lyderhansen

Validates, packages, and (on failure) diagnoses a splunk-custom-viz app. Make sure to use this skill after cv-create writes the source files, or whenever the user asks to package, tar, build, or deploy a Splunk custom viz pack. Produces .tar.gz (Classic) or .spl (Extension API) or both. Grep-based validation — no node_modules required. Includes 54 diagnostic rules loaded on demand when a viz fails.

Generates Splunk custom visualization code — formatter HTML, Canvas 2D source, and app config. Includes copy-paste templates with correct Splunk-specific syntax for ad-hoc search compatibility.

Expert guidance for building, customising, and packaging Splunk add-ons using the UCC (Universal Configuration Console) Framework. Use this skill whenever the user mentions: UCC, splunk add-on, TA (Technology Add-on), globalConfig, ucc-gen, modular inputs, Splunk add-on development, addonfactory, splunktaucclib, or needs to create/edit/build/package/validate a Splunk add-on. Also trigger for tasks involving inputs pages, configuration pages, alert actions, OAuth in Splunk, custom REST handlers, or any work with globalConfig.json / globalConfig.yaml files.

Use this skill whenever the user wants to build, customise, or extend Splunk visualisations and dashboards using the Splunk UI Toolkit (SUIT). Triggers include: creating a Splunk React app with @splunk/create, building custom visualisations or chart types for Dashboard Studio or the Unified Dashboard Framework (UDF), editing Dashboard JSON definitions (dataSources, visualizations, layout, inputs, tokens, expressions), wiring up tokens and drilldown interactivity, adding @splunk/react-ui components (Button, Card, Table, Layout, etc.) to a Splunk page, theming with SplunkThemeProvider, and packaging Splunk apps as .spl files. Also trigger for any question about when to choose Dashboard Studio vs the Dashboard Framework vs Classic Simple XML, or how to migrate between them. Always use this skill for SUIT topics even if the user only mentions "Splunk dashboard", "splunk.column", "DashboardCore", "preset", "drilldown token", "@splunk/react-ui", or "splunk app React".

SPL syntax traps and categorized command index for all Splunk search commands. Load BEFORE writing any SPL — dashboards, ad-hoc searches, alerts, saved searches, generators. Top 20+ silent-fail traps ranked by frequency, plus categorized command index with when-to-use descriptions. For full syntax on any command, read reference/<command>.md from this plugin.

Produces a single-file HTML mockup and a structured DESIGN-LOCK.md for a Splunk custom viz pack. Make sure to use this skill after cv-scope, or whenever the user wants to design a Splunk custom viz pack with high visual quality. HTML-first design workflow: writes a designer-grade mockup the user can open in a browser, then extracts a structured visual contract for cv-create to port to Splunk code. Includes mandatory pre-flight commitment block, 8 absolute bans against AI-slop patterns, and a self-administered Slop Test.

Design-first orchestrator for Splunk Dashboard Studio — runs the Design Context Protocol (audience, viewing context, tone, anti-references, brand) before any JSON, picks a persona and archetype, then routes to the ds-ref-* family for specific palette/typography/layout/encoding decisions. Will refuse to design in the dark. Use when the user wants a Splunk dashboard to look crafted, not AI-generic. Triggers on "make this dashboard beautiful", "clean up this dashboard", "design a dashboard for [executive/SOC/NOC/analyst/business]", "why does my dashboard look like AI made it", "redesign", "polish". Pairs with ds-ref-archetypes, ds-ref-color, ds-ref-typography, ds-ref-layout-grid, ds-ref-visual-encoding, ds-ref-anti-patterns, ds-ref-personas, ds-ref-references, ds-ref-brand, ds-ref-themes.

Ports a DESIGN-LOCK.md visual contract into installable Splunk custom viz source code. Make sure to use this skill after cv-sketch, or whenever the user wants to write Splunk custom viz Canvas code from a designed mockup. Three modes: (1) full pipeline — write all vizs in the lock; (2) single-viz iteration — re-render one viz, with natural-language delta support like 'make the gauge segments wider'; (3) standalone — one-shot a single viz from a bare prompt with inline mini-design. Outputs ES5 Canvas viz source, formatter HTML, theme.js, and demo CSVs. Both Classic AMD and Extension API formats. Light + dark themes are independent render paths.

Analyze a log sample to produce a draft SPEC.yaml for adding a new data source. Use when you have raw log lines from a new source and want a structured format analysis before scaffolding a generator.

Create a new log generator following project patterns. Use when adding support for a new log source like Palo Alto, CrowdStrike, Okta, etc.

Create a new attack or operational scenario. Use when adding coordinated events across multiple log sources.

Generate demo log data for Splunk. Use when you need to create synthetic logs for testing, demos, or training.

Use this skill when the user wants to create, edit, or generate Splunk Dashboard Studio dashboards (JSON-based, version 2). Triggers include any mention of "Dashboard Studio", "Splunk dashboard", "splunk.pie", "splunk.table", "splunk.singlevalue", "splunk.timeline", "splunk.parallelcoordinates", or requests to build Splunk visualizations, security dashboards, monitoring dashboards, or SOC dashboards. Also use when converting Simple XML dashboards to Dashboard Studio format, or when generating dashboard JSON definitions programmatically. Do NOT use for Classic Simple XML dashboards (version 1), Splunk Observability Cloud dashboards, or AppDynamics dashboards.

Complete field reference for all FAKE: sourcetypes in the fake_tshrt index. Use when writing SPL queries, building dashboards, or understanding the data model.

Create a new REST endpoint for the Splunk TA. Use when adding new functionality to the admin dashboard.

Scaffold and build Splunk custom visualizations using Canvas 2D. Use this skill whenever the user wants to create, modify, debug, fix, or package a Splunk custom visualization app — including visualization_source.js, formatter.html, visualizations.conf, savedsearches.conf, webpack config, harness.json, or anything involving SplunkVisualizationBase. Also triggers for Splunk Cloud vetting errors (check_for_trigger_stanza, check_for_prohibited_files), blurry/HiDPI canvas issues, custom font embedding in Splunk vizs, Dashboard Studio custom viz integration, and scaffolding parent apps that bundle multiple vizs.