splunk-assistant

Name: splunk-assistant
Author: grandcamel

15stars3forks

How to install splunk-assistant?

grandcamel/splunk-assistant-skills/splunk-assistant

$npx -y skills add grandcamel/Splunk-Assistant-Skills --skill splunk-assistant

Installs into the current project.

Summary

Central hub and router for Splunk Assistant Skills. Routes requests to 17 CLI command groups using 3-level progressive disclosure.

Files · 1

View on GitHub

SKILL.md

1	# splunk-assistant
2
3	Central hub and router for Splunk Assistant Skills. Routes requests to 17 CLI command groups using 3-level progressive disclosure.
4
5	## Purpose
6
7	Routes natural language requests to specialized Splunk skills based on intent. Provides connection verification, authentication validation, and execution strategy recommendations.
8
9	## Risk Levels
10
11	\| Operation \| Risk \| Notes \|
12	\|-----------\|------\|-------\|
13	\| Get server info \| - \| Read-only \|
14	\| Verify connection \| - \| Read-only \|
15	\| Route to skill \| - \| Navigation only \|
16
17	## Triggers
18
19	- Any Splunk-related request
20	- "splunk", "search", "query", "SPL"
21	- Connection/authentication issues
22	- General Splunk questions
23
24	## Progressive Disclosure
25
26	### Level 1: Essential Connection & Identification
27
28	- Verify Search Head connection on management port 8089 via HTTPS
29	- Validate JWT Bearer token or Basic Auth credentials
30	- Detect deployment type (Cloud vs on-prem)
31	- Route to appropriate specialized skill
32
33	### Level 2: Execution Mode Strategy
34
35	\| Mode \| Use Case \| Characteristics \|
36	\|------\|----------\|-----------------\|
37	\| Oneshot \| Ad-hoc queries \| Results inline, no SID, minimal disk I/O \|
38	\| Normal \| Long searches \| Returns SID, poll for results, progress tracking \|
39	\| Blocking \| Simple queries \| Waits for completion, synchronous \|
40	\| Export \| Large extracts \| Streaming, checkpoint support, ETL \|
41
42	### Level 3: Advanced Optimization & Resource Governance
43
44	- Time Modifiers: Always enforce `earliest_time` and `latest_time`
45	- Field Reduction: Insert `fields` command to limit data transfer
46	- Resource Cleanup: Issue `/control/cancel` after results consumed
47	- Error Handling: Use `strict=true` for clear errors vs incomplete data
48
49	## CLI Command Groups
50
51	\| CLI Command \| Skill \| Description \|
52	\|-------------\|-------\|-------------\|
53	\| `search` \| `splunk-search` \| Execute SPL query \|
54	\| `job` \| `splunk-job` \| Job lifecycle management \|
55	\| `export` \| `splunk-export` \| Large data export \|
56	\| `metadata` \| `splunk-metadata` \| Index/source discovery \|
57	\| `lookup` \| `splunk-lookup` \| Lookup management \|
58	\| `tag` \| `splunk-tag` \| Tag operations \|
59	\| `savedsearch` \| `splunk-savedsearch` \| Saved searches/reports \|
60	\| `alert` \| `splunk-alert` \| Alert management \|
61	\| `admin` \| `splunk-rest-admin` \| REST/Server administration \|
62	\| `security` \| `splunk-security` \| Token/RBAC/ACL \|
63	\| `metrics` \| `splunk-metrics` \| Metrics (mstats) \|
64	\| `app` \| `splunk-app` \| App management \|
65	\| `kvstore` \| `splunk-kvstore` \| KV Store \|
66	\| `dashboard` \| - \| Dashboard management \|
67	\| `input` \| - \| Data input management \|
68	\| `user` \| - \| User management \|
69	\| `config` \| - \| Configuration management \|
70	\| `completion` \| - \| Shell completion (utility) \|
71
72	## Connection Verification
73
74	```bash
75	# Get server information (verify connection)
76	splunk-as admin info
77
78	# Get server status
79	splunk-as admin status
80
81	# Get server health status
82	splunk-as admin health
83	```
84
85	## Examples
86
87	### Verify Connection
88
89	```bash
90	splunk-as admin info
91	# Output:
92	# ✓ Connected to splunk.example.com:8089
93	# ✓ Authentication: Bearer token valid
94	# ✓ Deployment: Splunk Enterprise 9.1.0
95	# ✓ User: admin (capabilities: search, admin_all_objects)
96	```
97
98	### Get Server Info
99
100	```bash
101	splunk-as admin info --output json
102	# Output: Server version, build, OS, cluster status, etc.
103	```
104
105	### Common CLI Commands
106
107	```bash
108	# Search commands
109	splunk-as search oneshot "index=main \| head 10"
110	splunk-as search normal "index=main \| stats count" --wait
111
112	# Job management
113	splunk-as job list
114	splunk-as job status 1703779200.12345
115
116	# Metadata discovery
117	splunk-as metadata indexes
118	splunk-as metadata sourcetypes --index main
119
120	# Security
121	splunk-as security whoami
122	```
123
124	## Best Practices
125
126	1. Always include time bounds - Prevent full index scans
127	2. Use field extraction - Limit data transfer
128	3. Choose appropriate mode - Oneshot for ad-hoc, Export for ETL
129	4. Clean up resources - Cancel jobs when done
130	5. Handle errors gracefully - Use the error hierarchy
131
132	## Related Skills
133
134	- [splunk-job](../splunk-job/SKILL.md) - Job lifecycle
135	- [splunk-search](../splunk-search/SKILL.md) - Query execution
136	- [splunk-security](../splunk-security/SKILL.md) - Authentication

People who liked this also viewed

6 picks

Type

azure-kustoQuery and analyze data in Azure Data Explorer (Kusto/ADX) using KQL for log analytics, telemetry, and time series analysis. WHEN: KQL queries, Kusto database queries, Azure Data Explorer, ADX clustersSkillsJul 2026470k1.3k
lark-base飞书多维表格（Base）操作：建表、字段、记录、视图、统计、公式/lookup、表单、仪表盘、workflow、角色权限；遇到 Base/多维表格/bitable 或 /base/ 链接时使用。文件导入转 lark-drive，认证/授权转 lark-shared。SkillsJul 2026382k16k
lark-calendar飞书日历：管理日历日程和会议室。查看/搜索日程、创建/更新日程、管理参会人、查询忙闲和推荐时段、预定会议室。当用户需要查看日程安排、创建/修改会议、查询/预定会议室时使用。不负责：查询过去的视频会议记录（走 lark-vc）、待办任务（走 lark-task）。SkillsJul 2026380k16k
shadcnManages shadcn components and projects — adding, searching, fixing, debugging, styling, and composing UI, including chat interfaces. Provides project context, component docs, and usage examples. AppliSkillsJul 2026246k120k
xlsxUse this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .xltx, .csv, or .tsv file (e.SkillsJul 2026139k163k
firebase-data-connectAgent Skills for FirebaseSkillsJul 2026108k387

splunk-assistant

15stars3forks

View on GitHub

How to install splunk-assistant?

grandcamel/splunk-assistant-skills/splunk-assistant

$npx -y skills add grandcamel/Splunk-Assistant-Skills --skill splunk-assistant

Installs into the current project.

Summary

Central hub and router for Splunk Assistant Skills. Routes requests to 17 CLI command groups using 3-level progressive disclosure.

Files · 1

View on GitHub

SKILL.md

1	# splunk-assistant
2
3	Central hub and router for Splunk Assistant Skills. Routes requests to 17 CLI command groups using 3-level progressive disclosure.
4
5	## Purpose
6
7	Routes natural language requests to specialized Splunk skills based on intent. Provides connection verification, authentication validation, and execution strategy recommendations.
8
9	## Risk Levels
10
11	\| Operation \| Risk \| Notes \|
12	\|-----------\|------\|-------\|
13	\| Get server info \| - \| Read-only \|
14	\| Verify connection \| - \| Read-only \|
15	\| Route to skill \| - \| Navigation only \|
16
17	## Triggers
18
19	- Any Splunk-related request
20	- "splunk", "search", "query", "SPL"
21	- Connection/authentication issues
22	- General Splunk questions
23
24	## Progressive Disclosure
25
26	### Level 1: Essential Connection & Identification
27
28	- Verify Search Head connection on management port 8089 via HTTPS
29	- Validate JWT Bearer token or Basic Auth credentials
30	- Detect deployment type (Cloud vs on-prem)
31	- Route to appropriate specialized skill
32
33	### Level 2: Execution Mode Strategy
34
35	\| Mode \| Use Case \| Characteristics \|
36	\|------\|----------\|-----------------\|
37	\| Oneshot \| Ad-hoc queries \| Results inline, no SID, minimal disk I/O \|
38	\| Normal \| Long searches \| Returns SID, poll for results, progress tracking \|
39	\| Blocking \| Simple queries \| Waits for completion, synchronous \|
40	\| Export \| Large extracts \| Streaming, checkpoint support, ETL \|
41
42	### Level 3: Advanced Optimization & Resource Governance
43
44	- Time Modifiers: Always enforce `earliest_time` and `latest_time`
45	- Field Reduction: Insert `fields` command to limit data transfer
46	- Resource Cleanup: Issue `/control/cancel` after results consumed
47	- Error Handling: Use `strict=true` for clear errors vs incomplete data
48
49	## CLI Command Groups
50
51	\| CLI Command \| Skill \| Description \|
52	\|-------------\|-------\|-------------\|
53	\| `search` \| `splunk-search` \| Execute SPL query \|
54	\| `job` \| `splunk-job` \| Job lifecycle management \|
55	\| `export` \| `splunk-export` \| Large data export \|
56	\| `metadata` \| `splunk-metadata` \| Index/source discovery \|
57	\| `lookup` \| `splunk-lookup` \| Lookup management \|
58	\| `tag` \| `splunk-tag` \| Tag operations \|
59	\| `savedsearch` \| `splunk-savedsearch` \| Saved searches/reports \|
60	\| `alert` \| `splunk-alert` \| Alert management \|
61	\| `admin` \| `splunk-rest-admin` \| REST/Server administration \|
62	\| `security` \| `splunk-security` \| Token/RBAC/ACL \|
63	\| `metrics` \| `splunk-metrics` \| Metrics (mstats) \|
64	\| `app` \| `splunk-app` \| App management \|
65	\| `kvstore` \| `splunk-kvstore` \| KV Store \|
66	\| `dashboard` \| - \| Dashboard management \|
67	\| `input` \| - \| Data input management \|
68	\| `user` \| - \| User management \|
69	\| `config` \| - \| Configuration management \|
70	\| `completion` \| - \| Shell completion (utility) \|
71
72	## Connection Verification
73
74	```bash
75	# Get server information (verify connection)
76	splunk-as admin info
77
78	# Get server status
79	splunk-as admin status
80
81	# Get server health status
82	splunk-as admin health
83	```
84
85	## Examples
86
87	### Verify Connection
88
89	```bash
90	splunk-as admin info
91	# Output:
92	# ✓ Connected to splunk.example.com:8089
93	# ✓ Authentication: Bearer token valid
94	# ✓ Deployment: Splunk Enterprise 9.1.0
95	# ✓ User: admin (capabilities: search, admin_all_objects)
96	```
97
98	### Get Server Info
99
100	```bash
101	splunk-as admin info --output json
102	# Output: Server version, build, OS, cluster status, etc.
103	```
104
105	### Common CLI Commands
106
107	```bash
108	# Search commands
109	splunk-as search oneshot "index=main \| head 10"
110	splunk-as search normal "index=main \| stats count" --wait
111
112	# Job management
113	splunk-as job list
114	splunk-as job status 1703779200.12345
115
116	# Metadata discovery
117	splunk-as metadata indexes
118	splunk-as metadata sourcetypes --index main
119
120	# Security
121	splunk-as security whoami
122	```
123
124	## Best Practices
125
126	1. Always include time bounds - Prevent full index scans
127	2. Use field extraction - Limit data transfer
128	3. Choose appropriate mode - Oneshot for ad-hoc, Export for ETL
129	4. Clean up resources - Cancel jobs when done
130	5. Handle errors gracefully - Use the error hierarchy
131
132	## Related Skills
133
134	- [splunk-job](../splunk-job/SKILL.md) - Job lifecycle
135	- [splunk-search](../splunk-search/SKILL.md) - Query execution
136	- [splunk-security](../splunk-security/SKILL.md) - Authentication

People who liked this also viewed

6 picks

Type