splunk-search

$npx mdskill add automateyournetwork/netclaw/splunk-search

Execute and validate SPL queries against Splunk data sources

  • Solve tasks requiring analysis of log data using SPL syntax
  • Relies on Splunk server credentials and the splunk-mcp client
  • Uses validate_spl, search_oneshot, and search_export tools to process queries
  • Returns results as sanitized Markdown tables or exported files
SKILL.md
.github/skills/splunk-searchView on GitHub ↗
---
name: splunk-search
description: "Execute and validate SPL (Search Processing Language) queries."
version: 1.0.0
license: Apache-2.0
author: netclaw
tags: []
---

# Splunk Search Skill

Execute and validate SPL (Search Processing Language) queries.

## Tools

| Tool | Description |
|------|-------------|
| `validate_spl` | Validate SPL syntax without executing |
| `search_oneshot` | Execute SPL query and return results |
| `search_export` | Execute SPL query and export to file |

## Output Format

Results are formatted as **Markdown tables** for easy reading. Sensitive fields are automatically sanitized.

## Example Queries

```
Validate this SPL: index=network sourcetype=syslog | stats count by host

Search for all firewall denies in the last hour

Export BGP peer events from the network index
```

## SPL Tips

- Use `earliest=-1h` for time ranges
- Use `| table field1, field2` to select columns
- Use `| stats count by field` for aggregations

## Prerequisites

- `SPLUNK_HOST` Splunk server hostname
- `SPLUNK_PORT` Management port (default: 8089)
- `SPLUNK_USERNAME` Service account username
- `SPLUNK_PASSWORD` Service account password

## Server

This skill uses the `splunk-mcp` server via npx.
More from automateyournetwork/netclaw