DrewComparison
Drew vs Splunk AI Assistant for SPL vs a chatbot with the Splunk MCP Server
Updated · Ayrix Labs
Short answer: Splunk AI Assistant for SPL helps you write, explain and optimize SPL inside Splunk Web. A general chatbot with the Splunk MCP Server can run searches for one person. Drew is a shared admin teammate in Slack and the web that runs the searches, maps your stack and marks whether each answer was checked.
At a glance
| Splunk AI Assistant for SPL | Chatbot + Splunk MCP Server | Drew | |
|---|---|---|---|
| Made by | Splunk | Your chatbot vendor plus Splunk's MCP app | Ayrix Labs |
| Where you use it | Inside Splunk Web | Your own desktop or IDE client | Slack and Drew's web app |
| Main job | Write, explain and optimize SPL; answer Splunk questions | Whatever you prompt it to do | Answer admin questions about your deployment |
| Runs searches on your data | You run the SPL it writes | Yes, through the MCP Server | Yes, through the MCP Server |
| Shared by a team | Per Splunk user | Per person | Per organization, with roles |
| Knows your stack | Opt-in personalization from your environment's metadata | Only what it finds in the chat | Maps indexes, sourcetypes, hosts, saved searches and license first |
| Says whether figures were checked | Not applicable: it writes SPL and you run it | Depends on the client | Verified, Likely or Not checked on every answer with figures |
| Status | Generally available | Generally available (MCP Server app) | Early access |
When to use Splunk AI Assistant for SPL
Use it when you are in Splunk Web writing a search and want help with SPL itself: turning a question into a query, explaining a long search, or making one faster. It also answers questions from Splunk's documentation. It runs where your data already is, and Splunk documents its data handling.
When to use a chatbot with the Splunk MCP Server
Splunk's MCP Server app lets an MCP client such as Claude, Cursor or another assistant run splunk_run_query and related tools against your Splunk. It is a good fit for one engineer exploring data from their own client. Each person configures it themselves, and nothing is shared across the team.
When to use Drew
Use Drew when the team wants one Splunk teammate everyone can ask in Slack, that already knows the layout of the deployment and is clear about whether a number was checked. Drew uses the same Splunk MCP Server, so it can sit beside Splunk AI Assistant for SPL: if the AI Assistant is installed, the MCP Server exposes its SPL tools too.
- Answers from your own Splunk. Ask in plain English in Slack or the web app. Drew runs the SPL searches through your Splunk MCP Server and answers with text, tables or charts.
- Says whether each answer was checked. Every answer that states figures is marked Verified (a search this turn returned the data), Likely (figures from an earlier search, with when) or Not checked. The label is decided by code from what actually ran, not by the model.
- Maps your stack first. After you connect, Drew builds a map of your deployment from read-only searches: indexes, sourcetypes, hosts, saved searches and daily license usage. It uses the map to answer faster, and still runs live searches when the map is empty.
- Asks before anything changes. Read-only tools run on their own. In the web app, any tool that is not marked read-only asks you first, and a tool whose name says it deletes always asks. In Slack, Drew offers only tools that need no approval.
- Keeps credentials out of the model. Your Splunk token is stored server-side and never passes through the model or the logs.
Drew is taking a small group of MSPs, Splunk teams and consultants into early access. Request access or email hello@rundrew.com.
Questions
Can I use Drew and Splunk AI Assistant for SPL together?
Yes. Drew connects through the Splunk MCP Server, and when Splunk AI Assistant for SPL is installed the MCP Server also exposes its SPL tools (such as generating and explaining SPL).
Is Drew made by Splunk?
No. Drew is made by Ayrix Labs and is not affiliated with Splunk.