supported Providers section below for provider-specific URLs.
Azure API Version	2024-10-21	Required for Azure OpenAI only. The API version to use (e.g. 2024-10-21). See Azure OpenAI documentation for available versions.
API Key	(optional)	The API key for authenticating with the AI provider. Stored encrypted via Splunk storage_passwords and cannot be retrieved again once saved. Leave empty for providers that do not require authentication (e.g. Ollama, Splunk Hosted).
Model	gpt-4o	The model name to use. Some providers support version aliases (e.g. gpt-4o, mistral-large-latest) that always target the latest release. See Model Aliases below.
Max Tokens	4096	Maximum number of tokens in the AI response. Higher values allow longer responses but increase cost and latency.
Temperature	0.3	Controls randomness in AI responses. Lower values (e.g. 0.1) produce more deterministic outputs, higher values (e.g. 0.8) produce more creative outputs.
Request Timeout	600	Maximum time in seconds to wait for an AI provider response. The default of 600 seconds (10 minutes) accommodates slow models or initial model downloads (e.g. Ollama pulling a model on first use).
Context Window (Ollama)	8192	Context window size in tokens for Ollama models. Must be large enough to accommodate the system prompt, context data, and conversation history. Only applies to the Ollama provider. Increase this value if context is being truncated.
Custom Prompt	(empty)	Optional additional instructions appended to the system prompt. Use this to customise the AI assistant’s behaviour, add domain-specific context, or enforce response formatting preferences.

Tip

Use Test connectivity (per-row) or Test all after creating an account to validate the endpoint, credentials, and model name before relying on the provider. The test calls POST /trackme/v2/ai/admin/test under the hood.

Supported Providers

Named Providers

The following providers are explicitly supported with dedicated dropdown options. All use the OpenAI chat completions API format except Anthropic (which uses its native Messages API) and Splunk Hosted (which uses the SLIM API with automatic SCS authentication).

OpenAI

• Provider: OpenAI

• Base URL: https://api.openai.com/v1

• API Key: Required (from platform.openai.com)

• Example models: gpt-4o, gpt-4o-mini, gpt-4.1, o4-mini

Azure OpenAI

• Provider: Azure OpenAI

• Base URL: https://<resource-name>.openai.azure.com/openai/deployments/<deployment-name>

• API Key: Required (Azure portal)

• Azure API Version: Required (e.g. 2024-10-21)

• Example models: Use the deployment name configured in Azure

Note

Azure OpenAI uses a different authentication mechanism (api-key header instead of Authorization: Bearer) and requires a mandatory api-version query parameter. TrackMe handles both automatically when the Azure provider type is selected.

Anthropic

• Provider: Anthropic (Claude)

• Base URL: https://api.anthropic.com/v1

• API Key: Required (from console.anthropic.com)

• Example models: claude-sonnet-4-5-20250929, claude-sonnet-4-20250514, claude-haiku-4-5, claude-opus-4-6-20260213

Note

Anthropic does not support -latest aliases. Use either generation-specific aliases (e.g. claude-sonnet-4-5) which auto-update within a generation, or pinned snapshot IDs (e.g. claude-sonnet-4-5-20250929) for deterministic behaviour. See Anthropic’s model documentation for the full list.

Note

Anthropic uses a native Messages API rather than the OpenAI chat completions format. TrackMe automatically handles the API differences when the Anthropic provider type is selected.

Google Gemini

• Provider: Google Gemini

• Base URL: https://generativelanguage.googleapis.com/v1beta/openai

• API Key: Required (from Google AI Studio)

• Example models: gemini-3-flash-preview, gemini-3-pro-preview, gemini-2.5-flash, gemini-2.5-pro

Note

Google Gemini uses its OpenAI-compatible endpoint for integration. The API key is passed as a Bearer token in the Authorization header, which TrackMe handles automatically. Gemini 3 models are currently in preview and use the -preview suffix in their model names.

Mistral AI

• Provider: Mistral AI

• Base URL: https://api.mistral.ai/v1

• API Key: Required (from console.mistral.ai)

• Example models: mistral-small-latest, mistral-medium-latest, mistral-large-latest

Ollama

• Provider: Ollama (local / self-hosted)

• Base URL: http://<ollama-host>:11434/v1

• API Key: Not required

• Example models: mistral, llama3.2, phi3, qwen2.5

Hint

Ollama is a self-hosted inference server that provides full data privacy and control over your AI infrastructure. It runs powerful open-source models without sending any data to external APIs, making it ideal for environments with strict data governance requirements or air-gapped networks. On first use with a new model, TrackMe automatically triggers the model download on the Ollama server, which can take several minutes. The default request timeout of 600 seconds accommodates this.

Splunk Hosted (SLIM API)

• Provider: Splunk Hosted (SLIM API)

• Base URL: Leave empty (auto-discovered)

• API Key: Not required (auto-managed)

• Example models: gpt-oss-120b, gpt-oss-20b, foundation-sec-1.1-8b-instruct

Important

The Splunk Hosted (SLIM API) provider is only available on Splunk Cloud instances where Splunk has enabled the SLIM (Splunk Language and Intelligence Model) API. It is not available on Splunk Enterprise (on-premises) deployments.

How it works:

Unlike all other provider types, Splunk Hosted requires no manual credential or endpoint configuration:

• No Base URL: The SLIM API endpoint is automatically discovered from the Splunk Cloud platform using the SCS (Splunk Cloud Services) tenant information. Leave the Base URL field empty.

• No API Key: Authentication uses short-lived SCS tokens that are transparently obtained and refreshed by TrackMe at each request. No API key needs to be entered or managed.

• Model selection: You only need to choose a model. Available models can be discovered via the TrackMe REST API (see below).

Discovering available models:

You can query the available SLIM API models using the TrackMe REST API:

| trackme url="/services/trackme/v2/ai/admin/models" mode="get"

This returns the list of models currently available on your Splunk Cloud instance, including their model_name (display name) and model_id (the value to enter in the Model configuration field).

Hint

About the models — gpt-oss-120b is a ~117B parameter Mixture of Experts model suitable for general-purpose tasks requiring high quality. gpt-oss-20b is a smaller ~21B parameter model offering faster responses at lower cost. foundation-sec-1.1-8b-instruct is a security-focused model designed for cybersecurity analysis and security operations use cases. Model availability may vary depending on your Splunk Cloud deployment and entitlements.

Custom (OpenAI-Compatible)

The Custom provider type works with any API endpoint that implements the OpenAI chat completions format (POST /chat/completions). This includes a wide range of enterprise and open-source providers:

Provider	Base URL	Example Models
xAI (Grok)	https://api.x.ai/v1	grok-3, grok-3-mini
Together AI	https://api.together.xyz/v1	meta-llama/Llama-3-70b-chat-hf
Groq	https://api.groq.com/openai/v1	llama-3.3-70b-versatile, mixtral-8x7b-32768
Perplexity	https://api.perplexity.ai	sonar-pro, sonar
Cohere	https://api.cohere.com/compatibility/v1	command-r-plus, command-r
AWS Bedrock	https://bedrock-runtime.<region>.amazonaws.com/openai/v1	anthropic.claude-sonnet-4-20250514-v1:0
DeepSeek	https://api.deepseek.com/v1	deepseek-chat, deepseek-reasoner
OpenRouter	https://openrouter.ai/api/v1	Any model available on OpenRouter
NVIDIA NIM	http://<nim-host>:8000/v1	Depends on deployed model
LM Studio	http://<lmstudio-host>:1234/v1	Depends on loaded model

Note

When using the Custom provider type, ensure that the API endpoint is reachable from the Splunk search head running TrackMe and that it supports the standard OpenAI chat completions request and response format.

Note

A note on GitHub Copilot — GitHub Copilot is not a supported AI provider. Although community projects exist that proxy Copilot’s internal endpoint (api.githubcopilot.com) as an OpenAI-compatible API, this endpoint is not an officially supported public API. It is designed exclusively for GitHub’s own IDE extensions (VS Code, JetBrains, CLI), and using it through third-party applications violates GitHub’s Terms of Service. Relying on it would expose your organisation to account suspension risk and potential breakage without notice. If you are in the Microsoft/GitHub ecosystem, use Azure OpenAI or OpenAI directly instead — these provide official, stable API access to the same underlying models that power Copilot.

Model Aliases

Some providers support version aliases that always point to the latest release of a model family. Using aliases avoids having to update the configuration when a new model version is released:

• Mistral: mistral-small-latest, mistral-medium-latest, mistral-large-latest — auto-update to the newest version within each model tier.

• OpenAI: gpt-4o, gpt-4o-mini — effectively aliases that point to the latest patch.

• Anthropic: Does not support -latest aliases. Use generation-specific aliases (e.g. claude-sonnet-4-5) or pinned snapshot IDs (e.g. claude-sonnet-4-5-20250929).

Check your provider’s documentation for available aliases and version pinning options.

Multi-Provider Setup

TrackMe supports configuring multiple AI providers simultaneously. This is useful for:

• Model comparison: Try different models on the same question to compare analysis quality

• Cost optimisation: Use a cheaper model for routine questions and a premium model for complex investigations

• Redundancy: Fall back to an alternative provider if the primary is unavailable

• Data privacy: Run Ollama alongside a cloud provider — use the self-hosted option for sensitive environments and the cloud provider for general use

• Platform-native option: On Splunk Cloud, use Splunk Hosted alongside external providers — keep data within the Splunk platform while having an external model available as an alternative

To set up multiple providers, create multiple accounts on the Manage AI Provider accounts page, each with a descriptive name (e.g. openai_gpt4o, ollama_mistral, anthropic_claude).

When multiple providers are available, users see a provider selector dropdown in the AI chat panel that displays each provider’s name and model, and the AI Advisors and Concierge let you pick which provider to run with.

Global AI settings

Beyond provider accounts, a small set of global toggles live under Configuration > General, in the Artificial Intelligence group. These control the AI Assistant feature switch, the concurrency cap, and data anonymisation.

Setting	Default	Description
Enable AI assistant	Yes	Enable or disable the AI assistant feature across all TrackMe UIs. When disabled, the AI assistant button is hidden from all users.
Max concurrent AI chats	10	Maximum number of concurrent AI chat requests across all users. Additional requests are rejected with an HTTP 429 response until a slot becomes available.
Anonymize entity names for AI	No	When enabled, entity names (object and alias fields) are anonymized using SHA256 hashing in describe endpoint responses consumed by AI providers. This protects potentially sensitive infrastructure details (hostnames, IPs, machine names) while preserving the object_id for entity identification. The AI assistant is guided to use object_id references instead of entity names.
Anonymize index names for AI	No	When enabled, Splunk index names are anonymized using SHA256 hashing in describe endpoint responses consumed by AI providers. This applies to data source (DSM), data host (DHM), and metric host (MHM) entities. Index names are replaced with their SHA256 hashes in entity information, investigation searches, and metric details. Investigation searches will contain hashed index names that users must replace with actual values before execution.

Note

The global Enable AI assistant toggle is enabled by default so that administrators can discover the feature, but — as stated above — no AI functionality is active until at least one provider account is configured.

Next steps

With at least one provider account configured, you are ready to use the rest of the AI layer:

• AI Assistant — the conversational assistant.

• The AI Advisors — the AI Advisor family (inspect / act).

• The AI Concierge — the catalog-driven AI Concierge.

• AI Agents automation — running the advisors unattended.