Open source, enterprise-ready AI skills for Splunk use cases, built for secure discovery, consistent execution, and production-grade customer workflows.
Skill Claude CodeCodex
Give cited, advisory-only Splunk app and add-on lifecycle guidance and assess supplied compatibility, installation, upgrade, validation, deprecation, migration, and removal evidence. Use when a Splunk Cloud Platform or Splunk Enterprise administrator needs packaging or AppInspect guidance, environment-specific…
Skill Claude CodeCodex
Scaffold, build, package, and install a custom visualization into Splunk using the dashboard-studio-extension framework. Use when the user wants to create a new custom viz, add a visualization to an existing project, or migrate a legacy custom viz.
Skill Claude CodeCodex
Explain, plan, and diagnose Splunk Enterprise Deployment Server and 10.x Agent Management fleet behavior from public documentation and sanitized evidence. Use for terminology, deployment apps, server classes, client filters, phone-home, effective assignment, rollout verification, cache or reload behavior, scale…
Skill Claude CodeCodex
Author, explain, diagnose, and validate Splunk search-time field extractions and mappings to Common Information Model (CIM) datasets from representative events, configuration, and search evidence. Use for automatic key-value extraction, regex or delimiter extraction, props.conf EXTRACT and REPORT/transforms.conf…
Skill Claude CodeCodex
Set up and validate Splunk HTTP Event Collector (HEC), explain indexer acknowledgment and distributed HEC behavior, diagnose HEC no-data and HTTP delivery failures from sanitized evidence, and prepare bounded escalation handoffs. Use for Splunk Cloud Platform or Splunk Enterprise HEC tokens, endpoints, event or raw…
Skill Claude CodeCodex
Give cited public Splunk knowledge-object governance guidance and assess user-authorized inventory, ownership, orphan, ACL, naming, lifecycle, lookup, and search-head-cluster comparison evidence without changing a deployment. Use for shared lookups, sourcetypes, saved searches, macros, field extractions, aliases…
Skill Claude CodeCodex
Diagnose and improve one existing functional Splunk search from supplied SPL and runtime evidence. Use when a search, report, dashboard panel, or scheduled search is slow, queued, expensive, resource-intensive, or prematurely finalized and the user needs evidence-backed query tuning, acceleration-fit analysis…
Skill Claude CodeCodex
Read Splunk Cloud Platform ACS state, assess maintenance or restart readiness without changing it, and execute one explicitly approved IPv4 CIDR add or remove for one feature-specific IP allowlist through the documented public ACS provider. Use when a Cloud admin needs exact-target preflight, a minimal allowlist…
Skill Claude CodeCodex
Convert classic Splunk Simple XML dashboards (version 1) into Dashboard Studio (version 2). Takes classic Simple XML as input, preserves every SPL query verbatim, and returns the Studio JSON definition to the caller. Use when the user asks to convert, migrate, upgrade, modernize, port, or make a v2 / Dashboard Studio…
Skill Claude CodeCodex
Answer cited questions about Splunk Cloud Monitoring Console, Splunk Enterprise Monitoring Console, splunkd health reports, health dashboards, health.log, and health endpoints; collect and normalize health evidence; guide privacy-aware diag and RapidDiag collection; and interpret supplied health signals into bounded…
Skill Claude CodeCodex
Research current public Splunk sources and use optional existing-auth read-only stack evidence to diagnose SAML, LDAP, roles, capabilities, group mappings, login failures, and access readiness without changing identity configuration or handling credentials.
Skill Claude CodeCodex
Research and answer current Splunk product questions from public sources with explicit product, deployment, version, freshness, and evidence boundaries. Use for explanatory questions such as what a feature does, where it is available, which edition or version supports it, whether two products or versions are…
Skill Claude CodeCodex
Run bounded, read-only Splunk SPL searches through splunkctl and return compact, evidence-backed results without exposing credentials or flooding context.
Skill Claude CodeCodex
Build cited, evidence-labeled Splunk Enterprise upgrade plans and Splunk Cloud support-assisted version-change readiness plans without performing the upgrade. Use for upgrade scope intake, supported-path and prerequisite research, dependency compatibility, prechecks, backups, sequencing, maintenance-window readiness…
Skill Claude CodeCodex
Assess Splunk-related advisories, CVEs, scanner or package findings, remediation and exception evidence, and vulnerability or compliance readiness. Use when Splunk administrators, security operators, compliance owners, or reviewers need an evidence-backed environment exposure decision, remediation or exception plan…
Skill Claude CodeCodex
Give cited, advisory-only Splunk alert, scheduled-report action, Enterprise Security finding/notable, and risk-workflow readiness guidance from supplied evidence. Use for schedule, trigger, suppression, action, recipient, downstream, ownership, escalation, entitlement, and post-change validation decisions. Route SPL…
Skill Claude CodeCodex
Assess latency, queueing, timeouts, missed or duplicate schedules, dispatch and concurrency pressure, refresh overlap, and data-source fan-out across existing Splunk dashboards, reports, and alerts without changing them. Use when object load, freshness, scheduled execution, or downstream timing is degraded and the…
Skill Claude CodeCodex
Assess Splunk data-model and report-acceleration readiness, summary coverage, and troubleshooting evidence without changing a deployment. Use for data-model object readiness, acceleration enablement, build or lag state, incomplete summaries, report acceleration, summary sharing, and choosing whether an acceleration…
Skill Claude CodeCodex
Orchestrate a new Splunk data source from requirements and supported collection-method selection through source, sourcetype, host, timestamp, event-boundary, indexed-event, ownership, and acceptance validation. Use for Splunk Cloud Platform or Splunk Enterprise source intake, applicability decisions, readiness…
Skill Claude CodeCodex
Diagnose Splunk forwarder and data-ingest paths from sanitized, read-only evidence. Use for Universal or Heavy Forwarder transport, deployment-client effects on ingestion, HEC and other inputs, parsing and timestamps, event boundaries, routing, sourcetype or index mismatches, missing, delayed, duplicated, or dropped…
Skill Claude CodeCodex
Diagnose post-triage, multi-component Splunk incidents from a supplied privacy-reviewed diagnostic packet. Use to align clocks and symptoms, preserve impact and contradictions, map dependencies, rank and test competing causal hypotheses, request the smallest safe read-only discriminator, validate bounded findings, and…
Skill Claude CodeCodex
Design and assess Splunk index, retention, capacity, archive, storage-tier, bucket-lifecycle, and SmartStore plans from supplied requirements and evidence without changing a deployment. Use for index placement, searchable and archive windows, growth and capacity models, storage choices, restore planning, SmartStore…
Skill Claude CodeCodex
Assess Splunk indexer-cluster membership, factor and searchability state, bucket fix-up evidence, cluster-bundle distribution, rolling-maintenance readiness, multisite behavior, and SmartStore interactions without changing a deployment. Use for cluster-manager or peer health, unmet replication or search factors…
Skill Claude CodeCodex
Design implementation-ready Splunk ingestion pipelines from known source requirements. Use for input and collector choice, processor placement, ingestion-time parsing, transformation, filtering, routing, capacity, reliability, security, validation, ownership, and implementation handoff for Splunk Cloud Platform or…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: