Chatting with Agents

Start conversations with your agents, manage history, switch between agents, and share conversations. This page covers the chat workflow and tips for effective use.

Parent: Agents
Previous: Agent Templates
Related: Your First Agent | Understanding Agents | Agent Skills

Starting Conversations

Open an agent from the Agents list and click into the chat area. Type your question or request in the input box and send. The agent responds using its system prompt and attached tools. You can ask follow-up questions in the same thread — the agent keeps context from the conversation.

If a send fails before the chat session connects to the streaming transport, your message is restored in the input box so you can retry without retyping.

When you open the Orchestrator chat, a centered logo animation appears while your subagents, workflows, and tool configurations are loaded. Suggestion groups and the chat input reveal in stages once loading completes, so the page stays visually stable instead of shifting between states.

Selecting the Model

When you create an agent, you choose its default model. Some plans let you override the model per conversation. If available, use the model selector in the chat header to switch. Different models suit different tasks: faster models for quick answers, more capable models for complex reasoning.

Conversation History

Conversations are saved automatically. You see past threads in the sidebar or history panel. Click a thread to resume it. The agent remembers the full context of that conversation. You can start new threads when you want a fresh context or a different topic.

Switching Between Agents

You can switch between agents without losing your place. Each agent has its own conversation list. Open another agent from the sidebar or Agents list. When you return to an agent, your previous conversations are still there. Use different agents for different tasks — Search Ninja for SPL, Splunk Sensei for learning, BOTS Hunter for investigations, and so on.

Using Skills in Chat

You can attach skills to individual messages using slash commands. Type / in the chat input to open the skills menu. Filter by name and select a skill — a pill badge appears above the input showing the attached skill. The skill applies to that single message only. For example, type /search-splunk before asking a Splunk question to activate the structured SPL workflow, or use /concise for a brief answer. See Agent Skills for the full list of available skills and details on permanent attachment.

@-Mentions for Subagents and Workflows

In the Orchestrator chat, you can use @-mentions to route a prompt directly to a specific subagent or workflow. Type @ in the chat input to open a palette showing your available subagents and workflows. Filter by name, then select a target — the @-mention token appears in your prompt. When you send the message, the Orchestrator routes it to the mentioned target instead of choosing one automatically.

You can mention multiple targets in a single prompt. Subagents appear with an "Agent" badge and workflows with a "Workflow" badge in the palette so you can distinguish between them.

@-mentions inside code blocks (backtick-fenced or inline code) are ignored, so you can reference agent names in code samples without triggering routing.

In single-agent chat, @-mentions are available for your other agents — useful when you want to reference another agent's capability without switching away from your current conversation.

Integration Approval Cards

When an agent needs a tool from an integration that is not yet enabled in the current session, it requests your approval via an integration approval card. The card shows the integration name and lets you choose which configuration to use if you have multiple instances of that integration type.

You have two options when approving:

Just this chat — enables the integration for the current conversation only
Save to agent — permanently attaches the integration to the agent for future chats

Click Approve to grant access or Deny to block the request. If you deny, the agent continues without that integration's tools.

This keeps you in control of which integrations each agent accesses without requiring upfront configuration for every possible tool combination.

You can share conversations with teammates. Use the share option in the conversation header to generate a link or invite. Shared links let others view the thread (and optionally continue it, depending on permissions). Sharing helps with handoffs, training, and documenting how you solved a problem.

Web Search

When you enable web search on an agent, it can look up current information from the internet during conversations. Deslicer uses provider-native web search tools when the selected model supports them — OpenAI, Anthropic, Google, and xAI models each have built-in web search capabilities. If you enable web search on an agent using a model that does not support it, the agent operates without web access for that conversation.

You enable web search in the agent's settings. Once enabled, the agent decides when to search the web based on your question. You do not need to trigger web search manually — the agent uses it automatically when current information would improve its answer.

Tool Activity Display

When agents use tools during a conversation, the chat interface shows each tool call with a readable name and status. Integration tools connected through the dynamic router display the actual integration tool name (e.g., "Search Splunk" or "List Hosts") rather than internal routing labels. MCP tools from integrations like Splunk MCP or VirusTotal also display shortened, readable names.

Delegated work appears as compact subagent cards that show the agent name, current status (working, completed, failed), and a preview of the latest activity. While an async subagent task runs, tool calls and intermediate results stream live into the card and activity timeline — you do not wait until the task finishes to see progress. Click a card to open the detail dialog, which includes tabs for Instructions (the prompt sent to the subagent), Results (the subagent's output or errors), a tool trace (every tool call made), and Artifacts (any files the subagent produced). Async tasks display a live elapsed time counter and a Stop button while running.

The activity timeline at the bottom of each delegation shows a chronological list of tool calls and responses. Each entry includes a status indicator (done, running, error, pending) and expandable input/output details.

Artifacts

When agents produce large outputs — configuration files, reports, data exports — they store them as artifacts instead of pasting the full content into the chat. The Artifacts tab in the subagent detail dialog lists each artifact with its title, file type, size, and a brief summary.

Click Download on any artifact to save it to your computer. Artifact downloads use signed URLs that are generated on demand. Artifacts remain available for the lifetime of the conversation.

Artifacts keep conversations readable by replacing multi-kilobyte tool outputs with compact references. You still get the full data — just as a download rather than inline text.

Multi-Tenant Orchestration

If your organization has multiple tenants, the Orchestrator chat supports multi-lane mode — sending a single prompt to multiple tenants simultaneously. Each tenant runs in its own parallel lane, and you see results side by side.

Activating Multi-Lane Mode

When you have access to more than one tenant, a Tenant Switcher appears in the Orchestrator chat toolbar. Click it to select up to three tenants for parallel execution. The switcher shows all tenants you belong to, with your current tenant pre-selected.

How It Works

Select two or more tenants from the Tenant Switcher.
Type your prompt in the unified input bar at the bottom.
Press Send — the prompt fans out to all selected tenants simultaneously.
Each tenant lane shows its own conversation with live status indicators (working, completed, failed).
Results appear independently as each tenant's orchestrator completes.

Lane Status Indicators

Each tenant lane displays a real-time progress state:

Agent status — which subagent is currently working
Workflow progress — step counts when a workflow is active
Elapsed time — how long the current operation has been running

You can expand or collapse individual lanes to focus on specific tenants. A Cancel button stops execution for a specific tenant without affecting the others.

Cross-Tenant Run History

Previous multi-tenant runs are preserved in the session. You can review past prompts and their per-tenant results without re-running them. Click New Chat to clear all lanes and start fresh.

DAP Confirmation Cards

When you work with DAP-connected agents (such as the App Deployment Agent), destructive or sensitive actions require your explicit approval before they execute. The agent proposes the action, and an interactive confirmation card appears in the chat showing exactly what will happen.

How Confirmation Cards Work

The agent calls a DAP tool (for example, approving a plan or submitting a draft).
Instead of executing immediately, a confirmation card appears in the chat.
The card displays the action name, a description of what will happen, and the target identifiers (plan ID, host ID, group name, and so on) so you know exactly which resources are affected.
You click Approve to proceed or Cancel to stop.
After approval, the agent receives the result and continues the conversation with the outcome.

Gated Actions

The following DAP actions require confirmation:

Action	What It Does
Approve Plan	Approves a pending change plan for execution
Reject Plan	Rejects a pending change plan
Execute Plan	Starts rolling out an approved plan to target nodes
Compile Plan	Compiles a plan for dry-run preview
Delete Plan	Permanently deletes a draft, approved, or rejected plan
Retry Plan	Re-queues failed jobs for another execution attempt
Cancel Execution	Stops a running execution
Submit Plan Draft	Stages inline change items on a draft plan
Create Host Group	Creates a new group of target hosts
Add Hosts to Group	Adds hosts to an existing group
Remove Host from Inventory	Removes an enrolled host
Revoke Enrollment Token	Revokes an active enrollment token

Confirmation Card Details

For Submit Plan Draft confirmations, the card shows every change item in a structured layout grouped by host, app, config file, and stanza. Each item displays a change type sigil (+ for additions, ~ for modifications, - for deletions), the key, the desired value, and the previous value. You can audit every change before approving — if a draft is too large to display in full, it is rejected automatically and the agent splits it into smaller drafts.

Confirmation cards expire after 10 minutes. If a card expires, click Ask agent to re-issue to get a fresh card. If you lack the required DAP role (dap:platform:manage), the card shows a permission error with guidance.

When Approve Plan fails because Splunk credentials or worker enrollment prerequisites are incomplete, the card shows an amber banner with specific remediation steps and links to Splunk Credentials or Enrollment — the same guidance as the Plans page approve dialog. See Change Plans — Approval Prerequisites.

When a confirmation card resolves (approved, cancelled, or expired), it shows a non-interactive pill summarizing the outcome. Approved and already-terminal cards include a View in DAP deep link that opens the affected plan or execution directly in the Automation Platform — useful for continuing your review outside the chat.

If the underlying resource has already moved past the gated step (for example, another team member already approved the plan), the card shows an "already terminal" state with the current status and a link to view the plan. This prevents duplicate actions and keeps you informed about the resource's actual state.

Security

Confirmation cards prevent AI agents from executing destructive actions without human approval. The agent never sees or handles API credentials — the approval is processed server-side through your authenticated session. Target identifiers displayed on the card are cryptographically bound to the actual action, so a card always reflects exactly what will be executed.

Tips for Effective Chatting

Be specific — "Find failed logins in the last 24 hours from index main" works better than "show me errors."
Ask for reasoning — Request explanations before running queries. Agents can show their logic and help you learn.
Use follow-ups — Refine with "narrow that to source IP X" or "add a timechart." The agent uses prior context.
Attach skills for specialized behavior — Use /deep-research for in-depth reports or /concise for quick answers. Skills guide how the agent uses its tools.
Compile a report — When you reach conclusions in a conversation, use the Compile Report button to turn the findings into a structured, shareable document. See Reports for details.
Enable web search — Turn on web search in agent settings when your questions need current, live information from the internet.
Review DAP confirmation cards carefully — When working with DAP agents, read the target identifiers and change items on each confirmation card before approving.
Switch agents when needed — If an agent isn't the right fit, try a purpose-built agent or a different custom agent.