splunk-knowledge

Validates, packages, and (on failure) diagnoses a splunk-custom-viz app. Make sure to use this skill after cv-create writes the source files, or whenever the user asks to package, tar, build, or deploy a Splunk custom viz pack. Produces .tar.gz (Classic) or .spl (Extension API) or both. Grep-based validation — no node_modules required. Includes 54 diagnostic rules loaded on demand when a viz fails.

Generates Splunk custom visualization code — formatter HTML, Canvas 2D source, and app config. Includes copy-paste templates with correct Splunk-specific syntax for ad-hoc search compatibility.

Expert guidance for building, customising, and packaging Splunk add-ons using the UCC (Universal Configuration Console) Framework. Use this skill whenever the user mentions: UCC, splunk add-on, TA (Technology Add-on), globalConfig, ucc-gen, modular inputs, Splunk add-on development, addonfactory, splunktaucclib, or needs to create/edit/build/package/validate a Splunk add-on. Also trigger for tasks involving inputs pages, configuration pages, alert actions, OAuth in Splunk, custom REST handlers, or any work with globalConfig.json / globalConfig.yaml files.

Use this skill whenever the user wants to build, customise, or extend Splunk visualisations and dashboards using the Splunk UI Toolkit (SUIT). Triggers include: creating a Splunk React app with @splunk/create, building custom visualisations or chart types for Dashboard Studio or the Unified Dashboard Framework (UDF), editing Dashboard JSON definitions (dataSources, visualizations, layout, inputs, tokens, expressions), wiring up tokens and drilldown interactivity, adding @splunk/react-ui components (Button, Card, Table, Layout, etc.) to a Splunk page, theming with SplunkThemeProvider, and packaging Splunk apps as .spl files. Also trigger for any question about when to choose Dashboard Studio vs the Dashboard Framework vs Classic Simple XML, or how to migrate between them. Always use this skill for SUIT topics even if the user only mentions "Splunk dashboard", "splunk.column", "DashboardCore", "preset", "drilldown token", "@splunk/react-ui", or "splunk app React".

SPL syntax traps and categorized command index for all Splunk search commands. Load BEFORE writing any SPL — dashboards, ad-hoc searches, alerts, saved searches, generators. Top 20+ silent-fail traps ranked by frequency, plus categorized command index with when-to-use descriptions. For full syntax on any command, read reference/<command>.md from this plugin.

Produces a single-file HTML mockup and a structured DESIGN-LOCK.md for a Splunk custom viz pack. Make sure to use this skill after cv-scope, or whenever the user wants to design a Splunk custom viz pack with high visual quality. HTML-first design workflow: writes a designer-grade mockup the user can open in a browser, then extracts a structured visual contract for cv-create to port to Splunk code. Includes mandatory pre-flight commitment block, 8 absolute bans against AI-slop patterns, and a self-administered Slop Test.

Design-first orchestrator for Splunk Dashboard Studio — runs the Design Context Protocol (audience, viewing context, tone, anti-references, brand) before any JSON, picks a persona and archetype, then routes to the ds-ref-* family for specific palette/typography/layout/encoding decisions. Will refuse to design in the dark. Use when the user wants a Splunk dashboard to look crafted, not AI-generic. Triggers on "make this dashboard beautiful", "clean up this dashboard", "design a dashboard for [executive/SOC/NOC/analyst/business]", "why does my dashboard look like AI made it", "redesign", "polish". Pairs with ds-ref-archetypes, ds-ref-color, ds-ref-typography, ds-ref-layout-grid, ds-ref-visual-encoding, ds-ref-anti-patterns, ds-ref-personas, ds-ref-references, ds-ref-brand, ds-ref-themes.

Ports a DESIGN-LOCK.md visual contract into installable Splunk custom viz source code. Make sure to use this skill after cv-sketch, or whenever the user wants to write Splunk custom viz Canvas code from a designed mockup. Three modes: (1) full pipeline — write all vizs in the lock; (2) single-viz iteration — re-render one viz, with natural-language delta support like 'make the gauge segments wider'; (3) standalone — one-shot a single viz from a bare prompt with inline mini-design. Outputs ES5 Canvas viz source, formatter HTML, theme.js, and demo CSVs. Both Classic AMD and Extension API formats. Light + dark themes are independent render paths.

Gathers the 5 context inputs needed to build a Splunk custom viz pack. Make sure to use this skill whenever the user asks to build, design, scaffold, or create a Splunk custom visualization, themed dashboard app, or branded viz suite — even if they only say 'I want a Splunk viz' without using the word 'pack' or 'plugin'. Asks for: app name, brand + domain, target format, viz inventory hint, theme. Routes to cv-sketch with a structured scope-context block.

Diagnostic reference for Splunk custom viz failures — 54 rules organized by severity (fatal, broken, rejected, cosmetic) plus error diagnosis flowchart. Loaded automatically when editing viz source files.

Advanced Canvas 2D rendering recipes for Splunk custom vizs — shapes, effects, animation, sparklines, typography systems, hover tooltips, and mood-based design recipes. ES5 only.

Builds and packages Splunk custom visualization apps — flat AMD compilation, post-build validation, and tarball packaging ready for Splunk install.

Splunk Dashboard Studio tabbed layouts — split a single dashboard into multiple panel groups, each with its own grid layout, sharing the same global inputs and data sources. Provides patterns for 3-tab analyst workflows, tab-scoped inputs (input_host_filter only on Detail tab), tab-bar position, and the global vs tab-scoped input split. Use when the user asks about tabs, tabbed dashboards, multiple pages in one dashboard, layoutDefinitions, tab bar position, or splitting workflows by audience in Splunk Dashboard Studio.

Splunk Dashboard Studio token reference — how dashboards pass user-facing values into searches and visualization options. Covers $token$ syntax, $token.subfield$, token filters (|h |u |s), expressions stanza (eval and conditions), $eval:name$ reference syntax (works in markdown/SPL/setToken value, does NOT work in input.timerange defaultValue), JSONata syntax (NOT SPL eval — & for concat, ? : ternary, $now()), and version requirements (Enterprise 10.2+ / Cloud 10.1.2507+). Use when the user asks about tokens, eval expressions, derived tokens, $eval:name$, why a panel isn't updating, or token filters in Splunk Dashboard Studio.

Splunk Dashboard Studio archetypes reference — the four canonical layouts (executive summary, operational monitoring, analytical deep-dive, SOC overview / wall) with panel-mix fingerprints, audience profiles, viewing context, and per-archetype defaults. Use when picking layout shape for a new dashboard, when ds-couture commits to an archetype, or when the user asks "what should this look like for X audience?".

JSONata syntax reference for Splunk Dashboard Studio eval expressions and conditions — operators (arithmetic, comparison, ternary, string &), string functions ($substring, $uppercase, $trim, $replace, $split, $join), numeric functions ($round, $floor, $ceil, $abs, $formatNumber), date/time functions ($now, $millis, $toMillis, $fromMillis), array operations ($map, $filter, $reduce, $count, $sort), path expressions, lambdas, and common recipes (RAG thresholds, dynamic labels, toggles, time arithmetic). Use when writing expressions.eval or expressions.conditions in Dashboard Studio JSON.

Splunk Dashboard Studio v2 JSON schema reference — top-level keys, dataSources (ds.search / ds.savedSearch / ds.chain / ds.test), visualizations container, inputs and tokens, defaults, expressions, layout (absolute / grid / tabs), drilldowns, and the XML envelope used for file deployment. Use when authoring or editing Dashboard Studio JSON by hand, when ds-create needs field-level detail, or when answering standalone questions about Dashboard Studio syntax. For Dynamic Options Syntax (DOS), see the companion DOS-REFERENCE.md.

Use this skill to generate a full Splunk Dashboard Studio JSON definition (dashboard.json) from a workspace's layout.json and data-sources.json. Reads Panel positions, visualization types, and SPL queries; produces the complete dataSources + visualizations + layout.structure. Advances workspace state from designed to built. Requires a workspace at designed stage produced by ds-design. **Before generating JSON, this skill REQUIRES loading the per-viz `ds-viz-<type>` skill for every distinct viz type in the layout, plus `ds-pick-viz`, `ds-ref-design-principles`, `ds-ref-syntax`, and `ds-ref-pitfalls`. Skipping these lookups produces output that fails schema validation or renders empty.**

Layout, spacing, and grid math for Splunk Dashboard Studio — 4pt and 8pt grid scales, F-pattern reading flow, hero KPI sizing rules, gutter math for absolute layouts, golden-ratio for hero zones, depth via layered splunk.rectangle, and canvas-zone presets per archetype (all 1920px minimum). Use when wireframing, when ds-design positions panels, or when ds-polish tightens alignment.

Starts a Splunk custom visualization pack build. Gathers app name, brand context, tone, font strategy, data source, viz inventory, then routes to the right workflow.

Designs themed Splunk visualization packs — brand research, palette selection, viz inventory, and design briefs for multi-viz apps with unified visual identity.

Splunk Dashboard Studio drilldown reference — click handlers that fire on row, point, or marker click. Covers setToken (key reads click context, value sets literal/computed), linkToSearch, linkToDashboard (ARRAY with value field only — NOT key, NOT object map), customUrl (|u mandatory), columnFormat.data (DS expression starting with >), and three-handler chain for cross-dashboard ±N minute time ranges. Use when the user asks about drilldowns, click handlers, eventHandlers, setToken, linkToDashboard, cross-dashboard navigation, or master-detail flows in Splunk Dashboard Studio.

Splunk configuration file reference — gotchas, precedence rules, and per-conf-file settings index. Load BEFORE writing or editing any Splunk .conf file. Covers all ~60 configuration files with traps ranked by frequency, data pipeline mapping, restart-vs-reload matrix, and a complete index pointing to reference/conf/<name>.md for every stanza and setting.

DEPRECATED — SPL reference has moved to the splunk-spl plugin. Install it and use spl-gotchas instead. This stub remains for backwards compatibility.

Splunk Dashboard Studio conditional panel visibility — toggle individual panels on or off using containerOptions.visibility (showConditions/hideConditions). Covers progressive disclosure, empty-state hints, wizard flows, hideWhenNoData, input.button toggle pattern (Enterprise 10.2+ / Cloud 10.1.2507+), and the portable "$tok$ != ''" expression syntax. Note: conditions are source-code-only — Token Manager UI creates eval expressions but NOT conditions. Use when the user asks about visibility, show/hide panel, toggle button, conditional panels, showConditions, hideWhenNoData, containerOptions.visibility, or input.button in Splunk Dashboard Studio.

Splunk Dashboard Studio dashboard-root defaults block — sets shared options on every data source or visualization of a given type. Most commonly used to wire a global timerange into every ds.search, set a project-wide refresh cadence, define dataset-wide visualization defaults, or initialise drilldown-populated tokens with defaults.tokens.default. Use when the user asks about defaults, global timerange, queryParameters, refresh / refreshType, shared options, or "why does one search ignore the time picker" in Splunk Dashboard Studio.

Splunk Dashboard Studio cross-skill pitfalls matrix — the "if X is wrong, look here" first-stop reference. Maps common symptoms (panel renders empty, axes flipped, sparklines only on row 1, multiselect breaks IN(), threshold colours land in wrong bucket, validator rejects schema, drilldown payload missing) to the per-viz / interactivity / reference skill that owns the fix. Spans viz, interactivity, and schema concerns. Use when the user reports a Splunk Dashboard Studio panel that doesn't render correctly, when validating a JSON-rejected dashboard, or as the first stop for "why is X not working" debugging questions.

Build a new Splunk Dashboard Studio dashboard from scratch. Asks what the dashboard is about, who will view it, and what style to aim for — then generates a complete Dashboard Studio v2 JSON with professional visual design. Handles iteration. Saves to .splunk-agent/dashboard.json.

Deploy a dashboard to Splunk via MCP with overwrite protection. Reads .splunk-agent/dashboard.json, checks if the dashboard ID already exists in Splunk, asks for confirmation before overwriting, and pushes. Falls back to showing the JSON for manual paste if MCP is unavailable.

Critique and improve an existing Splunk Dashboard Studio dashboard. Accepts pasted JSON, a file path, or pulls from Splunk via MCP. Analyzes visual design, layout, viz choices, and data queries. Proposes ranked improvements and generates an upgraded dashboard. Saves to .splunk-agent/dashboard.json.

Splunk Dashboard Studio splunk.image visualization — the only way to put a real image (logo, screenshot, diagram, background canvas, watermark) on a dashboard. Provides patterns for header logos, background canvases with KPI overlays, datacenter floor plans with rectangle hit-zones, faint watermarks, and the upload-vs-URL trade-off (PDF export caveat). Use when the user asks about images, logos, screenshots, architecture diagrams, floor plans, watermarks, or branded backgrounds in Splunk Dashboard Studio.

Use this skill to produce a deployable Splunk artifact from a validated dashboard.json. Writes dashboard.xml (Dashboard Studio v2 XML envelope with embedded JSON definition) to the workspace, and optionally packages the dashboard as a Splunk TA tarball with app.conf, metadata, and view files ready to install into Splunk. Advances workspace state from validated to deployed.

Design-first companion skill for Splunk Dashboard Studio — visual taste, hierarchy, restraint, typography, colour discipline, and the thousand small decisions that separate a dashboard your CISO screenshots for the board from one that gets closed after 4 seconds. Use whenever the user wants a Splunk dashboard to actually look crafted, not AI-generic. Triggers on any request involving "make this dashboard beautiful", "clean up this dashboard", "design a dashboard for [executive/SOC/NOC/analyst/business]", "why does my dashboard look like AI made it", "redesign", or "polish". Starts with a required Design Context Protocol (audience, tone, anti-reference, brand) — will refuse to design in the dark. Pairs with (does NOT replace) ds-ref-syntax (JSON schema), ds-ref-design-principles (archetypes + slop test), and the per-viz ds-viz-* skills (option fields). This skill tells those skills what to build and why.

Standalone Splunk Dashboard Studio design reference — covers the four canonical archetypes (executive summary, operational monitoring, analytical deep-dive, SOC overview), reflex defaults to refuse, absolute bans (status colour misuse, red/green only, pie >6, unbounded searches, defaultless inputs), KPI sizing, the chart-selection decision table for all 27 viz types, semantic colour conventions, typography, and the Splunk Dashboard Slop Test. Use when the user asks open-ended design questions ("what should my dashboard look like?", "which chart for X?"), or for the Slop Test before shipping. Companion files cover the full palette and chart-selection matrix.

Drilldowns are click handlers that fire when a user clicks a row, point, or marker in a panel. They power setToken (capture click context into a named token), linkToSearch (open Splunk search prefilled), linkToDashboard (navigate to another dashboard with form tokens), and customUrl (open an arbitrary external URL with URL-encoded values). Read when adding click-to-investigate behaviour, when wiring multi-panel drill flows, or when a click on a chart isn't triggering anything. Triggers on 'drilldown', 'click handler', 'eventHandlers', 'setToken', 'linkToSearch', 'linkToDashboard', 'customUrl', 'when I click a row'.

Inputs are the user-facing widgets — time pickers, dropdowns, multiselects, text fields, checkboxes — that write tokens consumed by every search and option on the dashboard. Read when adding a filter to a dashboard, when wiring a global time picker, when building a dynamic dropdown driven by SPL, or when a layout is missing a search filter widget. Triggers on 'input', 'time picker', 'dropdown', 'multiselect', 'global filter', 'how do I let users pick a value', 'dynamic dropdown'.

Tokens are how Dashboard Studio passes user-facing values into searches and visualization options. Read when wiring inputs to data sources, when a panel is not updating, or when adding token filters (|h, |u, |s). Covers $token$ syntax, $token.subfield$ for timerange tokens, $row.<field>.value$ inside drilldowns, $click.value$, token filters, and the most common 'tokens don't resolve' debugging steps. Triggers on 'tokens', 'token filter', '$tok$', 'inputs not affecting search', 'why is my panel not updating'.

Visibility rules toggle individual panels on or off based on the current value of dashboard tokens. Read when adding progressive disclosure (panel only appears after a row click), when building wizard-style flows, or when hiding "no data selected" placeholders. Triggers on 'visibility', 'show hide panel', 'conditional panel', 'progressive disclosure', 'panel only when token is set', 'showConditions', 'hideWhenNoData'.

Use this skill to generate a full Splunk Dashboard Studio JSON definition (dashboard.json) from a workspace's layout.json and data-sources.json. Reads Panel positions, visualization types, and SPL queries; produces the complete dataSources + visualizations + layout.structure. Advances workspace state from designed to built. Requires a workspace at designed stage produced by ds-design.

Use this skill to run the Splunk Dashboard Slop Test against an existing dashboard.json or dashboard.xml and write critique.md with a blunt verdict (PASS / MIXED / SLOP) and a per-criterion scorecard. Narrower and more opinionated than ds-review — it only checks the design-principles Slop Test, reflex defaults, and absolute bans. Use when the user asks "is this dashboard AI slop?", "does this pass the Slop Test?", or wants a design-principles-only audit before ds-polish.