Research, map, render, doctor, validate, and safely delegate complete Cisco Data Fabric adoption plans across Splunk data management, Edge Processor, Ingest Processor, SPL2, Federated Search, Machine Data Lake, Data Catalog, Splunk indexes and external stores, AI Toolkit and hosted models, Agent Builder, MCP Server, AI Canvas, context, governance, and cross-domain consumers. Use when users need Cisco Data Fabric architecture, feature or product coverage, readiness assessments, gap analysis, machine-data activation, federation targets, storage tiering, AI-ready data, or AgenticOps data foundation requests. Distinguish this architecture from a single product, package, entitlement, or direct API.
Render, validate, doctor, and optionally execute delegated setup plans for Cisco Cloud Control adoption, AI Canvas readiness, Cloud Control Studio handoffs, official Cloud Control feature coverage, Cisco Workflows API readiness, delegated Cisco Data Fabric architecture coverage, MCP connectors, Splunk AI Agent Monitoring, Observability content, and Cisco domain readiness. Use when the user asks to prepare Cisco Cloud Control, AgenticOps, AI Canvas, Cloud Control Studio, Cloud Control Workflows, or governed Cisco/Splunk agent execution workflows.
Resolve a Cisco product name from the SCAN catalog and route installation, configuration, and validation through the correct existing setup skill. Use when the user asks to set up Splunk for a Cisco product such as ACI, Nexus 9000, Duo, Meraki, ThousandEyes, ASA, or FTD, including choosing the dedicated ASA syslog TA versus Cisco Security Cloud API or eStreamer collection.
Install, render, validate, and audit Cisco Data Fabric AI Toolkit and Splunk-owned AI and machine-learning workflows beyond Splunk AI Assistant: Splunk AI Toolkit / MLTK (`Splunk_ML_Toolkit`), Python for Scientific Computing (PSC), Splunk App for Data Science and Deep Learning (DSDL), MLTK anomaly workflows, LLM/`ai` command readiness, external model runtimes, and legacy anomaly app migration. Use when the user asks about MLTK, Splunk AI Toolkit, Machine Learning Toolkit, PSC, Python for Scientific Computing, DSDL, Deep Learning Toolkit, Splunk anomaly detection assistants, AI Toolkit Agent Builder, the `aiagent` command, Cisco Time Series Model, Cisco Deep Time Series Model, Smart Alerts Assistant, or AI/ML product coverage outside Splunk AI Assistant, including Cisco Data Fabric requests about AI Toolkit or machine-data model workflows.
Use when configuring Cisco Data Fabric federated search or standalone Splunk Federated Search, cross-domain search, federated analytics, S3 data-lake search, or querying data where it resides. Render, preflight, apply, and validate FSS2S standard/transparent providers and reviewed legacy FSS3 payloads; render 10.5 migration guidance and current Data Management handoffs for S3, Azure, Databricks, Snowflake, and DDSS; distinguish Glue, Iceberg REST, and Splunk-native catalogs; preserve handoff-only Amazon Security Lake (`aws_lake`) and Cisco SAL (`aws_s3_sal`) identities; and manage supported global-switch, status, file, SHC, and REST workflows.
Render Cisco Data Fabric ingest-time routing workflows and Splunk Cloud Platform Ingest Processor setup plans with SPL2 pipelines, source types, destinations, lifecycle handoffs, queue and monitoring searches, metrics, OCSF, decrypt, S3 archive, custom pipeline templates, AI-powered data management readiness, Automated Field Extraction, Guided Onboarding with Auto-Schematization, and downstream readiness checks. Use when the user asks to configure Ingest Processor, author Ingest Processor pipelines, route or transform data at ingest time, validate Ingest Processor readiness, or compare Ingest Processor with Edge Processor and Data Manager, including Cisco Data Fabric or telemetry pipeline management requests that involve Splunk Cloud ingest-time routing and transformation.
Resolve Splunk security products and associated security offerings to the correct local setup skill, install-only path, ES bundled workflow, or manual handoff. Use when a user asks for total Splunk security portfolio coverage, product gap analysis, or which Splunk security skill handles ES, ES 8.x native SOAR, Security AI Assistant / AI Assistant in Security, Federated Analytics, SOAR, Security Essentials, UBA, Attack Analyzer, ARI, Mission Control, PCI, InfoSec, CIM, or related security apps.
Render, preflight, and validate Splunk Platform Dashboard Studio dashboards: the version=2 JSON dashboard definition, the data/ui/views source XML wrapper, panels for table/single-value/line/area/column/bar/pie/markdown visualizations, data source searches, layout (grid or absolute), and a REST apply helper. Use when the user asks to build or convert a Splunk Platform Dashboard Studio dashboard, author a version 2 dashboard definition, create dashboards as code for Splunk Enterprise or Splunk Cloud, generate dashboard JSON/XML from SPL panels, or apply a dashboard via the data/ui/views REST endpoint. This is Splunk Platform Dashboard Studio, NOT the Splunk Observability Cloud dashboard builder.