Gets better every day it runs
Give Drew the Splunk shift.
An AI teammate that runs alongside your team. Never sleeps — picks up the broken forwarder at 2am and hands you the fix before you ask. You approve every change.
Drew · teammate · just now
Took the Monday KV-store stack on sh-02. Lookups are failing in ES because the CA in etc/auth expired — server.pem was renewed, the chain was not.
I drafted the rotate from runbook ssl-ca-rotate, with backup + rollback. Ready when you are.
- 1 backup etc/auth/cacert.pem
- 2 install renewed CA bundle
- 3 restart splunkd · verify kvstore = ready
How Drew works
Give Drew the Splunk backlog.
- Expired CA in etc/authfixed
- Forwarder stopped phoning homefixed
- Blocking outputs.conf cloneawaiting you
- Deployment server app driftfixed
- Index nearing frozen limitdrafted
- Stale KV store collectionfixed
- Cert renewal on hf-02drafted
- Skipped searches on sh-01fixed
- Expired CA in etc/authfixed
- Forwarder stopped phoning homefixed
- Blocking outputs.conf cloneawaiting you
- Deployment server app driftfixed
- Index nearing frozen limitdrafted
- Stale KV store collectionfixed
- Cert renewal on hf-02drafted
- Skipped searches on sh-01fixed
- 01
Joins the team
An AI teammate for Splunk that runs alongside your team — in Slack and your console. Same estate, same bar for quality.
- 02
Owns the toil
Owns the toil, not just the ticket. Configs, certs, forwarders, KV store, deployment server — give Drew the Splunk backlog.
- 03
Shows its work
Shows its work. Every diagnosis and proposed change is visible — what it found, what it wants to do, and how it rolls back.
- 04
You stay in charge
You set the guardrails. Drew does the rest — and still waits for your yes before anything writes.
- 05
Learns from every review
Gets better every day it runs. Each approval and rejection teaches Drew how your estate actually works, then it takes on more.
You set the guardrails. Drew does the rest.
Example
Blocking outputs.conf
Clones to two destinations. One goes down. The healthy path stalls too because the output blocks — and the monitor goes quiet. Drew catches it on the estate and brings you a reversible fix.
Example
KV store / expired CA
KV store won't start because a CA in etc/auth expired. Lookups vanish and Enterprise Security looks broken even though server.pem was renewed. Drew diagnoses the chain and prepares the rotate.
Compounds
Gets better every day it runs.
Every fix, approval and rejection becomes context. The longer Drew runs on your estate, the more of the backlog it can own.
day 1 · read-only
day 30 · runbooks
day 90 · your estate
Learns your Splunk before it touches anything
Your indexes, apps, naming, owners, and how your team likes changes made — not a generic template.
Your Splunk changes. Drew keeps up.
Every fix, approval and rejection compounds. Day 90 Drew knows things day 1 Drew didn't.
Grow your Splunk without growing the admin team
Scale environments and customers without scaling headcount 1:1.
Who it's for
Built for teams that live in Splunk.
MSPs & MSSPs
One team covering many customer stacks. Drew takes admin load so you scale environments without scaling headcount 1:1.
Splunk admins & SREs
An extra teammate for the work that never makes the roadmap — estate health, boring failures, Monday cleanup.
Specialist consultants
Drop Drew onto a new estate and get productive coverage fast, without burning a senior on every health check.
Trust
Simple on the surface. Serious about your production data.
every loop
makes the next one better
Read-only first
Learns your Splunk before it touches anything. Starts read-only. You grant write per runbook when you're ready.
Human in the loop
Shows its work. Waits for your yes. No silent writes.
Logged & reversible
Every action lands in an audit trail, with a rollback for each change.
Your cloud or ours
Simple on the surface. Serious about your production data — hosted, or inside your own VPC.
FAQ
Questions Splunk teams ask about Drew.
What is Drew?
Drew is an AI teammate for Splunk administrators, made by Ayrix Labs and in early access. You connect your Splunk through Splunk's MCP Server app, then ask Drew in Slack or in its web app. Drew runs the Splunk searches itself and answers with text, tables or charts.
How does Drew connect to Splunk?
Through Splunk's own MCP Server app (Splunkbase app 7931), installed on your search head. An owner or admin adds the server's URL and token in Drew under Settings, Integrations. Drew then runs searches through that server; the token is stored server-side and never sent to the model.
Does Drew work with Splunk Cloud and Splunk Enterprise?
Drew works with any Splunk deployment that can run the Splunk MCP Server app. Splunk documents that app for both Splunk Enterprise and Splunk Cloud Platform.
Can Drew change my Splunk without asking?
No. Read-only tools run on their own. In the web app every other tool asks a person first, and a tool whose name says it deletes always asks; in Slack, Drew offers only tools that need no approval. An owner or admin can switch any tool off.
How is Drew different from Splunk AI Assistant for SPL?
Splunk AI Assistant for SPL lives inside Splunk Web and helps you write, explain and optimize SPL. Drew is a teammate in Slack and its own web app that runs the searches itself and answers admin questions about your deployment. They can be used together. See the comparison.
Where can I use Drew?
In Slack, once your workspace installs the Drew app and you link your account, and in Drew's web app.
How much does Drew cost?
Drew is in early access with design partners. Pricing is not public yet; early partners get early pricing locked in.
Is Drew affiliated with Splunk?
No. Drew is made by Ayrix Labs. Splunk is a trademark of Splunk LLC.
Guides
Splunk admin answers, with the SPL to run.
- How to check Splunk license usage by index, sourcetype and host
SPL searches to see Splunk license usage per index, sourcetype and host, daily usage against your quota, and why host and source can come back empty.
- Splunk health check: a practical checklist with searches
A Splunk health check checklist with the SPL for each item: skipped searches, blocked queues, quiet hosts, parsing errors, license, indexes, certificates and KV store.
- Splunk skipped searches: how to find the cause and fix it
Find which Splunk scheduled searches are skipped and why, with SPL for the skip ratio and reasons, and the fixes for concurrency limits and long-running searches.
- Splunk forwarder not sending data: a troubleshooting guide
Step-by-step checks when a Splunk universal forwarder stops sending data: find quiet hosts, check the connection, outputs.conf, inputs, missing indexes and timestamps.
- Onboarding data in Splunk: props.conf for line breaking and timestamps
Set props.conf so Splunk breaks events and reads timestamps right: LINE_BREAKER, SHOULD_LINEMERGE, TIME_PREFIX, TIME_FORMAT, where each goes, how to test.
- Splunk blocked queues: how to find the bottleneck
Read Splunk's indexing pipeline queues in metrics.log, find which queue blocks first, and fix the usual causes: slow disk, heavy regex, and blocked outputs.
- Splunk KV store not starting: causes and checks
Why the Splunk KV store fails to start and how to check: kvstore-status, mongod.log, expired certificates and CA chains, port 8191, disk space and permissions.
Comparing tools? Drew vs Splunk AI Assistant for SPL.
Design partners
Admin Splunk like your best admin would — every day.
Never sleeps. Picks up the broken forwarder at 2am. Hands you the fix before you ask.
We're taking a small group of MSPs, Splunk teams and consultants into early access. Partners get:
- →A read-only health review of your estate
- →Direct line to the team while Drew works your stack
- →Runbooks shaped around your failures, not ours
- →Early pricing locked in
Prefer email? hello@rundrew.com