splunk-search

Name: splunk-search
Author: grandcamel

15stars3forks

How to install splunk-search?

grandcamel/splunk-assistant-skills/splunk-search

$npx -y skills add grandcamel/Splunk-Assistant-Skills --skill splunk-search

Installs into the current project.

Summary

SPL query execution in multiple modes for Splunk.

Files · 1

View on GitHub

SKILL.md

1	# splunk-search
2
3	SPL query execution in multiple modes for Splunk.
4
5	## Purpose
6
7	Execute SPL (Search Processing Language) queries using various execution modes:
8	oneshot (inline results), normal (async with polling), and blocking (sync wait).
9
10	## Risk Levels
11
12	\| Operation \| Risk \| Notes \|
13	\|-----------\|------\|-------\|
14	\| Execute search (read) \| - \| Read-only query \|
15	\| Get results \| - \| Read-only \|
16	\| Validate SPL \| - \| Read-only \|
17	\| Execute search (write) \| ⚠️⚠️ \| SPL with `\| outputlookup` or `\| collect` modifies data \|
18
19	## Triggers
20
21	- "search", "SPL", "query", "find"
22	- "oneshot", "blocking", "async"
23	- "execute", "run search"
24
25	## Search Modes
26
27	\| Mode \| Use Case \| Returns SID \| Wait for Results \|
28	\|------\|----------\|-------------\|------------------\|
29	\| Oneshot \| Ad-hoc queries < 50K rows \| No \| Inline \|
30	\| Normal \| Long-running searches \| Yes \| Async (poll) \|
31	\| Blocking \| Simple queries \| Yes \| Sync (waits) \|
32
33	## CLI Commands
34
35	\| Command \| Description \|
36	\|---------\|-------------\|
37	\| `search oneshot` \| Execute oneshot search (results inline) \|
38	\| `search normal` \| Execute normal search (returns SID) \|
39	\| `search blocking` \| Execute blocking search (waits) \|
40	\| `search results` \| Get results from completed job \|
41	\| `search preview` \| Get partial results during search \|
42	\| `search validate` \| Validate SPL syntax \|
43
44	## Examples
45
46	### Oneshot Search (Recommended for Ad-hoc)
47
48	```bash
49	# Simple search
50	splunk-as search oneshot "index=main \| stats count by sourcetype"
51
52	# With time range
53	splunk-as search oneshot "index=main \| head 100" --earliest -1h --latest now
54
55	# Output as JSON
56	splunk-as search oneshot "index=main \| top host" --output json
57
58	# With count limit and specific fields
59	splunk-as search oneshot "index=main" --count 100 --fields host,status
60
61	# Output to file
62	splunk-as search oneshot "index=main \| head 1000" --output-file results.csv
63
64	# Using short flags (-e earliest, -l latest, -c count, -f fields, -o output format)
65	splunk-as search oneshot "index=main" -e -1h -l now -c 100 -f host,status -o json
66
67	# Save to file with --output-file
68	splunk-as search oneshot "index=main" -e -1h -c 100 --output-file results.csv
69	```
70
71	### Normal Search (Async)
72
73	```bash
74	# Create job and poll
75	splunk-as search normal "index=main \| stats count" --wait
76
77	# Create job only (returns SID)
78	splunk-as search normal "index=main \| stats count"
79	# Then use: splunk-as search results <SID>
80	```
81
82	### Blocking Search (Sync)
83
84	```bash
85	# Wait for completion and return results
86	splunk-as search blocking "index=main \| head 10" --timeout 60
87	```
88
89	### Get Results
90
91	```bash
92	# From completed job
93	splunk-as search results 1703779200.12345
94
95	# With pagination (using short flags)
96	splunk-as search results 1703779200.12345 -c 100 --offset 0
97
98	# Specific fields only
99	splunk-as search results 1703779200.12345 -f host,status,uri
100
101	# Output format and save to file
102	splunk-as search results 1703779200.12345 -o json
103	splunk-as search results 1703779200.12345 --output-file results.csv
104	```
105
106	### Validate SPL
107
108	```bash
109	# Validate SPL syntax
110	splunk-as search validate "index=main \| stats count"
111
112	# Validate with suggestions for fixes (-s/--suggestions)
113	splunk-as search validate "index=main \| stats count" -s
114	```
115
116	## API Endpoints
117
118	\| Endpoint \| Mode \| Description \|
119	\|----------\|------\|-------------\|
120	\| `POST /services/search/jobs/oneshot` \| Oneshot \| Inline results \|
121	\| `POST /services/search/v2/jobs` \| Normal \| Create async job \|
122	\| `POST /services/search/v2/jobs` + `exec_mode=blocking` \| Blocking \| Sync wait \|
123	\| `GET /services/search/v2/jobs/{sid}/results` \| - \| Get results \|
124	\| `GET /services/search/v2/jobs/{sid}/results_preview` \| - \| Get preview \|
125
126	## Request Parameters
127
128	\| Parameter \| Description \| Default \|
129	\|-----------\|-------------\|---------\|
130	\| `search` \| SPL query \| Required \|
131	\| `earliest_time` \| Start time \| -24h \|
132	\| `latest_time` \| End time \| now \|
133	\| `exec_mode` \| normal/blocking \| normal \|
134	\| `max_count` \| Max results \| 50000 \|
135	\| `output_mode` \| json/csv/xml \| json \|
136
137	## Best Practices
138
139	1. Always include time bounds - Prevents full index scans
140	2. Use oneshot for ad-hoc - Minimal resource usage
141	3. Add fields command - Reduce data transfer
142	4. Validate SPL first - Catch syntax errors early
143	5. Handle pagination - Use count/offset for large results
144
145	## SPL Quick Reference
146
147	```spl
148	# Basic search with time
149	index=main earliest=-1h \| head 100
150
151	# Statistics
152	index=main \| stats count by status \| sort -count
153
154	# Time chart
155	index=main \| timechart span=1h count by sourcetype
156
157	# Field extraction
158	index=main \| fields host, status, uri \| table host status uri
159
160	# Filtering
161	index=main status>=400 \| stats count by status
162
163	# Subsearch
164	index=main [search index=alerts \| fields src_ip \| head 100]
165	```
166
167	## Related Skills
168
169	- [splunk-job](../splunk-job/SKILL.md) - Job lifecycle
170	- [splunk-export](../splunk-export/SKILL.md) - Large exports
171	- [splunk-metadata](../splunk-metadata/SKILL.md) - Field discovery

People who liked this also viewed

6 picks

Type

azure-kustoQuery and analyze data in Azure Data Explorer (Kusto/ADX) using KQL for log analytics, telemetry, and time series analysis. WHEN: KQL queries, Kusto database queries, Azure Data Explorer, ADX clustersSkillsJul 2026470k1.3k
lark-base飞书多维表格（Base）操作：建表、字段、记录、视图、统计、公式/lookup、表单、仪表盘、workflow、角色权限；遇到 Base/多维表格/bitable 或 /base/ 链接时使用。文件导入转 lark-drive，认证/授权转 lark-shared。SkillsJul 2026382k16k
lark-calendar飞书日历：管理日历日程和会议室。查看/搜索日程、创建/更新日程、管理参会人、查询忙闲和推荐时段、预定会议室。当用户需要查看日程安排、创建/修改会议、查询/预定会议室时使用。不负责：查询过去的视频会议记录（走 lark-vc）、待办任务（走 lark-task）。SkillsJul 2026380k16k
shadcnManages shadcn components and projects — adding, searching, fixing, debugging, styling, and composing UI, including chat interfaces. Provides project context, component docs, and usage examples. AppliSkillsJul 2026246k120k
xlsxUse this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .xltx, .csv, or .tsv file (e.SkillsJul 2026139k163k
firebase-data-connectAgent Skills for FirebaseSkillsJul 2026108k387

splunk-search

15stars3forks

View on GitHub

How to install splunk-search?

grandcamel/splunk-assistant-skills/splunk-search

$npx -y skills add grandcamel/Splunk-Assistant-Skills --skill splunk-search

Installs into the current project.

Summary

SPL query execution in multiple modes for Splunk.

Files · 1

View on GitHub

SKILL.md

1	# splunk-search
2
3	SPL query execution in multiple modes for Splunk.
4
5	## Purpose
6
7	Execute SPL (Search Processing Language) queries using various execution modes:
8	oneshot (inline results), normal (async with polling), and blocking (sync wait).
9
10	## Risk Levels
11
12	\| Operation \| Risk \| Notes \|
13	\|-----------\|------\|-------\|
14	\| Execute search (read) \| - \| Read-only query \|
15	\| Get results \| - \| Read-only \|
16	\| Validate SPL \| - \| Read-only \|
17	\| Execute search (write) \| ⚠️⚠️ \| SPL with `\| outputlookup` or `\| collect` modifies data \|
18
19	## Triggers
20
21	- "search", "SPL", "query", "find"
22	- "oneshot", "blocking", "async"
23	- "execute", "run search"
24
25	## Search Modes
26
27	\| Mode \| Use Case \| Returns SID \| Wait for Results \|
28	\|------\|----------\|-------------\|------------------\|
29	\| Oneshot \| Ad-hoc queries < 50K rows \| No \| Inline \|
30	\| Normal \| Long-running searches \| Yes \| Async (poll) \|
31	\| Blocking \| Simple queries \| Yes \| Sync (waits) \|
32
33	## CLI Commands
34
35	\| Command \| Description \|
36	\|---------\|-------------\|
37	\| `search oneshot` \| Execute oneshot search (results inline) \|
38	\| `search normal` \| Execute normal search (returns SID) \|
39	\| `search blocking` \| Execute blocking search (waits) \|
40	\| `search results` \| Get results from completed job \|
41	\| `search preview` \| Get partial results during search \|
42	\| `search validate` \| Validate SPL syntax \|
43
44	## Examples
45
46	### Oneshot Search (Recommended for Ad-hoc)
47
48	```bash
49	# Simple search
50	splunk-as search oneshot "index=main \| stats count by sourcetype"
51
52	# With time range
53	splunk-as search oneshot "index=main \| head 100" --earliest -1h --latest now
54
55	# Output as JSON
56	splunk-as search oneshot "index=main \| top host" --output json
57
58	# With count limit and specific fields
59	splunk-as search oneshot "index=main" --count 100 --fields host,status
60
61	# Output to file
62	splunk-as search oneshot "index=main \| head 1000" --output-file results.csv
63
64	# Using short flags (-e earliest, -l latest, -c count, -f fields, -o output format)
65	splunk-as search oneshot "index=main" -e -1h -l now -c 100 -f host,status -o json
66
67	# Save to file with --output-file
68	splunk-as search oneshot "index=main" -e -1h -c 100 --output-file results.csv
69	```
70
71	### Normal Search (Async)
72
73	```bash
74	# Create job and poll
75	splunk-as search normal "index=main \| stats count" --wait
76
77	# Create job only (returns SID)
78	splunk-as search normal "index=main \| stats count"
79	# Then use: splunk-as search results <SID>
80	```
81
82	### Blocking Search (Sync)
83
84	```bash
85	# Wait for completion and return results
86	splunk-as search blocking "index=main \| head 10" --timeout 60
87	```
88
89	### Get Results
90
91	```bash
92	# From completed job
93	splunk-as search results 1703779200.12345
94
95	# With pagination (using short flags)
96	splunk-as search results 1703779200.12345 -c 100 --offset 0
97
98	# Specific fields only
99	splunk-as search results 1703779200.12345 -f host,status,uri
100
101	# Output format and save to file
102	splunk-as search results 1703779200.12345 -o json
103	splunk-as search results 1703779200.12345 --output-file results.csv
104	```
105
106	### Validate SPL
107
108	```bash
109	# Validate SPL syntax
110	splunk-as search validate "index=main \| stats count"
111
112	# Validate with suggestions for fixes (-s/--suggestions)
113	splunk-as search validate "index=main \| stats count" -s
114	```
115
116	## API Endpoints
117
118	\| Endpoint \| Mode \| Description \|
119	\|----------\|------\|-------------\|
120	\| `POST /services/search/jobs/oneshot` \| Oneshot \| Inline results \|
121	\| `POST /services/search/v2/jobs` \| Normal \| Create async job \|
122	\| `POST /services/search/v2/jobs` + `exec_mode=blocking` \| Blocking \| Sync wait \|
123	\| `GET /services/search/v2/jobs/{sid}/results` \| - \| Get results \|
124	\| `GET /services/search/v2/jobs/{sid}/results_preview` \| - \| Get preview \|
125
126	## Request Parameters
127
128	\| Parameter \| Description \| Default \|
129	\|-----------\|-------------\|---------\|
130	\| `search` \| SPL query \| Required \|
131	\| `earliest_time` \| Start time \| -24h \|
132	\| `latest_time` \| End time \| now \|
133	\| `exec_mode` \| normal/blocking \| normal \|
134	\| `max_count` \| Max results \| 50000 \|
135	\| `output_mode` \| json/csv/xml \| json \|
136
137	## Best Practices
138
139	1. Always include time bounds - Prevents full index scans
140	2. Use oneshot for ad-hoc - Minimal resource usage
141	3. Add fields command - Reduce data transfer
142	4. Validate SPL first - Catch syntax errors early
143	5. Handle pagination - Use count/offset for large results
144
145	## SPL Quick Reference
146
147	```spl
148	# Basic search with time
149	index=main earliest=-1h \| head 100
150
151	# Statistics
152	index=main \| stats count by status \| sort -count
153
154	# Time chart
155	index=main \| timechart span=1h count by sourcetype
156
157	# Field extraction
158	index=main \| fields host, status, uri \| table host status uri
159
160	# Filtering
161	index=main status>=400 \| stats count by status
162
163	# Subsearch
164	index=main [search index=alerts \| fields src_ip \| head 100]
165	```
166
167	## Related Skills
168
169	- [splunk-job](../splunk-job/SKILL.md) - Job lifecycle
170	- [splunk-export](../splunk-export/SKILL.md) - Large exports
171	- [splunk-metadata](../splunk-metadata/SKILL.md) - Field discovery

People who liked this also viewed

6 picks

Type