Individual skill
observability-splunk
Splunk log analysis using SPL (Search Processing Language). Use when investigating issues via Splunk logs, saved searches, or alerts.
sre-agent/.claude/skills/observability-splunk/SKILL.md
Source commit 2323af0551856ff4669b73dc36329d16aa19ed24
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 7, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 179
- Repository last updated
- Nov 8, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- ai-sre Repository topic
- site-reliability-engineering Repository topic
- ai-agent Repository topic
- devops Repository topic
- episodic-memory Repository topic
- incident-investigation Repository topic
- incident-response Repository topic
- knowledge-graph Repository topic
- sre-agent Repository topic
- self-hosted Repository topic
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 8,252 bytesSKILL.mdcore · 8,252 bytesSKILL.mdcore · 8,252 bytesSKILL.mdcore · 8,252 bytesSKILL.mdcore · 8,252 bytesSKILL.mdcore · 8,252 bytesSKILL.mdcore · 8,252 bytesSKILL.mdcore · 8,252 bytesSKILL.mdcore · 8,252 bytesSKILL.mdcore · 8,252 bytesSKILL.mdcore · 8,252 bytesSKILL.mdcore · 8,252 bytesSKILL.mdcore · 8,252 bytesscripts/__init__.pyruns · 31 bytesscripts/get_statistics.pyruns · 7,725 bytesscripts/sample_logs.pyruns · 4,888 bytesscripts/splunk_client.pyruns · 7,230 bytes
Read excerpt
# Splunk Analysis
## Authentication
**IMPORTANT**: Credentials are injected automatically by a proxy layer. Do NOT check for `SPLUNK_HOST`, `SPLUNK_TOKEN`, or other credentials in environment variables - they won't be visible to you. Just run the scripts directly; authentication is handled transparently.
---
## MANDATORY: Statistics-First Investigation
**NEVER dump raw logs.** Always follow this pattern:
```
STATISTICS → SAMPLE → PATTERNS → CORRELATE