[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-splunk-splunk-search":3,"mdc--f8doi6-key":36,"related-org-splunk-splunk-search":958,"related-repo-splunk-splunk-search":999},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":31,"sourceUrl":34,"mdContent":35},"splunk-search","run and inspect Splunk SPL searches","Run bounded Splunk SPL searches through the splsearch CLI, save large result sets as local SQLite tables, and inspect those saved tables with focused summaries, text search, ordered events, or bounded SQL.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"splunk","Splunk","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fsplunk.jpg",[12,16,19,22],{"name":13,"slug":14,"type":15},"Data Analysis","data-analysis","tag",{"name":17,"slug":18,"type":15},"CLI","cli",{"name":20,"slug":21,"type":15},"Search","search",{"name":23,"slug":24,"type":15},"SQLite","sqlite",3,"https:\u002F\u002Fgithub.com\u002Fsplunk\u002Fsplunk-agent-skills","2026-08-02T06:09:07.689795","Apache-2.0",0,[],{"repoUrl":26,"stars":25,"forks":29,"topics":32,"description":33},[],"Open source, enterprise-ready AI skills for Splunk use cases, built for secure discovery, consistent execution, and production-grade customer workflows.","https:\u002F\u002Fgithub.com\u002Fsplunk\u002Fsplunk-agent-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fsplunk-search","---\nname: splunk-search\ndescription: Run bounded Splunk SPL searches through the splsearch CLI, save large result sets as local SQLite tables, and inspect those saved tables with focused summaries, text search, ordered events, or bounded SQL.\nlicense: Apache-2.0\nallowed-tools:\n  - shell\nmetadata:\n  splunk:\n    domain: search\n    products:\n      - splunk-enterprise\n      - splunk-cloud-platform\n    entities:\n      - SPL searches\n      - saved result tables\n      - local SQLite result stores\n      - Splunk auth sessions\n      - search events\n    triggers:\n      - Splunk Search\n      - splsearch\n      - run a Splunk search\n      - query Splunk results\n      - incident search evidence\n    not-for:\n      - production write actions\n      - mutating Splunk data\n      - secret handling\n      - broad raw result dumps\n    outcomes:\n      - bounded Splunk search execution\n      - saved result-table analysis\n      - compact incident evidence\n      - support-ready search summaries\n---\n\n# Splunk Search\n\nUse Splunk Search when a user needs read-only Splunk evidence but the result\nset may be too large for the agent context. The `splsearch` CLI writes search\nresults to a local SQLite table and returns compact JSON with the table name.\nTreat the saved table as the artifact, then bring only focused summaries,\nsmall samples, or exact evidence back into the conversation.\n\n## Prerequisites\n\nThe `splsearch` CLI is installed and available on `PATH`, or the runtime\nprovides an equivalent `splsearch` binary for this skill. In this repository,\nthe packaged Go source for that CLI lives in `tools\u002Fsplsearch`. From the\nrepository root, build the tool artifact with\n`make -C tools\u002Fsplsearch build`, then put `tools\u002Fsplsearch\u002Fbin` on `PATH`\nbefore using the skill locally.\n\nThe user has read-only access to the target Splunk Enterprise or Splunk Cloud\nPlatform environment and can provide the target URL, time window, and search\nintent. Do not ask for passwords, cookies, tokens, or raw credential files.\n\n## When to Use\n\nUse this skill for Splunk log investigation, production or staging incident\ntriage, saved result-table analysis, and requests that mention `splsearch`,\nSplunk search, SPL execution, or querying saved Splunk results.\n\nDo not use this skill for changing Splunk configuration, editing knowledge\nobjects, deleting data, restarting services, creating alerts, modifying\nindexes, or handling secrets. If the user wants SPL authoring help without\nrunning a search or inspecting saved results, answer without invoking this\nskill.\n\n## Workflow Overview\n\n1. Identify the target Splunk URL, time window, impact scope, and strongest\n   available filters.\n2. Check cached auth with `splsearch auth status --output=json` when the target\n   is unclear.\n3. Validate a specific target with\n   `splsearch auth status --url=\u003Csplunk-url> --output=json` before deciding\n   whether browser login is needed.\n4. Run one bounded table-writing search with a useful time range and result\n   table name.\n5. Keep the returned `table` name and use it for every follow-up command.\n6. Review any saved warnings before continuing. If a broad fetch was\n   intentional, record that by accepting the warning.\n7. Inspect schema or metadata before writing SQL against the saved table.\n8. Use text search, summary, ordered events, or bounded SQL to reduce the saved\n   results locally.\n9. Bring only the compact answer set, evidence snippets, and command summary\n   back into chat.\n10. Keep the result table while the incident or handoff is active, then drop it\n   when evidence has been captured elsewhere.\n\nDo not shrink the Splunk search just because the agent context is small. Fetch\na relevant, bounded slice into SQLite, then reduce locally. Avoid `| head 10`,\ntiny limits, or immediate output unless the task truly needs only a tiny sample.\n\nRun table-writing searches serially. Parallel searches can contend for the\nlocal result database if they complete at the same time.\n\n## Commands\n\n- `splsearch auth status --output=json` lists cached auth inventory.\n- `splsearch auth status --url=\u003Csplunk-url> --output=json` validates one\n  target without forcing a fresh login.\n- `splsearch search --url=\u003Csplunk-url> --query='\u003CSPL>' --earliest=-15m --result-table=\u003Ctable>`\n  runs a bounded Splunk search and saves results locally.\n- `splsearch search --url=\u003Csplunk-url> --query='\u003CSPL>' --earliest=-15m --result-table=\u003Ctable> --progress=jsonl`\n  writes parseable progress events to stderr while keeping stdout as the final\n  JSON result.\n- `splsearch results-list --limit=20` rediscovers saved tables and follow-up\n  commands.\n- `splsearch result-info --table=\u003Ctable>` inspects metadata, original SPL,\n  time bounds, row counts, and warnings.\n- `splsearch result-warnings accept --table=\u003Ctable> --code=\u003Cwarning-code>`\n  marks a reviewed local warning as intentional.\n- `splsearch result-schema --table=\u003Ctable>` inspects saved columns before SQL.\n- `splsearch result-text-search --table=\u003Ctable> --query='\u003Ctext>' --limit=20`\n  performs local BM25 text recall over saved rows.\n- `splsearch result-summary --table=\u003Ctable> --group-by=\u003Cfield> --limit=20`\n  builds first-pass aggregates.\n- `splsearch result-events --table=\u003Ctable> --field=\u003Cfield> --value=\u003Cvalue>`\n  returns compact ordered event sequences.\n- `splsearch result-search --table=\u003Ctable> --query='\u003CSQL SELECT>' --limit=20`\n  runs bounded SQL against the saved table as `results`.\n- `splsearch results-drop --table=\u003Ctable>` removes a local saved table after\n  the evidence is no longer needed.\n\n## Examples\n\nInvestigate recent API errors without dumping raw rows:\n\n```sh\nsplsearch search --url=\u003Csplunk-url> --query='index=app_logs component=api severity=ERROR' --earliest=-30m --result-table=app_errors\nsplsearch result-info --table=app_errors\nsplsearch result-schema --table=app_errors\nsplsearch result-summary --table=app_errors --group-by=component --limit=20\nsplsearch result-events --table=app_errors --request-id=abc-123 --limit=100\nsplsearch result-search --table=app_errors --query='SELECT component, count(*) AS errors FROM results GROUP BY component ORDER BY errors DESC LIMIT 20' --limit=20\n```\n\nFind a text symptom inside a known saved table:\n\n```sh\nsplsearch result-text-search --table=app_errors --query='timeout retry exhausted' --limit=20\n```\n\nClean up after the handoff:\n\n```sh\nsplsearch results-drop --table=app_errors\n```\n\n## Troubleshooting\n\nIf target validation fails with a transport error, inspect the structured\n`error_code`, `operation`, `retryable`, `diagnostic_hint`, and `message`\nfields. Do not treat DNS, network, or proxy failures as proof that credentials\nneed refreshing.\n\nIf browser auth fails, keep the compact stdout JSON in context and inspect\n`error_code`, `operation`, `retryable`, `retryable_after_environment_change`,\n`remediation_code`, `diagnostic_hint`, `launch_error_summary`, `message`,\n`requested_channel`, `attempted_channel`, and `fallback_used`. Do not paste\ndiagnostic files or browser logs into chat unless the user explicitly asks.\n\nIf a long-running search appears stuck, use progress output rather than\nguessing. `--progress=jsonl` keeps stdout machine-readable and puts events such\nas dispatch, running state, fetch rows, write rows, ETA, and scan counts on\nstderr. If progress is active but scan counts are huge, narrow the SPL or time\nwindow instead of blindly extending `--timeout`.\n\nIf `search` returns `ok:false` or `table_created:false`, stop and report that\nno saved table exists. Do not continue with invented table names.\n\nIf a saved table has active warnings, review them before using the result.\nBroad or unlimited searches can be valid during an incident, but they must be\nintentional and named in the evidence.\n\nIf a saved table disappears, explain that local result tables are ephemeral and\nrerun the bounded Splunk search if the evidence is still needed.\n\n## Safety\n\nDo not print cookies, auth files, tokens, or `~\u002F.config\u002Fsplsearch\u002Fauth.json`.\nDo not read `~\u002F.config\u002Fsplsearch\u002Fresults.sqlite` directly unless the CLI cannot\nanswer the question. Do not paste broad raw result sets into chat.\n",{"data":37,"body":67},{"name":4,"description":6,"license":28,"allowed-tools":38,"metadata":40},[39],"shell",{"splunk":41},{"domain":21,"products":42,"entities":45,"triggers":51,"not-for":57,"outcomes":62},[43,44],"splunk-enterprise","splunk-cloud-platform",[46,47,48,49,50],"SPL searches","saved result tables","local SQLite result stores","Splunk auth sessions","search events",[52,53,54,55,56],"Splunk Search","splsearch","run a Splunk search","query Splunk results","incident search evidence",[58,59,60,61],"production write actions","mutating Splunk data","secret handling","broad raw result dumps",[63,64,65,66],"bounded Splunk search execution","saved result-table analysis","compact incident evidence","support-ready search summaries",{"type":68,"children":69},"root",[70,77,91,98,156,161,167,179,184,190,269,282,287,293,446,452,457,662,667,711,716,739,745,788,867,887,915,920,925,931,952],{"type":71,"tag":72,"props":73,"children":74},"element","h1",{"id":4},[75],{"type":76,"value":52},"text",{"type":71,"tag":78,"props":79,"children":80},"p",{},[81,83,89],{"type":76,"value":82},"Use Splunk Search when a user needs read-only Splunk evidence but the result\nset may be too large for the agent context. The ",{"type":71,"tag":84,"props":85,"children":87},"code",{"className":86},[],[88],{"type":76,"value":53},{"type":76,"value":90}," CLI writes search\nresults to a local SQLite table and returns compact JSON with the table name.\nTreat the saved table as the artifact, then bring only focused summaries,\nsmall samples, or exact evidence back into the conversation.",{"type":71,"tag":92,"props":93,"children":95},"h2",{"id":94},"prerequisites",[96],{"type":76,"value":97},"Prerequisites",{"type":71,"tag":78,"props":99,"children":100},{},[101,103,108,110,116,118,123,125,131,133,139,141,147,149,154],{"type":76,"value":102},"The ",{"type":71,"tag":84,"props":104,"children":106},{"className":105},[],[107],{"type":76,"value":53},{"type":76,"value":109}," CLI is installed and available on ",{"type":71,"tag":84,"props":111,"children":113},{"className":112},[],[114],{"type":76,"value":115},"PATH",{"type":76,"value":117},", or the runtime\nprovides an equivalent ",{"type":71,"tag":84,"props":119,"children":121},{"className":120},[],[122],{"type":76,"value":53},{"type":76,"value":124}," binary for this skill. In this repository,\nthe packaged Go source for that CLI lives in ",{"type":71,"tag":84,"props":126,"children":128},{"className":127},[],[129],{"type":76,"value":130},"tools\u002Fsplsearch",{"type":76,"value":132},". From the\nrepository root, build the tool artifact with\n",{"type":71,"tag":84,"props":134,"children":136},{"className":135},[],[137],{"type":76,"value":138},"make -C tools\u002Fsplsearch build",{"type":76,"value":140},", then put ",{"type":71,"tag":84,"props":142,"children":144},{"className":143},[],[145],{"type":76,"value":146},"tools\u002Fsplsearch\u002Fbin",{"type":76,"value":148}," on ",{"type":71,"tag":84,"props":150,"children":152},{"className":151},[],[153],{"type":76,"value":115},{"type":76,"value":155},"\nbefore using the skill locally.",{"type":71,"tag":78,"props":157,"children":158},{},[159],{"type":76,"value":160},"The user has read-only access to the target Splunk Enterprise or Splunk Cloud\nPlatform environment and can provide the target URL, time window, and search\nintent. Do not ask for passwords, cookies, tokens, or raw credential files.",{"type":71,"tag":92,"props":162,"children":164},{"id":163},"when-to-use",[165],{"type":76,"value":166},"When to Use",{"type":71,"tag":78,"props":168,"children":169},{},[170,172,177],{"type":76,"value":171},"Use this skill for Splunk log investigation, production or staging incident\ntriage, saved result-table analysis, and requests that mention ",{"type":71,"tag":84,"props":173,"children":175},{"className":174},[],[176],{"type":76,"value":53},{"type":76,"value":178},",\nSplunk search, SPL execution, or querying saved Splunk results.",{"type":71,"tag":78,"props":180,"children":181},{},[182],{"type":76,"value":183},"Do not use this skill for changing Splunk configuration, editing knowledge\nobjects, deleting data, restarting services, creating alerts, modifying\nindexes, or handling secrets. If the user wants SPL authoring help without\nrunning a search or inspecting saved results, answer without invoking this\nskill.",{"type":71,"tag":92,"props":185,"children":187},{"id":186},"workflow-overview",[188],{"type":76,"value":189},"Workflow Overview",{"type":71,"tag":191,"props":192,"children":193},"ol",{},[194,200,213,226,231,244,249,254,259,264],{"type":71,"tag":195,"props":196,"children":197},"li",{},[198],{"type":76,"value":199},"Identify the target Splunk URL, time window, impact scope, and strongest\navailable filters.",{"type":71,"tag":195,"props":201,"children":202},{},[203,205,211],{"type":76,"value":204},"Check cached auth with ",{"type":71,"tag":84,"props":206,"children":208},{"className":207},[],[209],{"type":76,"value":210},"splsearch auth status --output=json",{"type":76,"value":212}," when the target\nis unclear.",{"type":71,"tag":195,"props":214,"children":215},{},[216,218,224],{"type":76,"value":217},"Validate a specific target with\n",{"type":71,"tag":84,"props":219,"children":221},{"className":220},[],[222],{"type":76,"value":223},"splsearch auth status --url=\u003Csplunk-url> --output=json",{"type":76,"value":225}," before deciding\nwhether browser login is needed.",{"type":71,"tag":195,"props":227,"children":228},{},[229],{"type":76,"value":230},"Run one bounded table-writing search with a useful time range and result\ntable name.",{"type":71,"tag":195,"props":232,"children":233},{},[234,236,242],{"type":76,"value":235},"Keep the returned ",{"type":71,"tag":84,"props":237,"children":239},{"className":238},[],[240],{"type":76,"value":241},"table",{"type":76,"value":243}," name and use it for every follow-up command.",{"type":71,"tag":195,"props":245,"children":246},{},[247],{"type":76,"value":248},"Review any saved warnings before continuing. If a broad fetch was\nintentional, record that by accepting the warning.",{"type":71,"tag":195,"props":250,"children":251},{},[252],{"type":76,"value":253},"Inspect schema or metadata before writing SQL against the saved table.",{"type":71,"tag":195,"props":255,"children":256},{},[257],{"type":76,"value":258},"Use text search, summary, ordered events, or bounded SQL to reduce the saved\nresults locally.",{"type":71,"tag":195,"props":260,"children":261},{},[262],{"type":76,"value":263},"Bring only the compact answer set, evidence snippets, and command summary\nback into chat.",{"type":71,"tag":195,"props":265,"children":266},{},[267],{"type":76,"value":268},"Keep the result table while the incident or handoff is active, then drop it\nwhen evidence has been captured elsewhere.",{"type":71,"tag":78,"props":270,"children":271},{},[272,274,280],{"type":76,"value":273},"Do not shrink the Splunk search just because the agent context is small. Fetch\na relevant, bounded slice into SQLite, then reduce locally. Avoid ",{"type":71,"tag":84,"props":275,"children":277},{"className":276},[],[278],{"type":76,"value":279},"| head 10",{"type":76,"value":281},",\ntiny limits, or immediate output unless the task truly needs only a tiny sample.",{"type":71,"tag":78,"props":283,"children":284},{},[285],{"type":76,"value":286},"Run table-writing searches serially. Parallel searches can contend for the\nlocal result database if they complete at the same time.",{"type":71,"tag":92,"props":288,"children":290},{"id":289},"commands",[291],{"type":76,"value":292},"Commands",{"type":71,"tag":294,"props":295,"children":296},"ul",{},[297,307,317,328,339,350,361,372,383,394,405,416,435],{"type":71,"tag":195,"props":298,"children":299},{},[300,305],{"type":71,"tag":84,"props":301,"children":303},{"className":302},[],[304],{"type":76,"value":210},{"type":76,"value":306}," lists cached auth inventory.",{"type":71,"tag":195,"props":308,"children":309},{},[310,315],{"type":71,"tag":84,"props":311,"children":313},{"className":312},[],[314],{"type":76,"value":223},{"type":76,"value":316}," validates one\ntarget without forcing a fresh login.",{"type":71,"tag":195,"props":318,"children":319},{},[320,326],{"type":71,"tag":84,"props":321,"children":323},{"className":322},[],[324],{"type":76,"value":325},"splsearch search --url=\u003Csplunk-url> --query='\u003CSPL>' --earliest=-15m --result-table=\u003Ctable>",{"type":76,"value":327},"\nruns a bounded Splunk search and saves results locally.",{"type":71,"tag":195,"props":329,"children":330},{},[331,337],{"type":71,"tag":84,"props":332,"children":334},{"className":333},[],[335],{"type":76,"value":336},"splsearch search --url=\u003Csplunk-url> --query='\u003CSPL>' --earliest=-15m --result-table=\u003Ctable> --progress=jsonl",{"type":76,"value":338},"\nwrites parseable progress events to stderr while keeping stdout as the final\nJSON result.",{"type":71,"tag":195,"props":340,"children":341},{},[342,348],{"type":71,"tag":84,"props":343,"children":345},{"className":344},[],[346],{"type":76,"value":347},"splsearch results-list --limit=20",{"type":76,"value":349}," rediscovers saved tables and follow-up\ncommands.",{"type":71,"tag":195,"props":351,"children":352},{},[353,359],{"type":71,"tag":84,"props":354,"children":356},{"className":355},[],[357],{"type":76,"value":358},"splsearch result-info --table=\u003Ctable>",{"type":76,"value":360}," inspects metadata, original SPL,\ntime bounds, row counts, and warnings.",{"type":71,"tag":195,"props":362,"children":363},{},[364,370],{"type":71,"tag":84,"props":365,"children":367},{"className":366},[],[368],{"type":76,"value":369},"splsearch result-warnings accept --table=\u003Ctable> --code=\u003Cwarning-code>",{"type":76,"value":371},"\nmarks a reviewed local warning as intentional.",{"type":71,"tag":195,"props":373,"children":374},{},[375,381],{"type":71,"tag":84,"props":376,"children":378},{"className":377},[],[379],{"type":76,"value":380},"splsearch result-schema --table=\u003Ctable>",{"type":76,"value":382}," inspects saved columns before SQL.",{"type":71,"tag":195,"props":384,"children":385},{},[386,392],{"type":71,"tag":84,"props":387,"children":389},{"className":388},[],[390],{"type":76,"value":391},"splsearch result-text-search --table=\u003Ctable> --query='\u003Ctext>' --limit=20",{"type":76,"value":393},"\nperforms local BM25 text recall over saved rows.",{"type":71,"tag":195,"props":395,"children":396},{},[397,403],{"type":71,"tag":84,"props":398,"children":400},{"className":399},[],[401],{"type":76,"value":402},"splsearch result-summary --table=\u003Ctable> --group-by=\u003Cfield> --limit=20",{"type":76,"value":404},"\nbuilds first-pass aggregates.",{"type":71,"tag":195,"props":406,"children":407},{},[408,414],{"type":71,"tag":84,"props":409,"children":411},{"className":410},[],[412],{"type":76,"value":413},"splsearch result-events --table=\u003Ctable> --field=\u003Cfield> --value=\u003Cvalue>",{"type":76,"value":415},"\nreturns compact ordered event sequences.",{"type":71,"tag":195,"props":417,"children":418},{},[419,425,427,433],{"type":71,"tag":84,"props":420,"children":422},{"className":421},[],[423],{"type":76,"value":424},"splsearch result-search --table=\u003Ctable> --query='\u003CSQL SELECT>' --limit=20",{"type":76,"value":426},"\nruns bounded SQL against the saved table as ",{"type":71,"tag":84,"props":428,"children":430},{"className":429},[],[431],{"type":76,"value":432},"results",{"type":76,"value":434},".",{"type":71,"tag":195,"props":436,"children":437},{},[438,444],{"type":71,"tag":84,"props":439,"children":441},{"className":440},[],[442],{"type":76,"value":443},"splsearch results-drop --table=\u003Ctable>",{"type":76,"value":445}," removes a local saved table after\nthe evidence is no longer needed.",{"type":71,"tag":92,"props":447,"children":449},{"id":448},"examples",[450],{"type":76,"value":451},"Examples",{"type":71,"tag":78,"props":453,"children":454},{},[455],{"type":76,"value":456},"Investigate recent API errors without dumping raw rows:",{"type":71,"tag":458,"props":459,"children":464},"pre",{"className":460,"code":461,"language":462,"meta":463,"style":463},"language-sh shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","splsearch search --url=\u003Csplunk-url> --query='index=app_logs component=api severity=ERROR' --earliest=-30m --result-table=app_errors\nsplsearch result-info --table=app_errors\nsplsearch result-schema --table=app_errors\nsplsearch result-summary --table=app_errors --group-by=component --limit=20\nsplsearch result-events --table=app_errors --request-id=abc-123 --limit=100\nsplsearch result-search --table=app_errors --query='SELECT component, count(*) AS errors FROM results GROUP BY component ORDER BY errors DESC LIMIT 20' --limit=20\n","sh","",[465],{"type":71,"tag":84,"props":466,"children":467},{"__ignoreMap":463},[468,535,553,569,597,624],{"type":71,"tag":469,"props":470,"children":473},"span",{"class":471,"line":472},"line",1,[474,479,485,490,496,501,506,511,516,521,525,530],{"type":71,"tag":469,"props":475,"children":477},{"style":476},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[478],{"type":76,"value":53},{"type":71,"tag":469,"props":480,"children":482},{"style":481},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[483],{"type":76,"value":484}," search",{"type":71,"tag":469,"props":486,"children":487},{"style":481},[488],{"type":76,"value":489}," --url=",{"type":71,"tag":469,"props":491,"children":493},{"style":492},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[494],{"type":76,"value":495},"\u003C",{"type":71,"tag":469,"props":497,"children":498},{"style":481},[499],{"type":76,"value":500},"splunk-url",{"type":71,"tag":469,"props":502,"children":503},{"style":492},[504],{"type":76,"value":505},">",{"type":71,"tag":469,"props":507,"children":508},{"style":481},[509],{"type":76,"value":510}," --query=",{"type":71,"tag":469,"props":512,"children":513},{"style":492},[514],{"type":76,"value":515},"'",{"type":71,"tag":469,"props":517,"children":518},{"style":481},[519],{"type":76,"value":520},"index=app_logs component=api severity=ERROR",{"type":71,"tag":469,"props":522,"children":523},{"style":492},[524],{"type":76,"value":515},{"type":71,"tag":469,"props":526,"children":527},{"style":481},[528],{"type":76,"value":529}," --earliest=-30m",{"type":71,"tag":469,"props":531,"children":532},{"style":481},[533],{"type":76,"value":534}," --result-table=app_errors\n",{"type":71,"tag":469,"props":536,"children":538},{"class":471,"line":537},2,[539,543,548],{"type":71,"tag":469,"props":540,"children":541},{"style":476},[542],{"type":76,"value":53},{"type":71,"tag":469,"props":544,"children":545},{"style":481},[546],{"type":76,"value":547}," result-info",{"type":71,"tag":469,"props":549,"children":550},{"style":481},[551],{"type":76,"value":552}," --table=app_errors\n",{"type":71,"tag":469,"props":554,"children":555},{"class":471,"line":25},[556,560,565],{"type":71,"tag":469,"props":557,"children":558},{"style":476},[559],{"type":76,"value":53},{"type":71,"tag":469,"props":561,"children":562},{"style":481},[563],{"type":76,"value":564}," result-schema",{"type":71,"tag":469,"props":566,"children":567},{"style":481},[568],{"type":76,"value":552},{"type":71,"tag":469,"props":570,"children":572},{"class":471,"line":571},4,[573,577,582,587,592],{"type":71,"tag":469,"props":574,"children":575},{"style":476},[576],{"type":76,"value":53},{"type":71,"tag":469,"props":578,"children":579},{"style":481},[580],{"type":76,"value":581}," result-summary",{"type":71,"tag":469,"props":583,"children":584},{"style":481},[585],{"type":76,"value":586}," --table=app_errors",{"type":71,"tag":469,"props":588,"children":589},{"style":481},[590],{"type":76,"value":591}," --group-by=component",{"type":71,"tag":469,"props":593,"children":594},{"style":481},[595],{"type":76,"value":596}," --limit=20\n",{"type":71,"tag":469,"props":598,"children":600},{"class":471,"line":599},5,[601,605,610,614,619],{"type":71,"tag":469,"props":602,"children":603},{"style":476},[604],{"type":76,"value":53},{"type":71,"tag":469,"props":606,"children":607},{"style":481},[608],{"type":76,"value":609}," result-events",{"type":71,"tag":469,"props":611,"children":612},{"style":481},[613],{"type":76,"value":586},{"type":71,"tag":469,"props":615,"children":616},{"style":481},[617],{"type":76,"value":618}," --request-id=abc-123",{"type":71,"tag":469,"props":620,"children":621},{"style":481},[622],{"type":76,"value":623}," --limit=100\n",{"type":71,"tag":469,"props":625,"children":627},{"class":471,"line":626},6,[628,632,637,641,645,649,654,658],{"type":71,"tag":469,"props":629,"children":630},{"style":476},[631],{"type":76,"value":53},{"type":71,"tag":469,"props":633,"children":634},{"style":481},[635],{"type":76,"value":636}," result-search",{"type":71,"tag":469,"props":638,"children":639},{"style":481},[640],{"type":76,"value":586},{"type":71,"tag":469,"props":642,"children":643},{"style":481},[644],{"type":76,"value":510},{"type":71,"tag":469,"props":646,"children":647},{"style":492},[648],{"type":76,"value":515},{"type":71,"tag":469,"props":650,"children":651},{"style":481},[652],{"type":76,"value":653},"SELECT component, count(*) AS errors FROM results GROUP BY component ORDER BY errors DESC LIMIT 20",{"type":71,"tag":469,"props":655,"children":656},{"style":492},[657],{"type":76,"value":515},{"type":71,"tag":469,"props":659,"children":660},{"style":481},[661],{"type":76,"value":596},{"type":71,"tag":78,"props":663,"children":664},{},[665],{"type":76,"value":666},"Find a text symptom inside a known saved table:",{"type":71,"tag":458,"props":668,"children":670},{"className":460,"code":669,"language":462,"meta":463,"style":463},"splsearch result-text-search --table=app_errors --query='timeout retry exhausted' --limit=20\n",[671],{"type":71,"tag":84,"props":672,"children":673},{"__ignoreMap":463},[674],{"type":71,"tag":469,"props":675,"children":676},{"class":471,"line":472},[677,681,686,690,694,698,703,707],{"type":71,"tag":469,"props":678,"children":679},{"style":476},[680],{"type":76,"value":53},{"type":71,"tag":469,"props":682,"children":683},{"style":481},[684],{"type":76,"value":685}," result-text-search",{"type":71,"tag":469,"props":687,"children":688},{"style":481},[689],{"type":76,"value":586},{"type":71,"tag":469,"props":691,"children":692},{"style":481},[693],{"type":76,"value":510},{"type":71,"tag":469,"props":695,"children":696},{"style":492},[697],{"type":76,"value":515},{"type":71,"tag":469,"props":699,"children":700},{"style":481},[701],{"type":76,"value":702},"timeout retry exhausted",{"type":71,"tag":469,"props":704,"children":705},{"style":492},[706],{"type":76,"value":515},{"type":71,"tag":469,"props":708,"children":709},{"style":481},[710],{"type":76,"value":596},{"type":71,"tag":78,"props":712,"children":713},{},[714],{"type":76,"value":715},"Clean up after the handoff:",{"type":71,"tag":458,"props":717,"children":719},{"className":460,"code":718,"language":462,"meta":463,"style":463},"splsearch results-drop --table=app_errors\n",[720],{"type":71,"tag":84,"props":721,"children":722},{"__ignoreMap":463},[723],{"type":71,"tag":469,"props":724,"children":725},{"class":471,"line":472},[726,730,735],{"type":71,"tag":469,"props":727,"children":728},{"style":476},[729],{"type":76,"value":53},{"type":71,"tag":469,"props":731,"children":732},{"style":481},[733],{"type":76,"value":734}," results-drop",{"type":71,"tag":469,"props":736,"children":737},{"style":481},[738],{"type":76,"value":552},{"type":71,"tag":92,"props":740,"children":742},{"id":741},"troubleshooting",[743],{"type":76,"value":744},"Troubleshooting",{"type":71,"tag":78,"props":746,"children":747},{},[748,750,756,758,764,765,771,772,778,780,786],{"type":76,"value":749},"If target validation fails with a transport error, inspect the structured\n",{"type":71,"tag":84,"props":751,"children":753},{"className":752},[],[754],{"type":76,"value":755},"error_code",{"type":76,"value":757},", ",{"type":71,"tag":84,"props":759,"children":761},{"className":760},[],[762],{"type":76,"value":763},"operation",{"type":76,"value":757},{"type":71,"tag":84,"props":766,"children":768},{"className":767},[],[769],{"type":76,"value":770},"retryable",{"type":76,"value":757},{"type":71,"tag":84,"props":773,"children":775},{"className":774},[],[776],{"type":76,"value":777},"diagnostic_hint",{"type":76,"value":779},", and ",{"type":71,"tag":84,"props":781,"children":783},{"className":782},[],[784],{"type":76,"value":785},"message",{"type":76,"value":787},"\nfields. Do not treat DNS, network, or proxy failures as proof that credentials\nneed refreshing.",{"type":71,"tag":78,"props":789,"children":790},{},[791,793,798,799,804,805,810,811,817,819,825,826,831,832,838,839,844,845,851,852,858,859,865],{"type":76,"value":792},"If browser auth fails, keep the compact stdout JSON in context and inspect\n",{"type":71,"tag":84,"props":794,"children":796},{"className":795},[],[797],{"type":76,"value":755},{"type":76,"value":757},{"type":71,"tag":84,"props":800,"children":802},{"className":801},[],[803],{"type":76,"value":763},{"type":76,"value":757},{"type":71,"tag":84,"props":806,"children":808},{"className":807},[],[809],{"type":76,"value":770},{"type":76,"value":757},{"type":71,"tag":84,"props":812,"children":814},{"className":813},[],[815],{"type":76,"value":816},"retryable_after_environment_change",{"type":76,"value":818},",\n",{"type":71,"tag":84,"props":820,"children":822},{"className":821},[],[823],{"type":76,"value":824},"remediation_code",{"type":76,"value":757},{"type":71,"tag":84,"props":827,"children":829},{"className":828},[],[830],{"type":76,"value":777},{"type":76,"value":757},{"type":71,"tag":84,"props":833,"children":835},{"className":834},[],[836],{"type":76,"value":837},"launch_error_summary",{"type":76,"value":757},{"type":71,"tag":84,"props":840,"children":842},{"className":841},[],[843],{"type":76,"value":785},{"type":76,"value":818},{"type":71,"tag":84,"props":846,"children":848},{"className":847},[],[849],{"type":76,"value":850},"requested_channel",{"type":76,"value":757},{"type":71,"tag":84,"props":853,"children":855},{"className":854},[],[856],{"type":76,"value":857},"attempted_channel",{"type":76,"value":779},{"type":71,"tag":84,"props":860,"children":862},{"className":861},[],[863],{"type":76,"value":864},"fallback_used",{"type":76,"value":866},". Do not paste\ndiagnostic files or browser logs into chat unless the user explicitly asks.",{"type":71,"tag":78,"props":868,"children":869},{},[870,872,878,880,886],{"type":76,"value":871},"If a long-running search appears stuck, use progress output rather than\nguessing. ",{"type":71,"tag":84,"props":873,"children":875},{"className":874},[],[876],{"type":76,"value":877},"--progress=jsonl",{"type":76,"value":879}," keeps stdout machine-readable and puts events such\nas dispatch, running state, fetch rows, write rows, ETA, and scan counts on\nstderr. If progress is active but scan counts are huge, narrow the SPL or time\nwindow instead of blindly extending ",{"type":71,"tag":84,"props":881,"children":883},{"className":882},[],[884],{"type":76,"value":885},"--timeout",{"type":76,"value":434},{"type":71,"tag":78,"props":888,"children":889},{},[890,892,897,899,905,907,913],{"type":76,"value":891},"If ",{"type":71,"tag":84,"props":893,"children":895},{"className":894},[],[896],{"type":76,"value":21},{"type":76,"value":898}," returns ",{"type":71,"tag":84,"props":900,"children":902},{"className":901},[],[903],{"type":76,"value":904},"ok:false",{"type":76,"value":906}," or ",{"type":71,"tag":84,"props":908,"children":910},{"className":909},[],[911],{"type":76,"value":912},"table_created:false",{"type":76,"value":914},", stop and report that\nno saved table exists. Do not continue with invented table names.",{"type":71,"tag":78,"props":916,"children":917},{},[918],{"type":76,"value":919},"If a saved table has active warnings, review them before using the result.\nBroad or unlimited searches can be valid during an incident, but they must be\nintentional and named in the evidence.",{"type":71,"tag":78,"props":921,"children":922},{},[923],{"type":76,"value":924},"If a saved table disappears, explain that local result tables are ephemeral and\nrerun the bounded Splunk search if the evidence is still needed.",{"type":71,"tag":92,"props":926,"children":928},{"id":927},"safety",[929],{"type":76,"value":930},"Safety",{"type":71,"tag":78,"props":932,"children":933},{},[934,936,942,944,950],{"type":76,"value":935},"Do not print cookies, auth files, tokens, or ",{"type":71,"tag":84,"props":937,"children":939},{"className":938},[],[940],{"type":76,"value":941},"~\u002F.config\u002Fsplsearch\u002Fauth.json",{"type":76,"value":943},".\nDo not read ",{"type":71,"tag":84,"props":945,"children":947},{"className":946},[],[948],{"type":76,"value":949},"~\u002F.config\u002Fsplsearch\u002Fresults.sqlite",{"type":76,"value":951}," directly unless the CLI cannot\nanswer the question. Do not paste broad raw result sets into chat.",{"type":71,"tag":953,"props":954,"children":955},"style",{},[956],{"type":76,"value":957},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":959,"total":25},[960,976,992],{"slug":961,"name":961,"fn":962,"description":963,"org":964,"tags":965,"stars":25,"repoUrl":26,"updatedAt":975},"custom-visualization-builder","build and install custom Splunk visualizations","Scaffold, build, package, and install a custom visualization into Splunk using the dashboard-studio-extension framework. Use when the user wants to create a new custom viz, add a visualization to an existing project, or migrate a legacy custom viz.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[966,969,972],{"name":967,"slug":968,"type":15},"Plugin Development","plugin-development",{"name":970,"slug":971,"type":15},"UI Components","ui-components",{"name":973,"slug":974,"type":15},"Visualization","visualization","2026-08-02T06:09:08.393955",{"slug":977,"name":977,"fn":978,"description":979,"org":980,"tags":981,"stars":25,"repoUrl":26,"updatedAt":991},"splunk-dashboard-converter","convert Splunk Simple XML to Dashboard Studio","Convert classic Splunk Simple XML dashboards (version 1) into Dashboard Studio (version 2). Takes classic Simple XML as input, preserves every SPL query verbatim, and returns the Studio JSON definition to the caller. Use when the user asks to convert, migrate, upgrade, modernize, port, or make a v2 \u002F Dashboard Studio version of an existing classic Splunk dashboard, form, or Simple XML view.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[982,985,988],{"name":983,"slug":984,"type":15},"Dashboards","dashboards",{"name":986,"slug":987,"type":15},"Migration","migration",{"name":989,"slug":990,"type":15},"XML","xml","2026-08-02T06:09:08.054477",{"slug":4,"name":4,"fn":5,"description":6,"org":993,"tags":994,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[995,996,997,998],{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"items":1000,"total":25},[1001,1007,1013],{"slug":961,"name":961,"fn":962,"description":963,"org":1002,"tags":1003,"stars":25,"repoUrl":26,"updatedAt":975},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1004,1005,1006],{"name":967,"slug":968,"type":15},{"name":970,"slug":971,"type":15},{"name":973,"slug":974,"type":15},{"slug":977,"name":977,"fn":978,"description":979,"org":1008,"tags":1009,"stars":25,"repoUrl":26,"updatedAt":991},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1010,1011,1012],{"name":983,"slug":984,"type":15},{"name":986,"slug":987,"type":15},{"name":989,"slug":990,"type":15},{"slug":4,"name":4,"fn":5,"description":6,"org":1014,"tags":1015,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1016,1017,1018,1019],{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15}]