Need Help - What would you build? Air-gapped NL assistant that is integrated with Splunk

So I have a side project with given scope:

• Fully air-gapped / on-prem - no internet, no outbound calls of any kind
• Engineers ask questions about Splunk data in natural language
• Has to hold the conversation in Korean (index/field names stay English)
• Local/small models preferred, needs to fit a modest GPU - was looking at Qwen/Gemma4 but indexing more on what is good enough small model to have decent performance
• Some memory across the session (not required, but at least within the current session would be nice)
• Strictly read-only and safe enough to point at prod logs

I am thinking simple chat interface (like claude, openAI style) where we give Splunk API access for AI to retrieve and reason.

2 Questions:

• I was thinking deploying like Openclaw/Hermes agent + small language model to start - because I really like the interaction with them. Is there any better or easier way to achieve similar experience? (vLM, ollama, open WebUI, any suggestions would be nice)
• In terms of outcome, what do you think we can actually let it do? log analysis? RCA? basic questions?

Pretty new to this and trying to learn.. any initial guidance or tips would be awesome!