Scan a codebase for existing OpenTelemetry instrumentation and report on observability coverage gaps. Read-only for application code -- writes the audit artifact at .observe/otel.md but does not modify service code. Use when the user types $otel-audit, asks about observability gaps, wants to assess instrumentation coverage, says "what signals am I missing", "scan this service for observability", asks about "observability readiness", asks whether instrumentation can make incidents faster to detect or localize, or asks whether GenAI/LLM workflows follow OpenTelemetry semantic conventions. Do NOT use for implementing code changes -- use $otel-instrument instead.
Add OpenTelemetry observability to applications using auto-instrumentation and optional custom spans/metrics, write a separate instrumentation report, and run verification unless explicitly skipped or blocked. Use when the user types $otel-instrument, asks to "add OTel", "add tracing", "add metrics", "implement observability", "wire up telemetry", "instrument this service", asks to add a specific custom signal like "add a metric to track queue depth", "add a span for payment processing", "track error rate for X", or asks to add signals that make incidents faster to detect or localize, or asks to instrument GenAI/LLM workflows with OpenTelemetry semantic conventions.
Generate Splunk Observability Cloud detector and dashboard Terraform from existing observability reports. Reads .observe/otel.md plus instrumentation and verification reports when available, classifies proven or explicitly accepted metrics and readiness gaps, outputs HCL with SignalFlow program_text, and writes local configure verification. Use when the user types $splunk-configure, asks to generate detectors or dashboards, audit alert coverage, distinguish app-down from degraded impact, build blast-radius views, improve MTTD or incident localization, or add GenAI/LLM detector coverage.
Generate Splunk Observability Cloud dashboard Terraform from an existing otel-audit report. Reads .observe/otel.md, groups metrics into dashboard panels, and outputs ready-to-apply HCL (signalfx_dashboard_group + signalfx_dashboard + per-panel signalfx_*_chart resources) plus a sidecar preview model for the local Observer. Use when the user types $splunk-dashboard, asks to "generate a dashboard", "build a dashboard from the audit", "create charts for my service", or "visualize my metrics".
Diff local splunk-dashboard Terraform against live Splunk Observability Cloud dashboards and create only the confirmed gaps. Reads .observe/terraform/dashboards.tf, fetches live dashboards, dashboard groups, and charts via the Splunk O11y REST API, classifies each group / dashboard / chart as COVERED / GAP / UNCERTAIN with an explicit reason, shows a confirmation diff, and creates gaps chart-first (POST /v2/chart then POST /v2/dashboard). Writes .observe/dashboard-sync.md as a resumable ledger. Use when the user types $splunk-dashboard-publish, asks to "sync dashboards", "check which dashboards are missing", "create missing dashboards", or "push dashboard gaps to Splunk".
DEPRECATED — this skill has been renamed to $splunk-dashboard-publish. Use $splunk-dashboard-publish for all new work. This stub exists for backward compatibility and redirects to the canonical skill.
Diff local splunk-configure detector specs against live Splunk Observability Cloud detectors and create only the confirmed gaps. Reads .observe/terraform/detectors.tf, fetches live detectors for the service via the Splunk O11y REST API (GET /v2/detector), classifies each local spec as COVERED / GAP / UNCERTAIN / AutoDetect-advisory, shows a confirmation diff, and creates only the confirmed GAPs via POST /v2/detector (idempotent by diffing local specs against the live detector set and tolerating a 409). Writes .observe/detector-sync.md as an idempotent resume ledger. Use when the user types $splunk-detector-publish, asks to "sync detectors", "check which detectors are missing", "create missing monitors", or "push detector gaps to Splunk".
DEPRECATED — this skill has been renamed to $splunk-detector-publish. Use $splunk-detector-publish for all new work. This stub exists for backward compatibility and redirects to the canonical skill.