# Splunk Search

> Execute and validate SPL (Search Processing Language) queries.

- Skill: `gabrielmoreira/splunk-search` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gabrielmoreira/splunk-search`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gabrielmoreira/splunk-search/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: Apache-2.0
- Author: gabrielmoreira (https://skillmd.com/u/gabrielmoreira)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/gabrielmoreira/splunk-search

---


# Splunk Search Skill

Execute and validate SPL (Search Processing Language) queries.

## Tools

| Tool | Description |
|------|-------------|
| `validate_spl` | Validate SPL syntax without executing |
| `search_oneshot` | Execute SPL query and return results |
| `search_export` | Execute SPL query and export to file |

## Output Format

Results are formatted as **Markdown tables** for easy reading. Sensitive fields are automatically sanitized.

## Example Queries

```
Validate this SPL: index=network sourcetype=syslog | stats count by host

Search for all firewall denies in the last hour

Export BGP peer events from the network index
```

## SPL Tips

- Use `earliest=-1h` for time ranges
- Use `| table field1, field2` to select columns
- Use `| stats count by field` for aggregations

## Prerequisites

- `SPLUNK_HOST` Splunk server hostname
- `SPLUNK_PORT` Management port (default: 8089)
- `SPLUNK_USERNAME` Service account username
- `SPLUNK_PASSWORD` Service account password

## Server

This skill uses the `splunk-mcp` server via npx.