splunk-search

name	splunk-search
description	Execute and validate SPL (Search Processing Language) queries.
version	1.0.0
license	Apache-2.0
author	netclaw
tags	[]

Splunk Search Skill

Execute and validate SPL (Search Processing Language) queries.

Tools

Tool	Description
validate_spl	Validate SPL syntax without executing
search_oneshot	Execute SPL query and return results
search_export	Execute SPL query and export to file

Output Format

Results are formatted as Markdown tables for easy reading. Sensitive fields are automatically sanitized.

Example Queries

Validate this SPL: index=network sourcetype=syslog | stats count by host

Search for all firewall denies in the last hour

Export BGP peer events from the network index

SPL Tips

• Use earliest=-1h for time ranges
• Use | table field1, field2 to select columns
• Use | stats count by field for aggregations

Prerequisites

• SPLUNK_HOST Splunk server hostname
• SPLUNK_PORT Management port (default: 8089)
• SPLUNK_USERNAME Service account username
• SPLUNK_PASSWORD Service account password

Server

This skill uses the splunk-mcp server via npx.