Splunk Search
Run bounded read-only Splunk searches through splunkctl.Built by Splunk LLCInstallation
npx skills add splunk/splunk-agent-skills --skill splunk-searchSkill instructions
Use Splunk Search when a user needs current, read-only evidence from Splunk.
Run supported live searches with splunkctl, reduce results on the Splunk
server, and return only the counts, states, or small excerpts needed to answer
the request.
When to Use
Use this skill for Splunk log investigation, production or staging incident triage, bounded SPL execution, search-job inspection, and compact search evidence.
Do not use this skill for changing Splunk configuration, editing knowledge objects, deleting data, restarting services, creating alerts, modifying indexes, or handling secrets.