[Splunk AI Assistant (Preview) - Telemetry]
action.email.sendresults                   = 0
action.outputtelemetry                     = 1
action.outputtelemetry.param.anonymous     = 1
action.outputtelemetry.param.support       = 0
action.outputtelemetry.param.license       = 0
action.outputtelemetry.param.optinrequired = 3
action.outputtelemetry.param.component     = app.Splunk_AI_Assistant.splgen
action.outputtelemetry.param.input         = data
action.outputtelemetry.param.type          = aggregate
alert.track                                = false
counttype                                  = number of events
relation                                   = greater than
quantity                                   = 0
cron_schedule                              = 33 3 * * *
description                                = Sends anonymous operational data
disabled                                   = False
dispatch.earliest_time                     = -1d@d
dispatch.latest_time                       = @d
enableSched                                = 1
is_visible                                 = false
schedule_window                            = auto
search                                     = index="_internal" source="*splgen.log*" \
| rex field=_raw "PID (?<PID>\d+)" \
| stats values(*) as *, max(columns) as maxColumns, sum(rows) as numRows by PID \
| sort _time \
| stats values(*) as *, max(columns) as maxColumns, sum(rows) as numRows by PID, UUID \
| eval build_type="prod" \
| fields PID UUID command apply_time build_type \
| head 1000 \
| makejson output=data \
| table data

[Splunk AI Assistant (Preview) - Feedback Telemetry]
action.email.sendresults                   = 0
action.outputtelemetry                     = 1
action.outputtelemetry.param.anonymous     = 1
action.outputtelemetry.param.support       = 0
action.outputtelemetry.param.license       = 0
action.outputtelemetry.param.optinrequired = 3
action.outputtelemetry.param.component     = app.Splunk_AI_Assistant.splgen.usage
action.outputtelemetry.param.input         = data
action.outputtelemetry.param.type          = aggregate
alert.track                                = false
counttype                                  = number of events
relation                                   = greater than
quantity                                   = 0
cron_schedule                              = 33 3 * * *
description                                = Sends anonymous feedback data
disabled                                   = False
dispatch.earliest_time                     = -1d@d
dispatch.latest_time                       = @d
enableSched                                = 1
is_visible                                 = false
schedule_window                            = auto
search                                     = index="splgen_fb" \
| fields query, response, session_id, correct \
| head 1000 \
| makejson output=data \
| table data