Executes and manages SPL queries within Splunk using oneshot, normal, and blocking execution modes.
The Splunk Search skill empowers Claude to interact directly with Splunk instances to perform complex data analysis and log retrieval via the Splunk REST API. It provides a robust interface for executing Search Processing Language (SPL) queries across multiple execution modes, allowing users to choose between ad-hoc oneshot searches for quick results, asynchronous normal searches for long-running jobs, or synchronous blocking searches. With built-in SPL validation, time-range optimization, and result pagination support, it streamlines the process of monitoring system health, investigating security incidents, and extracting actionable insights from large datasets directly through Claude.
Key Features
01Granular time-range controls to optimize index scanning and performance
02Supports multiple execution modes: Oneshot, Normal (async), and Blocking (sync)
03Built-in SPL syntax validation to catch errors before job submission
04Real-time search preview and paginated result retrieval for large datasets
050 GitHub stars
06Comprehensive search job management including SID tracking and status polling
Use Cases
01Automated monitoring of system metrics by managing long-running asynchronous search jobs
02Ad-hoc troubleshooting and log analysis using oneshot SPL queries for rapid debugging
03Validating complex SPL syntax and field extractions before deploying production alerts
