splunk-spl2-pipeline-kit

Splunk SPL2 Pipeline Kit

This skill is the shared SPL2 authoring and validation surface for splunk-ingest-processor-setup and splunk-edge-processor-setup. It is offline-only: it renders starter SPL2, lints pipeline files, and reports profile compatibility issues without calling Splunk APIs.

For newer Cisco Data Fabric wording, this is the reusable SPL2 authoring route. Native Observability Metrics Pipeline Management remains a separate UI workflow covered by splunk-observability-deep-native-workflows.

Agent Behavior

• Use ingestProcessor for Splunk-hosted Ingest Processor pipelines.
• Use edgeProcessor for Edge Processor pipelines.
• Keep real samples, private keys, HEC tokens, Observability tokens, and lookup contents out of chat and rendered files. Render placeholders and file-path handoffs only.
• Treat SPL-to-SPL2 conversion as review assistance. Splunk's in-product conversion tool remains the authoritative conversion workflow.
• Read reference.md before changing supported commands, templates, or lint rules.

Quick Start

Render every template and lint the rendered output:

bash skills/splunk-spl2-pipeline-kit/scripts/setup.sh --phase all --profile both

Lint a user-provided pipeline:

bash skills/splunk-spl2-pipeline-kit/scripts/setup.sh \
  --phase lint \
  --profile ingestProcessor \
  --pipeline-file pipelines/my_pipeline.spl2

Run the offline smoke test:

bash skills/splunk-spl2-pipeline-kit/scripts/smoke_offline.sh

Outputs

The default output directory is splunk-spl2-pipeline-kit-rendered/:

• templates/<profile>/*.spl2 - route, branch, redact, sample, lookup, extract, timestamp, JSON/XML, OCSF, decrypt, metrics, stats, S3, and compatibility starters where supported.
• custom-template-app/default/data/spl2/*.spl2 - SPL2 custom template module examples using @template and runtime profile metadata.
• lint-report.json and lint-report.md.
• coverage-report.json.

Guardrails