Splunk Search Skill
Execute and validate SPL (Search Processing Language) queries.
Tools
| Tool | Description |
|---|---|
validate_spl |
Validate SPL syntax without executing |
search_oneshot |
Execute SPL query and return results |
search_export |
Execute SPL query and export to file |
Output Format
Results are formatted as Markdown tables for easy reading. Sensitive fields are automatically sanitized.
Example Queries
Validate this SPL: index=network sourcetype=syslog | stats count by host
Search for all firewall denies in the last hour
Export BGP peer events from the network index
SPL Tips
- Use
earliest=-1hfor time ranges - Use
| table field1, field2to select columns - Use
| stats count by fieldfor aggregations
Prerequisites
SPLUNK_HOSTSplunk server hostnameSPLUNK_PORTManagement port (default: 8089)SPLUNK_USERNAMEService account usernameSPLUNK_PASSWORDService account password
Server
This skill uses the splunk-mcp server via npx.