Warning
These skills are experimental. They are not covered by existing Splunk support contracts. Review Support before using them.
This repository contains reusable skills for AI agents working with Splunk.
| Skill | Purpose |
|---|---|
splunk-search |
Run bounded Splunk SPL searches through the splsearch CLI, save large result sets as local SQLite tables, and inspect them with focused summaries, text search, ordered events, or bounded SQL. |
splunk-dashboard-converter |
Convert classic Splunk Simple XML dashboards (version 1) into Dashboard Studio (version 2), preserve every SPL query verbatim, and return the Studio JSON definition to the caller. |
custom-visualization-builder |
Scaffold, build, package, and install a custom visualization into Splunk using the dashboard-studio-extension framework. |
splunk-cloud-admin-copilot |
Read Splunk Cloud Platform ACS state, assess maintenance or restart readiness without changing it, and execute one explicitly approved IPv4 CIDR add or remove for one feature-specific IP allowlist through the documented public ACS provider. |
splunk-identity-saml-readiness-advisor |
Research current public Splunk sources and use optional existing-auth read-only stack evidence to diagnose identity, SAML, LDAP, role, capability, mapping, login, and access-readiness problems without changing configuration or handling credentials. |
splunk-product-question-navigator |
Research current public Splunk sources to answer general product questions with citations, applicability, and explicit uncertainty or routing. |
hec-setup-and-troubleshooting |
Set up and validate Splunk HTTP Event Collector from current public documentation, diagnose delivery failures from sanitized evidence, and prepare bounded escalation handoffs without changing production systems. |
Each skill is self-contained under skills/. The lowercase tools/splsearch
directory contains the Go source for the helper CLI used by splunk-search.
This repository uses the skills/<name>/SKILL.md layout expected by
compatible AI coding agents.
Available skill IDs:
custom-visualization-builderhec-setup-and-troubleshootingsplunk-cloud-admin-copilotsplunk-dashboard-convertersplunk-identity-saml-readiness-advisorsplunk-product-question-navigatorsplunk-search
List the skills before installing:
npx skills add splunk/splunk-agent-skills --listRun one of these commands from a project root to copy all seven skills for the selected agent:
npx skills add splunk/splunk-agent-skills --skill '*' --agent claude-code --copy --yes
npx skills add splunk/splunk-agent-skills --skill '*' --agent codex --copy --yes
npx skills add splunk/splunk-agent-skills --skill '*' --agent cursor --copy --yes
npx skills add splunk/splunk-agent-skills --skill '*' --agent github-copilot --copy --yes
npx skills add splunk/splunk-agent-skills --skill '*' --agent gemini-cli --copy --yes
npx skills add splunk/splunk-agent-skills --skill '*' --agent opencode --copy --yesProject scope is the default. Add --global to install into the selected
agent's user-level skills directory instead. To copy only one skill, name it
with --skill:
npx skills add splunk/splunk-agent-skills --skill splunk-search --agent codex --copy --yesFor a manual installation, clone or download this repository and copy the
desired directory from skills/ into the skills directory configured for the
agent. Read the selected SKILL.md before use; it defines the prerequisites,
workflow, and safety boundaries for that skill.
The skills CLI installs skill directories; it does not install external
executables. The splunk-cloud-admin-copilot skill requires the separately
installed acs CLI, preconfigured for the exact deployment and environment.
The skill never runs login or setup commands.
The splunk-search skill also requires the splsearch CLI on
PATH. With Go 1.21 or later installed, clone this repository and build the
CLI:
git clone https://github.com/splunk/splunk-agent-skills.git
cd splunk-agent-skills
make -C tools/splsearch build
export PATH="$PWD/tools/splsearch/bin:$PATH"
splsearch --helpThen use the installed skill through your agent according to its normal skill invocation workflow.