Product

An AI assistant for Splunk administrators

Updated November 3, 2026 · Ayrix Labs

Short answer: Drew is an AI teammate for Splunk administrators, made by Ayrix Labs and in early access. You connect your Splunk through Splunk's MCP Server app, then ask Drew in Slack or in its web app. Drew runs the Splunk searches itself and answers with text, tables or charts.

What Drew does today

Answers from your own Splunk. Ask in plain English in Slack or the web app. Drew runs the SPL searches through your Splunk MCP Server and answers with text, tables or charts.
Says whether each answer was checked. Every answer that states figures is marked Verified (a search this turn returned the data), Likely (figures from an earlier search, with when) or Not checked. The label is decided by code from what actually ran, not by the model.
Maps your stack first. After you connect, Drew builds a map of your deployment from read-only searches: indexes, sourcetypes, hosts, saved searches and daily license usage. It uses the map to answer faster, and still runs live searches when the map is empty.
Asks before anything changes. Read-only tools run on their own. In the web app, any tool that is not marked read-only asks you first, and a tool whose name says it deletes always asks. In Slack, Drew offers only tools that need no approval.
Keeps credentials out of the model. Your Splunk token is stored server-side and never passes through the model or the logs.

Questions admins ask Drew

Which indexes used the most license yesterday, and what changed from last week?
Which scheduled searches are being skipped, and why?
Which hosts stopped sending data in the last 24 hours?
What sourcetypes land in the main index, and from which hosts?
Who owns the saved searches that read the firewall index?

Drew answers each one by running searches against your deployment, not from a generic template, and tells you whether the figures were checked this turn.

How it connects

Install Splunk's MCP Server app on your search head (Splunk Enterprise or Splunk Cloud Platform) and create a token for it.
In Drew, an owner or admin opens Settings, Integrations, Add MCP server, and enters the server URL and token. The token is stored server-side.
Drew maps your stack from read-only searches, then you can ask it anything in Slack or the web app.

Who it is for

Team	What Drew takes on
MSPs and MSSPs	Questions across many customer stacks without a senior admin on every one.
Splunk admins and SREs	The health questions that never make the roadmap: license, skipped searches, quiet hosts.
Splunk consultants	Getting oriented on a new estate quickly: what data is where, and what runs on it.

Safety model

Drew can only use the tools your MCP servers expose. Read-only tools run on their own; in the web app anything else asks a person first, in Slack Drew offers only tools that need no approval, and an owner or admin can switch any tool off. Drew is early-access software from Ayrix Labs and is not affiliated with Splunk.

Drew is taking a small group of MSPs, Splunk teams and consultants into early access. Request access or email hello@rundrew.com.

Questions

Is there an AI assistant for Splunk administration?

Drew is an AI teammate for Splunk administrators, made by Ayrix Labs and in early access. You connect your Splunk through Splunk's MCP Server app, then ask Drew in Slack or in its web app. Drew runs the Splunk searches itself and answers with text, tables or charts.

Does Drew need write access to Splunk?

No. Drew answers from searches, which only need read access. Any tool that is not marked read-only asks you before it runs.