Splunk Monitoring Skill

Query, analyze, and manage Splunk resources using the Splunk REST API.

MANDATORY: Read Before Any Splunk Operation

You MUST follow this skill before executing any Splunk API calls. It contains mandatory anti-hallucination rules, parallel execution patterns, and API conventions that prevent common errors.

API Conventions

Authentication

All Splunk API calls use Bearer token or Basic auth — injected automatically by the connection. Never hardcode credentials.

Base URL

• Default: https://<host>:8089
• Use the connection-injected SPLUNK_BASE_URL. Always verify with the connection config.