splunk-agent-skills

In the author's own words, from each skill's SKILL.md — showing the first 30 of 32 files.

• alerting-and-notable-workflows

  Give cited, advisory-only Splunk alert, scheduled-report action, Enterprise Security finding/notable, and risk-workflow readiness guidance from supplied evidence. Use for schedule, trigger, suppression, action, recipient, downstream, ownership, escalation, entitlement, and post-change validation decisions. Route SPL authoring and execution to Splunk Search, broad permissions and object lifecycle…

  skills/alerting-and-notable-workflows/SKILL.md on GitHub (opens in a new tab)

• app-and-add-on-lifecycle-advisor

  Give cited, advisory-only Splunk app and add-on lifecycle guidance and assess supplied compatibility, installation, upgrade, validation, deprecation, migration, and removal evidence. Use when a Splunk Cloud Platform or Splunk Enterprise administrator needs packaging or AppInspect guidance, environment-specific readiness classification, a non-mutating lifecycle plan, or safe-removal review for a n…

  skills/app-and-add-on-lifecycle-advisor/SKILL.md on GitHub (opens in a new tab)

• custom-visualization-builder

  Scaffold, build, package, and install a custom visualization into Splunk using the dashboard-studio-extension framework. Use when the user wants to create a new custom viz, add a visualization to an existing project, or migrate a legacy custom viz.

  skills/custom-visualization-builder/SKILL.md on GitHub (opens in a new tab)

• dashboard-report-alert-performance-advisor

  Assess latency, queueing, timeouts, missed or duplicate schedules, dispatch and concurrency pressure, refresh overlap, and data-source fan-out across existing Splunk dashboards, reports, and alerts without changing them. Use when object load, freshness, scheduled execution, or downstream timing is degraded and the requester needs an evidence-bounded performance finding, product and provider bound…

  skills/dashboard-report-alert-performance-advisor/SKILL.md on GitHub (opens in a new tab)

• data-model-and-search-acceleration

  Assess Splunk data-model and report-acceleration readiness, summary coverage, and troubleshooting evidence without changing a deployment. Use for data-model object readiness, acceleration enablement, build or lag state, incomplete summaries, report acceleration, summary sharing, and choosing whether an acceleration mechanism fits a repeated search objective. Require validated field and CIM prereq…

  skills/data-model-and-search-acceleration/SKILL.md on GitHub (opens in a new tab)

• data-source-onboarding-advisor

  Orchestrate a new Splunk data source from requirements and supported collection-method selection through source, sourcetype, host, timestamp, event-boundary, indexed-event, ownership, and acceptance validation. Use for Splunk Cloud Platform or Splunk Enterprise source intake, applicability decisions, readiness, acceptance contracts, and exact implementation handoffs; do not use for endpoint setup…

  skills/data-source-onboarding-advisor/SKILL.md on GitHub (opens in a new tab)

• deployment-server-and-forwarder-fleet-management

  Explain, plan, and diagnose Splunk Enterprise Deployment Server and 10.x Agent Management fleet behavior from public documentation and sanitized evidence. Use for terminology, deployment apps, server classes, client filters, phone-home, effective assignment, rollout verification, cache or reload behavior, scale tuning, fleet visibility, and Deployment Server delivery of Splunk Remote Upgrader con…

  skills/deployment-server-and-forwarder-fleet-management/SKILL.md on GitHub (opens in a new tab)

• field-extraction-and-cim-mapping

  Author, explain, diagnose, and validate Splunk search-time field extractions and mappings to Common Information Model (CIM) datasets from representative events, configuration, and search evidence. Use for automatic key-value extraction, regex or delimiter extraction, props.conf EXTRACT and REPORT/transforms.conf rules, SPL extraction commands, aliases, calculated fields, lookups, event types, tag…

  skills/field-extraction-and-cim-mapping/SKILL.md on GitHub (opens in a new tab)

• forwarder-and-data-ingest-doctor

  Diagnose Splunk forwarder and data-ingest paths from sanitized, read-only evidence. Use for Universal or Heavy Forwarder transport, deployment-client effects on ingestion, HEC and other inputs, parsing and timestamps, event boundaries, routing, sourcetype or index mismatches, missing, delayed, duplicated, or dropped events, and queues or backpressure in Splunk Cloud Platform or Splunk Enterprise;…

  skills/forwarder-and-data-ingest-doctor/SKILL.md on GitHub (opens in a new tab)

• hec-setup-and-troubleshooting

  Set up and validate Splunk HTTP Event Collector (HEC), explain indexer acknowledgment and distributed HEC behavior, diagnose HEC no-data and HTTP delivery failures from sanitized evidence, and prepare bounded escalation handoffs. Use for Splunk Cloud Platform or Splunk Enterprise HEC tokens, endpoints, event or raw payloads, TLS, channels, ACK, health, authorization, queues, and delivery verifica…

  skills/hec-setup-and-troubleshooting/SKILL.md on GitHub (opens in a new tab)

• incident-diagnosis-specialist

  Diagnose post-triage, multi-component Splunk incidents from a supplied privacy-reviewed diagnostic packet. Use to align clocks and symptoms, preserve impact and contradictions, map dependencies, rank and test competing causal hypotheses, request the smallest safe read-only discriminator, validate bounded findings, and hand confirmed component failures to exact specialists. Do not use to collect r…

  skills/incident-diagnosis-specialist/SKILL.md on GitHub (opens in a new tab)

• index-and-storage-management-advisor

  Design and assess Splunk index, retention, capacity, archive, storage-tier, bucket-lifecycle, and SmartStore plans from supplied requirements and evidence without changing a deployment. Use for index placement, searchable and archive windows, growth and capacity models, storage choices, restore planning, SmartStore readiness, and evidence-backed change validation. Route active incidents and provi…

  skills/index-and-storage-management-advisor/SKILL.md on GitHub (opens in a new tab)

• indexer-cluster-health-and-troubleshooting

  Assess Splunk indexer-cluster membership, factor and searchability state, bucket fix-up evidence, cluster-bundle distribution, rolling-maintenance readiness, multisite behavior, and SmartStore interactions without changing a deployment. Use for cluster-manager or peer health, unmet replication or search factors, incomplete searchability, persistent fix-up, cluster-bundle state, rolling readiness,…

  skills/indexer-cluster-health-and-troubleshooting/SKILL.md on GitHub (opens in a new tab)

• ingestion-pipeline-design

  Design implementation-ready Splunk ingestion pipelines from known source requirements. Use for input and collector choice, processor placement, ingestion-time parsing, transformation, filtering, routing, capacity, reliability, security, validation, ownership, and implementation handoff for Splunk Cloud Platform or Splunk Enterprise. Do not use for source-onboarding discovery, production configura…

  skills/ingestion-pipeline-design/SKILL.md on GitHub (opens in a new tab)

• knowledge-object-governance

  Give cited public Splunk knowledge-object governance guidance and assess user-authorized inventory, ownership, orphan, ACL, naming, lifecycle, lookup, and search-head-cluster comparison evidence without changing a deployment. Use for shared lookups, sourcetypes, saved searches, macros, field extractions, aliases, props/transforms, CIM mappings, dashboards, reports, and related objects when an adm…

  skills/knowledge-object-governance/SKILL.md on GitHub (opens in a new tab)

• license-and-capacity-planning-advisor

  Separate Splunk Enterprise entitlement lifecycle issues from measured license-capacity demand and produce an evidence-bounded, advisory-only plan grounded in current official Splunk documentation.

  skills/license-and-capacity-planning-advisor/SKILL.md on GitHub (opens in a new tab)

• report-authoring-specialist

  Define evidence-bounded Splunk report contracts and readiness findings for scheduled and ad hoc reports without creating, running, scheduling, editing, or sending them. Use when a requester needs the business question, search-definition handoff, time range and timezone, cadence and schedule window, recipients and formats, permission prerequisites, acceptance evidence, Cloud or Enterprise ownershi…

  skills/report-authoring-specialist/SKILL.md on GitHub (opens in a new tab)

• search-and-dashboard-troubleshooter

  Diagnose broken Splunk searches, reports, alerts, and dashboards from supplied evidence. Use when an existing search or saved object is empty, missing, wrong, inconsistent, invisible, not dispatching, not triggering, or not rendering and the user needs the first unsupported functional stage, the smallest next evidence, aligned read-only validation, and an exact authoring, governance, field, workf…

  skills/search-and-dashboard-troubleshooter/SKILL.md on GitHub (opens in a new tab)

• search-head-cluster-health-and-troubleshooting

  Assess Splunk Search Head Cluster captaincy, elections and Raft state, member health, configuration and artifact replication, scheduler and search availability, KV Store health and recovery boundaries, deployer bundle phases, member drift, and rolling-change readiness without changing a deployment. Use for SHC captain/member instability, replication inconsistency, KV Store symptoms, deployer prop…

  skills/search-head-cluster-health-and-troubleshooting/SKILL.md on GitHub (opens in a new tab)

• search-performance-optimizer

  Diagnose and improve one existing functional Splunk search from supplied SPL and runtime evidence. Use when a search, report, dashboard panel, or scheduled search is slow, queued, expensive, resource-intensive, or prematurely finalized and the user needs evidence-backed query tuning, acceleration-fit analysis, workload separation, or a comparable before-and-after plan. Route new-search authoring,…

  skills/search-performance-optimizer/SKILL.md on GitHub (opens in a new tab)

• splunk-cloud-admin-copilot

  Read Splunk Cloud Platform ACS state, assess maintenance or restart readiness without changing it, and execute one explicitly approved IPv4 CIDR add or remove for one feature-specific IP allowlist through the documented public ACS provider. Use when a Cloud admin needs exact-target preflight, a minimal allowlist mutation, readback, rollback, and a sanitized receipt; route every other administrati…

  skills/splunk-cloud-admin-copilot/SKILL.md on GitHub (opens in a new tab)

• splunk-dashboard-converter

  Convert classic Splunk Simple XML dashboards (version 1) into Dashboard Studio (version 2). Takes classic Simple XML as input, preserves every SPL query verbatim, and returns the Studio JSON definition to the caller. Use when the user asks to convert, migrate, upgrade, modernize, port, or make a v2 / Dashboard Studio version of an existing classic Splunk dashboard, form, or Simple XML view.

  skills/splunk-dashboard-converter/SKILL.md on GitHub (opens in a new tab)

• splunk-enterprise-administration-advisor

  Provide cited, read-only Splunk Enterprise administration guidance for routine local users, roles, capabilities, configuration precedence, service ownership, maintenance readiness, and safe non-mutating validation. Use when an administrator needs to understand documented Enterprise behavior, compare supplied source-file, btool, or runtime observations, identify accountable role owners, or decide…

  skills/splunk-enterprise-administration-advisor/SKILL.md on GitHub (opens in a new tab)

• splunk-health-monitoring-and-diagnostic-collection

  Answer cited questions about Splunk Cloud Monitoring Console, Splunk Enterprise Monitoring Console, splunkd health reports, health dashboards, health.log, and health endpoints; collect and normalize health evidence; guide privacy-aware diag and RapidDiag collection; and interpret supplied health signals into bounded hypotheses and support handoffs. Use for Splunk Cloud Platform or Splunk Enterpri…

  skills/splunk-health-monitoring-and-diagnostic-collection/SKILL.md on GitHub (opens in a new tab)

• splunk-identity-saml-readiness-advisor

  Research current public Splunk sources and use optional existing-auth read-only stack evidence to diagnose SAML, LDAP, roles, capabilities, group mappings, login failures, and access readiness without changing identity configuration or handling credentials.

  skills/splunk-identity-saml-readiness-advisor/SKILL.md on GitHub (opens in a new tab)

• splunk-product-question-navigator

  Research and answer current Splunk product questions from public sources with explicit product, deployment, version, freshness, and evidence boundaries. Use for explanatory questions such as what a feature does, where it is available, which edition or version supports it, whether two products or versions are compatible, or what changed. Route live incidents, stack changes, SPL execution, account-…

  skills/splunk-product-question-navigator/SKILL.md on GitHub (opens in a new tab)

• splunk-search

  Run bounded, read-only Splunk SPL searches through splunkctl and return compact, evidence-backed results without exposing credentials or flooding context.

  skills/splunk-search/SKILL.md on GitHub (opens in a new tab)

• splunk-setup-page-builder

  Build a certification-compliant first-run setup page for a Splunk app or add-on that collects non-secret settings via the configurations REST endpoint and secrets via storage/passwords, wires app.conf/default.meta correctly, and avoids the deprecated setup.xml mechanism. Use when the user wants a "Set up your app" screen, first-run configuration wizard, or a way to collect an endpoint/credential/…

  skills/splunk-setup-page-builder/SKILL.md on GitHub (opens in a new tab)

• upgrade-and-security-readiness-router

  Classify Splunk upgrade, advisory, vulnerability, compliance, and post-change incident requests; preserve the minimum applicability and ownership context; ask one route-changing question when necessary; and hand each outcome to the exact public-product, upgrade-readiness, vulnerability/compliance, platform-operations, Cloud-administration, app-lifecycle, or provider owner. This skill routes only.…

  skills/upgrade-and-security-readiness-router/SKILL.md on GitHub (opens in a new tab)

• upgrade-and-vulnerability-readiness-advisor

  Assess cited Splunk Enterprise and Splunk Cloud version, maintenance, and security-patch readiness. Use when a planned version change or Splunk security advisory needs one evidence-labeled applicability and readiness decision covering compatibility, prerequisites, sequencing, change control, recovery, validation, and Cloud-versus-Enterprise ownership without executing the change.

  skills/upgrade-and-vulnerability-readiness-advisor/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• superpowersby obra An agentic skills framework & software development methodology that works. 300k stars · 15 skills
• skillsby mattpocock Skills for Real Engineers. Straight from my .agents directory. 293k stars · 30 skills
• ECCby affaan-m The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Cod… 280k stars · 30 skills
• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 270k stars · 1 skill
• andrej-karpathy-skillsby multica-ai A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls. 220k stars · 1 skill
• skillsby anthropics Public repository for Agent Skills 181k stars · 19 skills