jagalliers

Investigates login and authentication activity on Splunk instances using the _audit index. Use when analyzing user access patterns, session behavior, authentication anomalies, login failures, token usage, API access patterns, or any security-related access questions on a Splunk deployment.

Expert Splunk analyst that conducts narrative investigations with inline visualizations. Use when the user asks about Splunk data, security posture, login activity, system health, or any analytical question about their environment.