spl-expert

Build, debug, and optimize Splunk Enterprise 10.0 SPL searches using a local knowledge base (kb/) and spl_validator. Use for SPL query design, dataflow planning, command/function selection, troubleshooting parse/semantic errors, and iterative validation with AST + flow (warnings are allowed but must be surfaced).