# Drew

> Drew is an AI teammate for Splunk administrators, made by Ayrix Labs and in early access. You connect your Splunk through Splunk's MCP Server app, then ask Drew in Slack or in its web app. Drew runs the Splunk searches itself and answers with text, tables or charts.

Drew is in early access. It is made by Ayrix Labs and is not affiliated with Splunk. Contact: hello@rundrew.com.

What Drew does today:

- **Answers from your own Splunk.** Ask in plain English in Slack or the web app. Drew runs the SPL searches through your [Splunk MCP Server](https://splunkbase.splunk.com/app/7931) and answers with text, tables or charts.
- **Says whether each answer was checked.** Every answer that states figures is marked Verified (a search this turn returned the data), Likely (figures from an earlier search, with when) or Not checked. The label is decided by code from what actually ran, not by the model.
- **Maps your stack first.** After you connect, Drew builds a map of your deployment from read-only searches: indexes, sourcetypes, hosts, saved searches and daily license usage. It uses the map to answer faster, and still runs live searches when the map is empty.
- **Asks before anything changes.** Read-only tools run on their own. In the web app, any tool that is not marked read-only asks you first, and a tool whose name says it deletes always asks. In Slack, Drew offers only tools that need no approval.
- **Keeps credentials out of the model.** Your Splunk token is stored server-side and never passes through the model or the logs.

## Product

- [An AI assistant for Splunk administrators](https://rundrew.com/splunk-ai-assistant.md): Drew is an AI teammate for Splunk admins. Ask in Slack or the web, and it runs the searches on your Splunk through the Splunk MCP Server. Early access.
- [Drew vs Splunk AI Assistant for SPL vs a chatbot with the Splunk MCP Server](https://rundrew.com/compare/splunk-ai-assistant-for-spl.md): How Drew, Splunk AI Assistant for SPL and general chatbots using the Splunk MCP Server differ for Splunk admin work, and when to use each.

## Splunk admin guides

- [How to check Splunk license usage by index, sourcetype and host](https://rundrew.com/guides/splunk-license-usage.md): SPL searches to see Splunk license usage per index, sourcetype and host, daily usage against your quota, and why host and source can come back empty.
- [Splunk health check: a practical checklist with searches](https://rundrew.com/guides/splunk-health-check.md): A Splunk health check checklist with the SPL for each item: skipped searches, blocked queues, quiet hosts, parsing errors, license, indexes, certificates and KV store.
- [Splunk skipped searches: how to find the cause and fix it](https://rundrew.com/guides/splunk-skipped-searches.md): Find which Splunk scheduled searches are skipped and why, with SPL for the skip ratio and reasons, and the fixes for concurrency limits and long-running searches.
- [Splunk forwarder not sending data: a troubleshooting guide](https://rundrew.com/guides/splunk-forwarder-not-sending-data.md): Step-by-step checks when a Splunk universal forwarder stops sending data: find quiet hosts, check the connection, outputs.conf, inputs, missing indexes and timestamps.
- [Onboarding data in Splunk: props.conf for line breaking and timestamps](https://rundrew.com/guides/splunk-props-conf-data-onboarding.md): Set props.conf so Splunk breaks events and reads timestamps right: LINE_BREAKER, SHOULD_LINEMERGE, TIME_PREFIX, TIME_FORMAT, where each goes, how to test.
- [Splunk blocked queues: how to find the bottleneck](https://rundrew.com/guides/splunk-blocked-queues.md): Read Splunk's indexing pipeline queues in metrics.log, find which queue blocks first, and fix the usual causes: slow disk, heavy regex, and blocked outputs.
- [Splunk KV store not starting: causes and checks](https://rundrew.com/guides/splunk-kv-store-not-starting.md): Why the Splunk KV store fails to start and how to check: kvstore-status, mongod.log, expired certificates and CA chains, port 8191, disk space and permissions.

## Optional

- [Full text of every page](https://rundrew.com/llms-full.txt)
- [Request early access](https://rundrew.com/#apply)
- [Privacy](https://rundrew.com/privacy)