splunk-savedsearch
starsforks
How to install splunk-savedsearch?
grandcamel/splunk-assistant-skills/splunk-savedsearch
$npx -y skills add grandcamel/Splunk-Assistant-Skills --skill splunk-savedsearchCRUD for reports and scheduled searches in Splunk.
SKILL.md
| 1 | # splunk-savedsearch |
| 2 | |
| 3 | CRUD for reports and scheduled searches in Splunk. |
| 4 | |
| 5 | ## Purpose |
| 6 | |
| 7 | Create, read, update, delete saved searches, reports, and scheduled searches. |
| 8 | |
| 9 | ## Risk Levels |
| 10 | |
| 11 | | Operation | Risk | Notes | |
| 12 | |-----------|------|-------| |
| 13 | | List saved searches | - | Read-only | |
| 14 | | Get saved search | - | Read-only | |
| 15 | | Run saved search | - | Read-only execution | |
| 16 | | Create saved search | ⚠️ | Can be deleted | |
| 17 | | Update saved search | ⚠️ | Previous version lost | |
| 18 | | Enable/disable schedule | ⚠️ | Easily reversible | |
| 19 | | Delete saved search | ⚠️⚠️ | May be recoverable from backup | |
| 20 | |
| 21 | ## Triggers |
| 22 | |
| 23 | - "saved search", "report", "schedule" |
| 24 | - "scheduled search", "alert" |
| 25 | |
| 26 | ## CLI Commands |
| 27 | |
| 28 | Commands provided by the `splunk-as` package (`pip install splunk-as`): |
| 29 | |
| 30 | | Command | Description | |
| 31 | |---------|-------------| |
| 32 | | `savedsearch list` | List saved searches in app | |
| 33 | | `savedsearch get` | Get saved search details | |
| 34 | | `savedsearch create` | Create saved search/report | |
| 35 | | `savedsearch update` | Modify saved search | |
| 36 | | `savedsearch run` | Execute saved search on-demand | |
| 37 | | `savedsearch history` | Get saved search execution history | |
| 38 | | `savedsearch enable` | Enable scheduled execution | |
| 39 | | `savedsearch disable` | Disable scheduling | |
| 40 | | `savedsearch delete` | Delete saved search | |
| 41 | |
| 42 | ## Examples |
| 43 | |
| 44 | ```bash |
| 45 | # List saved searches |
| 46 | splunk-as savedsearch list --app search |
| 47 | |
| 48 | # Get saved search details |
| 49 | splunk-as savedsearch get "My Report" |
| 50 | |
| 51 | # Create saved search (use --name and --search options) |
| 52 | splunk-as savedsearch create --name "My Report" --search "index=main | stats count" --app search |
| 53 | |
| 54 | # Update saved search |
| 55 | splunk-as savedsearch update "My Report" --search "index=main | stats count by host" |
| 56 | |
| 57 | # Run saved search (--wait/--no-wait controls blocking) |
| 58 | splunk-as savedsearch run "My Report" --wait |
| 59 | splunk-as savedsearch run "My Report" --no-wait |
| 60 | |
| 61 | # Get execution history (default shows 10 entries) |
| 62 | splunk-as savedsearch history "My Report" |
| 63 | splunk-as savedsearch history "My Report" -c 20 |
| 64 | |
| 65 | # Enable scheduling |
| 66 | splunk-as savedsearch enable "My Report" |
| 67 | |
| 68 | # Disable scheduling |
| 69 | splunk-as savedsearch disable "My Report" |
| 70 | |
| 71 | # Delete saved search |
| 72 | splunk-as savedsearch delete "My Report" |
| 73 | ``` |
| 74 | |
| 75 | ## API Endpoints |
| 76 | |
| 77 | - `GET/POST /services/saved/searches` - CRUD |
| 78 | - `POST /services/saved/searches/{name}/dispatch` - Run |
| 79 | - `GET /services/saved/searches/{name}/history` - History |
People who liked this also viewed
6 picksType
- azure-kustoQuery and analyze data in Azure Data Explorer (Kusto/ADX) using KQL for log analytics, telemetry, and time series analysis. WHEN: KQL queries, Kusto database queries, Azure Data Explorer, ADX clustersSkillsJul 2026
- lark-base飞书多维表格（Base）操作：建表、字段、记录、视图、统计、公式/lookup、表单、仪表盘、workflow、角色权限；遇到 Base/多维表格/bitable 或 /base/ 链接时使用。文件导入转 lark-drive，认证/授权转 lark-shared。SkillsJul 2026
- lark-calendar飞书日历：管理日历日程和会议室。查看/搜索日程、创建/更新日程、管理参会人、查询忙闲和推荐时段、预定会议室。当用户需要查看日程安排、创建/修改会议、查询/预定会议室时使用。不负责：查询过去的视频会议记录（走 lark-vc）、待办任务（走 lark-task）。SkillsJul 2026
- shadcnManages shadcn components and projects — adding, searching, fixing, debugging, styling, and composing UI, including chat interfaces. Provides project context, component docs, and usage examples. AppliSkillsJul 2026
- xlsxUse this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .xltx, .csv, or .tsv file (e.SkillsJul 2026
- firebase-data-connectAgent Skills for FirebaseSkillsJul 2026
