How do I install the Splunk Spl2 Pipeline Kit skill?

Run npx skillmds@latest add kilo-org/splunk-spl2-pipeline-kit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Splunk Spl2 Pipeline Kit safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Splunk Spl2 Pipeline Kit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Splunk Spl2 Pipeline Kit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Splunk Spl2 Pipeline Kit?

Kilo-Org (@kilo-org) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Splunk Spl2 Pipeline Kit by kilo-org

Name: Splunk Spl2 Pipeline Kit
Author: Kilo-Org

Splunk Spl2 Pipeline Kit

Render and lint reusable SPL2 pipeline templates for Cisco Data Fabric, Splunk Ingest Processor, and Edge Processor, including routing, redaction, sampling, lookups, metrics, OCSF, decrypt, stats, custom templates, SPL-to-SPL2 compatibility, and PCRE2 migration checks. Use when the user needs SPL2 pipeline authoring, conversion review, compatibility linting, or shared templates for Ingest Processor or Edge Processor workflows, including Cisco Data Fabric or telemetry pipeline management requests that need reusable SPL2 pipeline logic.

Kilo-Org b2eaffe 10 files · 40.3 KB Updated Sep 17, 2026

File contents

Splunk SPL2 Pipeline Kit

This skill is the shared SPL2 authoring and validation surface for splunk-ingest-processor-setup and splunk-edge-processor-setup. It is offline-only: it renders starter SPL2, lints pipeline files, and reports profile compatibility issues without calling Splunk APIs.

For newer Cisco Data Fabric wording, this is the reusable SPL2 authoring route. Native Observability Metrics Pipeline Management remains a separate UI workflow covered by splunk-observability-deep-native-workflows.

Agent Behavior

Use ingestProcessor for Splunk-hosted Ingest Processor pipelines.
Use edgeProcessor for Edge Processor pipelines.
Keep real samples, private keys, HEC tokens, Observability tokens, and lookup contents out of chat and rendered files. Render placeholders and file-path handoffs only.
Treat SPL-to-SPL2 conversion as review assistance. Splunk's in-product conversion tool remains the authoritative conversion workflow.
Read reference.md before changing supported commands, templates, or lint rules.

Quick Start

Render every template and lint the rendered output:

bash skills/splunk-spl2-pipeline-kit/scripts/setup.sh --phase all --profile both

Lint a user-provided pipeline:

bash skills/splunk-spl2-pipeline-kit/scripts/setup.sh \
  --phase lint \
  --profile ingestProcessor \
  --pipeline-file pipelines/my_pipeline.spl2

Run the offline smoke test:

bash skills/splunk-spl2-pipeline-kit/scripts/smoke_offline.sh

Outputs

The default output directory is splunk-spl2-pipeline-kit-rendered/:

templates/<profile>/*.spl2 - route, branch, redact, sample, lookup, extract, timestamp, JSON/XML, OCSF, decrypt, metrics, stats, S3, and compatibility starters where supported.
custom-template-app/default/data/spl2/*.spl2 - SPL2 custom template module examples using @template and runtime profile metadata.
lint-report.json and lint-report.md.
coverage-report.json.

Guardrails

logs_to_metrics requires an import logs_to_metrics from /splunk.ingest.commands style import and is Ingest Processor-only.
decrypt is Ingest Processor-only and must be treated as a private-key lookup handoff. Do not render private-key material.
stats linting rejects avg() because Ingest Processor documents sum()/count() as the supported average pattern. Edge Processor stats is supported and includes newer state-window behavior on current EP versions.
object_to_array() is deprecated in SPL2 release notes; use json_entries().
Regex guidance is PCRE2-oriented. Prefer named captures like (?P<fieldName>...).
Edge Processor-only and Ingest Processor-only differences are reported in the lint output rather than hidden in comments.

---name: splunk-spl2-pipeline-kitdescription: Render and lint reusable SPL2 pipeline templates for Cisco Data Fabric, Splunk Ingest Processor, and Edge Processor, including routing, redaction, sampling, lookups, metrics, OCSF, decrypt, stats, custom templates, SPL-to-SPL2 compatibility, and PCRE2 migration checks. Use when the user needs SPL2 pipeline authoring, conversion review, compatibility linting, or shared templates for Ingest Processor or Edge Processor workflows, including Cisco Data Fabric or telemetry pipeline management requests that need reusable SPL2 pipeline logic.---# Splunk SPL2 Pipeline KitThis skill is the shared SPL2 authoring and validation surface for`splunk-ingest-processor-setup` and `splunk-edge-processor-setup`. It isoffline-only: it renders starter SPL2, lints pipeline files, and reportsprofile compatibility issues without calling Splunk APIs.For newer Cisco Data Fabric wording, this is the reusable SPL2 authoring route.Native Observability Metrics Pipeline Management remains a separate UI workflowcovered by `splunk-observability-deep-native-workflows`.## Agent Behavior- Use `ingestProcessor` for Splunk-hosted Ingest Processor pipelines.- Use `edgeProcessor` for Edge Processor pipelines.- Keep real samples, private keys, HEC tokens, Observability tokens, and lookup contents out of chat and rendered files. Render placeholders and file-path handoffs only.- Treat SPL-to-SPL2 conversion as review assistance. Splunk's in-product conversion tool remains the authoritative conversion workflow.- Read `reference.md` before changing supported commands, templates, or lint rules.## Quick StartRender every template and lint the rendered output:```bashbash skills/splunk-spl2-pipeline-kit/scripts/setup.sh --phase all --profile both```Lint a user-provided pipeline:```bashbash skills/splunk-spl2-pipeline-kit/scripts/setup.sh \ --phase lint \ --profile ingestProcessor \ --pipeline-file pipelines/my_pipeline.spl2```Run the offline smoke test:```bashbash skills/splunk-spl2-pipeline-kit/scripts/smoke_offline.sh```## OutputsThe default output directory is `splunk-spl2-pipeline-kit-rendered/`:- `templates/<profile>/*.spl2` - route, branch, redact, sample, lookup, extract, timestamp, JSON/XML, OCSF, decrypt, metrics, stats, S3, and compatibility starters where supported.- `custom-template-app/default/data/spl2/*.spl2` - SPL2 custom template module examples using `@template` and runtime profile metadata.- `lint-report.json` and `lint-report.md`.- `coverage-report.json`.## Guardrails- `logs_to_metrics` requires an `import logs_to_metrics from /splunk.ingest.commands` style import and is Ingest Processor-only.- `decrypt` is Ingest Processor-only and must be treated as a private-key lookup handoff. Do not render private-key material.- `stats` linting rejects `avg()` because Ingest Processor documents `sum()/count()` as the supported average pattern. Edge Processor `stats` is supported and includes newer state-window behavior on current EP versions.- `object_to_array()` is deprecated in SPL2 release notes; use `json_entries()`.- Regex guidance is PCRE2-oriented. Prefer named captures like `(?P<fieldName>...)`.- Edge Processor-only and Ingest Processor-only differences are reported in the lint output rather than hidden in comments.

Frequently asked questions