Menu
DEPRECATED — SPL reference has moved to the splunk-spl plugin. Install it and use spl-gotchas instead. This stub remains for backwards compatibility.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Validates, packages, and (on failure) diagnoses a splunk-custom-viz app. Make sure to use this skill after cv-create writes the source files, or whenever the user asks to package, tar, build, or deploy a Splunk custom viz pack. Produces .tar.gz (Classic) or .spl (Extension API) or both. Grep-based validation — no node_modules required. Includes 54 diagnostic rules loaded on demand when a viz fails.
Generates Splunk custom visualization code — formatter HTML, Canvas 2D source, and app config. Includes copy-paste templates with correct Splunk-specific syntax for ad-hoc search compatibility.
Expert guidance for building, customising, and packaging Splunk add-ons using the UCC (Universal Configuration Console) Framework. Use this skill whenever the user mentions: UCC, splunk add-on, TA (Technology Add-on), globalConfig, ucc-gen, modular inputs, Splunk add-on development, addonfactory, splunktaucclib, or needs to create/edit/build/package/validate a Splunk add-on. Also trigger for tasks involving inputs pages, configuration pages, alert actions, OAuth in Splunk, custom REST handlers, or any work with globalConfig.json / globalConfig.yaml files.
Use this skill whenever the user wants to build, customise, or extend Splunk visualisations and dashboards using the Splunk UI Toolkit (SUIT). Triggers include: creating a Splunk React app with @splunk/create, building custom visualisations or chart types for Dashboard Studio or the Unified Dashboard Framework (UDF), editing Dashboard JSON definitions (dataSources, visualizations, layout, inputs, tokens, expressions), wiring up tokens and drilldown interactivity, adding @splunk/react-ui components (Button, Card, Table, Layout, etc.) to a Splunk page, theming with SplunkThemeProvider, and packaging Splunk apps as .spl files. Also trigger for any question about when to choose Dashboard Studio vs the Dashboard Framework vs Classic Simple XML, or how to migrate between them. Always use this skill for SUIT topics even if the user only mentions "Splunk dashboard", "splunk.column", "DashboardCore", "preset", "drilldown token", "@splunk/react-ui", or "splunk app React".
SPL syntax traps and categorized command index for all Splunk search commands. Load BEFORE writing any SPL — dashboards, ad-hoc searches, alerts, saved searches, generators. Top 20+ silent-fail traps ranked by frequency, plus categorized command index with when-to-use descriptions. For full syntax on any command, read reference/<command>.md from this plugin.
Produces a single-file HTML mockup and a structured DESIGN-LOCK.md for a Splunk custom viz pack. Make sure to use this skill after cv-scope, or whenever the user wants to design a Splunk custom viz pack with high visual quality. HTML-first design workflow: writes a designer-grade mockup the user can open in a browser, then extracts a structured visual contract for cv-create to port to Splunk code. Includes mandatory pre-flight commitment block, 8 absolute bans against AI-slop patterns, and a self-administered Slop Test.
| name | ds-spl |
| description | DEPRECATED — SPL reference has moved to the splunk-spl plugin. Install it and use spl-gotchas instead. This stub remains for backwards compatibility. |
SPL reference is now in the splunk-spl plugin (separate install).
spl-gotchas skill (21 traps + 151-command categorized index)splunk-spl/reference/<command>.md (149 files)Install the plugin: add splunk-spl from the splunk-knowledge marketplace.
The most common SPL traps — load spl-gotchas for the full list:
spath uses output= not ascase() default: 1==1, "val" not true() = "val"'field.name'sort default limit is 10000 — use sort 0matchValue for string-equality DOS, rangeValue for numeric ranges!= in search returns nulls — use wheretimechart limit=10 hides series — use limit=0 useother=ffirst()/last() are NOT time-ordered — use earliest()/latest()join default max is 50000 — use max=0"field" in eval is a string literal, not a field reference