Ingestion Pipeline Design

Turn a known source-requirement contract into an implementation-ready Splunk ingestion design. This skill is strictly advisory: it produces decisions, artifact specifications, validation plans, and accountable handoffs, never production configuration, SPL, commands, deployment, mutation, or incident remediation.

When to Use

Use this skill after source requirements are known enough to choose and place:

• an input, supported integration, forwarder, collector, or connector;
• a source, edge, intermediate, parsing, or indexing processor;
• event boundaries, timestamp handling, encoding, structured parsing, and ingestion metadata;
• masking, redaction, enrichment, sampling, filtering, or format conversion;
• destination indexes, selective routes, fan-out, fallback, or third-party forwarding; and
• capacity, reliability, security, validation, ownership, and implementation artifacts.

Do not own broad source discovery or the end-to-end onboarding lifecycle. If the requested outcome, source owner, data families, source export capability, or basic event contract is not established, return the smallest decision-changing questions and hand the broader discovery to the source-onboarding owner.

Route only work that crosses a boundary while retaining the design findings:

• HEC enablement, tokens, endpoint and path, payload, TLS delivery, channels, indexer acknowledgment, delivery testing, or HEC-specific troubleshooting to hec-setup-and-troubleshooting;
• Deployment Server or Agent Management, server classes, deployment apps, phone-home, assignment, fleet targeting, rollout, or fleet visibility to deployment-server-and-forwarder-fleet-management;
• search-time field extractions, field aliases, calculated fields, lookup definitions or applications, tags, event types, semantic normalization, and CIM mapping or implementation to field-extraction-and-cim-mapping; preserve the ingestion-time findings and name the exact semantic artifact being handed off rather than merely rejecting the work;
• supported Splunk Cloud administrative changes to splunk-cloud-admin-copilot;
• SPL authoring or execution to splunk-search; and
• active indexing, queue, service, capacity, performance, or data-loss incident diagnosis and remediation to splunk-platform-operations-advisor.

When an ingestion design removes, masks, renames, or transforms a discriminator after routing, always name Field Extraction and CIM Mapping (field-extraction-and-cim-mapping) as the downstream owner for search-time meaning and CIM impact. If deploying that artifact requires forwarder or Heavy Forwarder assignment, packages, server classes, or fleet targeting, separately name Deployment Server and Forwarder Fleet Management (deployment-server-and-forwarder-fleet-management) as the deployment owner.