$npx -y skills add grandcamel/Splunk-Assistant-Skills --skill splunk-metricsReal-time metrics and data point analysis for Splunk.
| 1 | # splunk-metrics |
| 2 | |
| 3 | Real-time metrics and data point analysis for Splunk. |
| 4 | |
| 5 | ## Purpose |
| 6 | |
| 7 | Query and analyze metrics data using mstats and mcatalog commands. |
| 8 | |
| 9 | ## Risk Levels |
| 10 | |
| 11 | | Operation | Risk | Notes | |
| 12 | |-----------|------|-------| |
| 13 | | List metrics | - | Read-only | |
| 14 | | List metric indexes | - | Read-only | |
| 15 | | Query with mstats | - | Read-only | |
| 16 | | Discover with mcatalog | - | Read-only | |
| 17 | |
| 18 | ## Triggers |
| 19 | |
| 20 | - "metrics", "mstats", "mcatalog" |
| 21 | - "time series", "data points" |
| 22 | |
| 23 | ## CLI Commands |
| 24 | |
| 25 | | Command | Description | |
| 26 | |---------|-------------| |
| 27 | | `metrics mstats` | Execute mstats command | |
| 28 | | `metrics mcatalog` | Query metrics catalog | |
| 29 | | `metrics mpreview` | Preview metrics data | |
| 30 | | `metrics indexes` | List metric indexes | |
| 31 | | `metrics list` | List metric names | |
| 32 | |
| 33 | ## Options |
| 34 | |
| 35 | | Option | Commands | Description | |
| 36 | |--------|----------|-------------| |
| 37 | | `-i`, `--index` | mstats, mcatalog, mpreview, list | Metrics index | |
| 38 | | `-o`, `--output` | mcatalog, mpreview | Output format (text, json) | |
| 39 | | `-m`, `--metric` | mcatalog | Filter by metric name pattern | |
| 40 | | `-f`, `--filter` | mpreview | Filter expression (e.g., host=server1) | |
| 41 | | `-c`, `--count` | mpreview | Number of data points | |
| 42 | | `--agg` | mstats | Aggregation function | |
| 43 | | `--split-by` | mstats | Split by field | |
| 44 | | `--span` | mstats | Time span | |
| 45 | |
| 46 | ## Examples |
| 47 | |
| 48 | ```bash |
| 49 | # List metrics |
| 50 | splunk-as metrics list -i metrics |
| 51 | |
| 52 | # List metric indexes |
| 53 | splunk-as metrics indexes |
| 54 | |
| 55 | # Query with mstats |
| 56 | splunk-as metrics mstats cpu.percent --agg avg --split-by host --span 1h |
| 57 | |
| 58 | # Discover metrics with mcatalog (use -m/--metric for filtering) |
| 59 | splunk-as metrics mcatalog -i metrics -m "cpu.*" |
| 60 | splunk-as metrics mcatalog -i metrics -o json |
| 61 | |
| 62 | # Preview metrics data (requires metric_name positional arg) |
| 63 | splunk-as metrics mpreview cpu.percent -i metrics |
| 64 | splunk-as metrics mpreview cpu.percent -i metrics -f "host=server1" -c 50 |
| 65 | ``` |
| 66 | |
| 67 | ## SPL Patterns |
| 68 | |
| 69 | ```spl |
| 70 | | mstats avg(cpu.percent) WHERE index=metrics BY host span=1h |
| 71 | | mcatalog values(metric_name) WHERE index=metrics |
| 72 | | mpreview index=metrics |
| 73 | ``` |