splunk-cisco-skills

Research, map, render, doctor, validate, and safely delegate complete Cisco Data Fabric adoption plans across Splunk data management, Edge Processor, Ingest Processor, SPL2, Federated Search, Machine Data Lake, Data Catalog, Splunk indexes and external stores, AI Toolkit and hosted models, Agent Builder, MCP Server, AI Canvas, context, governance, and cross-domain consumers. Use when users need Cisco Data Fabric architecture, feature or product coverage, readiness assessments, gap analysis, machine-data activation, federation targets, storage tiering, AI-ready data, or AgenticOps data foundation requests. Distinguish this architecture from a single product, package, entitlement, or direct API.

Render, validate, doctor, and optionally execute delegated setup plans for Cisco Cloud Control adoption, AI Canvas readiness, Cloud Control Studio handoffs, official Cloud Control feature coverage, Cisco Workflows API readiness, delegated Cisco Data Fabric architecture coverage, MCP connectors, Splunk AI Agent Monitoring, Observability content, and Cisco domain readiness. Use when the user asks to prepare Cisco Cloud Control, AgenticOps, AI Canvas, Cloud Control Studio, Cloud Control Workflows, or governed Cisco/Splunk agent execution workflows.

Resolve a Cisco product name from the SCAN catalog and route installation, configuration, and validation through the correct existing setup skill. Use when the user asks to set up Splunk for a Cisco product such as ACI, Nexus 9000, Duo, Meraki, ThousandEyes, ASA, or FTD, including choosing the dedicated ASA syslog TA versus Cisco Security Cloud API or eStreamer collection.

Install, render, validate, and audit Cisco Data Fabric AI Toolkit and Splunk-owned AI and machine-learning workflows beyond Splunk AI Assistant: Splunk AI Toolkit / MLTK (`Splunk_ML_Toolkit`), Python for Scientific Computing (PSC), Splunk App for Data Science and Deep Learning (DSDL), MLTK anomaly workflows, LLM/`ai` command readiness, external model runtimes, and legacy anomaly app migration. Use when the user asks about MLTK, Splunk AI Toolkit, Machine Learning Toolkit, PSC, Python for Scientific Computing, DSDL, Deep Learning Toolkit, Splunk anomaly detection assistants, AI Toolkit Agent Builder, the `aiagent` command, Cisco Time Series Model, Cisco Deep Time Series Model, Smart Alerts Assistant, or AI/ML product coverage outside Splunk AI Assistant, including Cisco Data Fabric requests about AI Toolkit or machine-data model workflows.

Use when configuring Cisco Data Fabric federated search or standalone Splunk Federated Search, cross-domain search, federated analytics, S3 data-lake search, or querying data where it resides. Render, preflight, apply, and validate FSS2S standard/transparent providers and reviewed legacy FSS3 payloads; render 10.5 migration guidance and current Data Management handoffs for S3, Azure, Databricks, Snowflake, and DDSS; distinguish Glue, Iceberg REST, and Splunk-native catalogs; preserve handoff-only Amazon Security Lake (`aws_lake`) and Cisco SAL (`aws_s3_sal`) identities; and manage supported global-switch, status, file, SHC, and REST workflows.

Render Cisco Data Fabric ingest-time routing workflows and Splunk Cloud Platform Ingest Processor setup plans with SPL2 pipelines, source types, destinations, lifecycle handoffs, queue and monitoring searches, metrics, OCSF, decrypt, S3 archive, custom pipeline templates, AI-powered data management readiness, Automated Field Extraction, Guided Onboarding with Auto-Schematization, and downstream readiness checks. Use when the user asks to configure Ingest Processor, author Ingest Processor pipelines, route or transform data at ingest time, validate Ingest Processor readiness, or compare Ingest Processor with Edge Processor and Data Manager, including Cisco Data Fabric or telemetry pipeline management requests that involve Splunk Cloud ingest-time routing and transformation.

Resolve Splunk security products and associated security offerings to the correct local setup skill, install-only path, ES bundled workflow, or manual handoff. Use when a user asks for total Splunk security portfolio coverage, product gap analysis, or which Splunk security skill handles ES, ES 8.x native SOAR, Security AI Assistant / AI Assistant in Security, Federated Analytics, SOAR, Security Essentials, UBA, Attack Analyzer, ARI, Mission Control, PCI, InfoSec, CIM, or related security apps.

Render, preflight, and validate Splunk Platform Dashboard Studio dashboards: the version=2 JSON dashboard definition, the data/ui/views source XML wrapper, panels for table/single-value/line/area/column/bar/pie/markdown visualizations, data source searches, layout (grid or absolute), and a REST apply helper. Use when the user asks to build or convert a Splunk Platform Dashboard Studio dashboard, author a version 2 dashboard definition, create dashboards as code for Splunk Enterprise or Splunk Cloud, generate dashboard JSON/XML from SPL panels, or apply a dashboard via the data/ui/views REST endpoint. This is Splunk Platform Dashboard Studio, NOT the Splunk Observability Cloud dashboard builder.

Render and validate a Splunk Add-on for Cisco ASA onboarding plan for Splunk_TA_cisco-asa, Cisco ASA or FTD syslog, cisco:asa source typing, SC4S or customer syslog receiver ownership, CIM Network_Traffic and Intrusion_Detection readiness, and ES/firewall dashboard evidence. Use when the user asks to onboard, configure, route, or validate Cisco ASA or FTD data in Splunk.

Install and validate the Cisco Catalyst Enhanced Netflow Add-on for Splunk (splunk_app_stream_ipfix_cisco_hsl). Use when the user asks about the optional Enhanced Netflow add-on, Cisco HSL/IPFIX mappings, app ID 6872, or extra Cisco Enterprise Networking NetFlow dashboards.

Install and operate Cisco Isovalent on Kubernetes: Cilium, Tetragon, Enterprise add-ons, and gated private Isovalent product packs. Renders OSS or Enterprise Helm assets, distribution and CNI-conflict preflights, feature coverage, apply plans, doctor reports, live validation, and day-2 discover/backup/upgrade/rollback/uninstall runbooks. NOT a Splunk TA skill; Splunk telemetry wiring is delegated to splunk-observability-isovalent-integration. Use when installing or validating Cilium, Tetragon, Hubble, or Isovalent platform workflows on Kubernetes.

Render, capture, validate, and safely operate Cisco Meraki Active Application Monitoring with ThousandEyes. Use when the user asks to link Meraki Dashboard to ThousandEyes, deploy ThousandEyes Enterprise Agents on supported Meraki MX networks, claim or use Meraki AAM free tests, create ThousandEyes tests from Meraki Insight / Active Application Monitoring, monitor an application from agents inside Meraki networks, inspect or summarize Meraki Dashboard HAR/POST requests for the AAM wizard, or validate the resulting ThousandEyes agents, tests, and results.

Install and configure the Cisco Secure Access App for Splunk (cisco-cloud-security) and required event Add-on (TA-cisco-cloud-security-addon). Supports org account creation, investigate index, private app index, and app discovery index provisioning. Use when the user asks about Cisco Secure Access, app IDs 5558/7569, cisco-cloud-security, or Secure Access dashboards.

Render and (optionally) apply Model Context Protocol client configurations for the official ThousandEyes MCP Server (https://api.thousandeyes.com/mcp, GA per docs.thousandeyes.com/.../thousandeyes-mcp-server). Supports Cursor, Claude Code, Codex, VS Code, and AWS Kiro clients with both OAuth Bearer and OAuth2 flows. Surfaces TE rate limits, the unit-consumption warning for Instant Tests, and gates the write/Instant-Test tool group behind an explicit acknowledgement. Use when the user asks to register the ThousandEyes MCP, set up TE in Cursor/Claude/Codex/VS Code/Kiro, configure the Cisco ThousandEyes Cursor plugin, or pair an AI assistant with TE.

Automate Cisco ThousandEyes App for Splunk (ta_cisco_thousandeyes) setup and configuration. Handles OAuth 2.0 device code authentication, HEC token management, index creation, streaming and polling data inputs, and optional ITSI integration. Use when the user asks about ThousandEyes, network monitoring, path visualization, CEA tests, endpoint tests, or ta_cisco_thousandeyes.

Render, validate, and optionally apply Agent Control setup assets covering Docker or external server readiness, file-backed auth templates, policy controls, Python @control() snippets, TypeScript runtime snippets, OpenTelemetry and custom Splunk HEC event sinks, Splunk HEC and OTel Collector handoffs, and Splunk Observability dashboards/detectors. Use when the user asks to govern runtime agent behavior with Agent Control and wire control events to Splunk Platform or Splunk Observability Cloud.

Render, validate, and optionally apply Galileo platform readiness, object lifecycle, Observe export/runtime, Evaluate, Luna, Controls, multimodal, and Splunk wiring for Galileo SaaS or Enterprise deployments. Covers projects, log streams, datasets, prompts, experiments, metrics, annotations, feedback, RBAC, provider handoffs, trace maintenance/metrics APIs, Luna Studio training, metadata-only media export, HEC/OTLP/OTel handoffs, dashboards, and detectors. Use when configuring Galileo-to-Splunk Platform or Splunk Observability Cloud setup, including multimodal traces and multi-model experiment comparison evidence.

Diagnose Splunk Cloud Platform and Splunk Enterprise administration health, render full-coverage doctor reports, and create selected safe fix packets. Use when the user asks for a Splunk admin doctor, health audit, full feature coverage check, production-safe remediation plan, Cloud/Enterprise admin troubleshooting, or routing to existing Splunk admin skills.

Render and validate Amazon Kinesis Firehose to Splunk HEC onboarding for CloudTrail, VPC Flow Logs, CloudWatch events, and raw or JSON data, including HEC token/index handoffs, delivery stream settings, buffering, retry, S3 backup, IAM policy stubs, CloudWatch delivery metrics, ACK guidance, and strict source/sourcetype readiness evidence. Use when the user asks to send AWS Firehose data to Splunk.

Install, update, and manage Splunk apps and add-ons (TAs). Supports installing locally from .tgz/.spl files, remotely from a URL, or from Splunkbase. Can also list installed apps and uninstall apps. Use when the user asks to install a Splunk app, TA, add-on, download from Splunkbase, deploy an app package, or manage installed apps.

Render, validate, and gate Splunk AppDynamics Smart Agent and Agent Management workflows, including prerequisites, platform and permission checks, Smart Agent config, local and remote install, upgrade, uninstall, synchronization, deployment groups, auto-attach, auto-discovery, UI paths, smartagentctl lifecycle commands, deprecated Smart Agent CLI guidance, and supported managed agent types for Apache, .NET MSI, Database, Java, Machine, Node.js, PHP, and Python agents, plus software downloads, checksum validation, digital signatures, and release posture. Use when the user asks for AppDynamics Smart Agent, Agent Management, remote agent installation, deployment groups, managed agent upgrade, rollback, auto-attach, auto-discovery, managed Apache, .NET, Database, Java, Machine, Node.js, PHP, or Python agents, package download automation, checksum validation, signature validation, or release compatibility.

Render and validate Splunk AppDynamics alerting content, including health rules, schedules, policies, actions, email digests, action suppression, anomaly detection, automated root cause analysis, import, export, rollback, AIML dynamic baselines, automated transaction diagnostics, and post-apply readback validation. Use when the user asks for AppDynamics health rules, alert policies, actions, schedules, email digests, action suppression, anomaly detection, automated RCA, dynamic baseline behavior, automated transaction diagnostics, alerting content import/export, rollback, or alert validation.

Render, validate, and gate Splunk AppDynamics Analytics workflows for Transaction Analytics, Log Analytics, Browser Analytics, Mobile Analytics, Synthetic Analytics, IoT Analytics, Connected Devices Analytics, Business Journeys, Experience Level Management (XLM), ADQL, Analytics Events API schemas, event publishing, and query validation. Use when the user asks for AppDynamics Analytics, ADQL, Analytics Events API, custom event publishing, analytics schemas, transaction analytics, log analytics, browser or mobile analytics, synthetic analytics, IoT analytics, connected device analytics, Business Journeys, XLM, SLA, or experience-level reporting.

Render and validate Splunk AppDynamics APM workflows for business applications, tiers, nodes, business transactions, service endpoints, remote services, information points, snapshots, metrics, serverless APM, Development Level Monitoring, Splunk AppDynamics for OpenTelemetry, OTel collector/access-key validation, and app-server agent snippets. Use when the user asks for AppDynamics APM, business applications, tiers, nodes, business transactions, snapshots, service endpoints, remote services, information points, metrics, AWS Lambda/serverless APM, development monitoring, OpenTelemetry ingestion, OTel collector setup, or application server agent instrumentation snippets.

Render and validate Splunk AppDynamics Controller administration workflows, including SaaS and on-prem account checks, API clients, OAuth token-file flow, users, groups, roles, SAML, LDAP, account permissions, licensing, license rules, sensitive data collection controls, privacy settings, audit readiness, and data collection dashboards. Use when the user asks for AppDynamics Controller administration, API clients, OAuth, RBAC, SAML, LDAP, user/group/role management, account permissions, licensing, license rules, sensitive data controls, SQL/log masking, environment variable filtering, or privacy validation.

Render and validate Splunk AppDynamics dashboard and report workflows, including custom dashboards, Dash Studio handoffs, reports, scheduled reports, War Rooms, ThousandEyes dashboard handoff, dashboard inventory, report delivery checks, and validation runbooks. Use when the user asks for AppDynamics dashboards, custom dashboard migration, Dash Studio handoffs, reports, scheduled reports, report delivery, War Rooms, or dashboard and report validation.

Render and validate Splunk AppDynamics Database Visibility workflows, including Database Agent readiness, Database Visibility API collector CRUD, file-backed database secrets, DB server, node, metric, and event validation. Use when the user asks for AppDynamics Database Visibility, Database Agent, database collector creation or updates, Database Visibility API payloads, DB credential redaction, DB server validation, DB node validation, or database event checks.

Render, validate, preflight, apply, and rollback production Java Dual Signal AppDynamics agent configuration. Use when the user asks for AppDynamics Java dual-agent, Java Dual Signal mode, AGENT_DEPLOYMENT_MODE=dual, -Dagent.deployment.mode=dual, Java OTLP export to a local collector, or coordinated collector-first then Java restart rollout on local or SSH hosts.

Render and validate Splunk AppDynamics End User Monitoring workflows, including Browser RUM, Mobile RUM, IoT RUM, EUM account and application keys, JavaScript injection, iOS, Android, React Native, Flutter, .NET MAUI snippets, Browser Session Replay, Mobile Session Replay, mapping, source-map upload, and beacon validation. Use when the user asks for AppDynamics EUM, Browser RUM, BRUM, Mobile RUM, IoT RUM, app keys, JavaScript injection, Session Replay, Mobile Session Replay, source maps, mobile SDKs, or EUM beacon validation.

Render and validate Splunk AppDynamics Infrastructure Visibility workflows, including Machine Agent, Server Visibility, Network Visibility, Docker and container visibility, service availability, server tags, GPU Monitoring, Prometheus extension coverage, and infrastructure health rules. Use when the user asks for AppDynamics Machine Agent, Server Visibility, Network Visibility, Docker or container visibility, service availability, server tags, host metrics, or infrastructure health rules, NVIDIA GPU monitoring, DCGM, NVIDIA-SMI, or Prometheus exporter monitoring through Machine Agent.

Render, validate, and gate Splunk AppDynamics Kubernetes Cluster Agent, Kubernetes auto-instrumentation, and Splunk OpenTelemetry Collector setup through the Cluster Agent, including dual-signal combined-agent plans for Java, .NET Core Linux, Node.js, Machine Agent handoff, and Splunk Observability Cloud export validation. Use when the user asks for AppDynamics Cluster Agent, Kubernetes monitoring, AppDynamics Kubernetes auto-instrumentation, Splunk OTel Collector through Cluster Agent, O11y export, or workload rollout validation.

Render, validate, and delegate Splunk Log Observer Connect for Splunk AppDynamics workflows, including new LOC setup, old Splunk integration detection and disablement, Splunk Cloud or Enterprise service-account handoffs, allow-list checks, and deep-link validation. Use when the user asks for AppDynamics Log Observer Connect, AppDynamics logs in Splunk Platform, legacy Splunk integration disablement, service-account handoffs, or AppD to Splunk log deep links.

Render, validate, preflight, apply, and rollback the bundled OpenTelemetry Collector that runs with AppDynamics Machine Agent combined mode. Use when the user asks for Machine Agent bundled OTel Collector, combined agent for infrastructure visibility, AppDynamics collector YAML, local OTLP 4317/4318 listeners, or Splunk Observability plus AppDynamics OTel export from Linux, Docker, or Windows Machine Agent installs.

Render, validate, and gate Splunk AppDynamics On-Premises and Virtual Appliance platform workflows, including Enterprise Console, Controller, Events Service, EUM Server, Synthetic Server, planning, platform quickstart, release notes, compatibility, HA, backup, restore, upgrades, and secure platform hardening. Use when the user asks for AppDynamics On-Premises, Virtual Appliance, Enterprise Console, Controller host setup, Events Service, EUM Server, Synthetic Server, HA, upgrade, or secure platform runbooks.

Render, validate, and hand off Splunk AppDynamics SAP Agent workflows, including SAP Agent, ABAP Agent, HTTP SDK, SNP CrystalBridge Monitoring, BiQ Collector, local and gateway HTTP SDK deployment, SAP NetWeaver transports, SAP authorization checks, Controller node registration, SAP Agent release notes, and SAP metric validation. Use when the user asks for AppDynamics SAP Agent, ABAP Agent, HTTP SDK, SNP CrystalBridge Monitoring, BiQ Collector, SAP NetWeaver transports, SAP authorization runbooks, local or gateway HTTP SDK deployment, or SAP release or metric validation.

Render, validate, and delegate Splunk AppDynamics security and AI workflows, including Application Security Monitoring, Secure Application, Secure Application runtime policies, Secure Application `policyConfigs`, Secure Application APIs, Secure Application for OpenTelemetry Java, Observability for AI, OpenAI, LangChain, Bedrock, GPU readiness, and Cisco AI Pod handoffs. Use when the user asks for AppDynamics Secure Application, application security monitoring, Secure Application policies, Secure Application APIs, Secure Application `policyConfigs`, Secure Application for OTel Java, Observability for AI, OpenAI or LangChain monitoring, Bedrock checks, GPU telemetry, or Cisco AI Pod AppDynamics handoffs.

Coverage-first parent router for the Splunk AppDynamics skill suite. Resolves AppDynamics SaaS, On-Premises, Virtual Appliance, SAP Agent, APM, agents, Smart Agent, Cluster Agent, Infrastructure Visibility, Database Visibility, Analytics, EUM, Synthetic Monitoring, Log Observer Connect, Controller/admin, alerting, dashboards/reports, ThousandEyes integration, tags, extensions, Sensitive Data Collection and Security, release notes and references, product announcements, AIML, GPU Monitoring, Splunk AppDynamics for OpenTelemetry, Secure Application, Observability for AI, and Splunk Platform integration requests to the owning child skill, then emits a machine-readable coverage report from the checked-in taxonomy. Use when the user asks for AppDynamics setup, AppDynamics coverage, AppDynamics product routing, or a full AppDynamics doctor/gap report.

Render and validate Splunk AppDynamics Synthetic Monitoring workflows, including Browser Synthetic jobs, Synthetic API Monitoring, hosted locations, Private Synthetic Agents, Docker, Kubernetes, Minikube PSA assets, Shepherd URLs, screenshots, waterfalls, and run validation. Use when the user asks for AppDynamics Synthetic Monitoring, browser synthetic jobs, Synthetic API Monitoring, hosted synthetic locations, Private Synthetic Agent, PSA, Shepherd URL validation, synthetic waterfalls, or synthetic run checks.

Render and validate Splunk AppDynamics tags, extensions, and integration-module workflows, including Custom Tag APIs, tag enablement, Machine Agent custom metrics, Integration Modules, extensions, ServiceNow, Jira, Scalyr, Agent Command Center, and Log Auto-Discovery runbooks. Use when the user asks for AppDynamics custom tags, tag APIs, extensions, Machine Agent custom metrics, Integration Modules, ServiceNow, Jira, Scalyr, Agent Command Center, or Log Auto-Discovery.

Render, validate, and safely gate the AppDynamics-ThousandEyes integration across AppDynamics SaaS, On-Premises, and Virtual Appliance. Use when Codex needs to configure AppDynamics ThousandEyes token readiness, Dash Studio ThousandEyes widgets, Browser/Mobile RUM ThousandEyes network metrics, ThousandEyes native AppDynamics integration runbooks for test recommendations and alert notifications, ThousandEyes API-backed tests/labels/tags/alert rules/dashboards/templates, or a custom webhook fallback that posts ThousandEyes alerts into AppDynamics custom events.