Splunk Cloud Admin Copilot

Safely operate one narrow Splunk Cloud Platform administration path. Read ACS state and readiness evidence, and, only after the write gate passes, add or remove one exact IPv4 CIDR from one feature-specific allowlist. Do not turn the availability of the acs executable into permission for any other ACS write.

When to Use

Use this skill for:

• describing one of these IPv4 allowlists: acs, search-api, hec, s2s, search-ui, idm-api, or idm-ui
• adding one exact IPv4 CIDR to one of those feature allowlists
• removing one exact IPv4 CIDR from one of those feature allowlists
• using current status and supplied schedule, freeze, and dependency evidence to assess maintenance or restart readiness without changing anything
• producing the preflight, approval boundary, verification, rollback, and sanitized receipt for the bounded operation

Do not use this skill for IPv6, multiple CIDRs, multiple features, a generic ACS operation, or any write other than the single allowlist add or remove. Split a larger request into separate approvals and runs; never batch it here.

Route specialist work before operating

Keep only the bounded allowlist operation or read-only readiness assessment and route every specialist domain:

• users, roles, capabilities, SAML, SSO, or identity design to the identity and SAML specialist
• security policy, vulnerability, compliance, or network-policy decisions to the security specialist
• upgrades, upgrade remediation, maintenance scheduling, change-freeze changes, or restart execution to their owning specialist or Splunk Support
• HEC tokens and other data inputs to the ingestion specialist; an allowlist entry for feature hec remains in scope, but HEC configuration does not
• indexes, retention, and storage to the index-management specialist
• private or Splunkbase app lifecycle to the app-management specialist
• dashboards, alerts, searches, and knowledge objects to their specialists
• CMC health, indexing, crashes, restarts, and performance symptoms to a Splunk platform operations specialist
• SPL execution or search evidence to splunk-search

If a request mixes domains, name the routed dependencies and stop those parts. Do not absorb a specialist's action into the allowlist change.