Splunk Identity and SAML Readiness Advisor

Answer identity and access questions by researching current public Splunk sources during the run. This skill supplies the investigation method, not product truth: Splunk documentation and software can change faster than this file. Use optional stack reads only to test a documented expectation, and never change the stack or identity provider.

Prerequisites

Start with whatever the user supplied. Identify, when available:

• Splunk Cloud Platform or Splunk Enterprise, including the release or service version shown by the deployment
• SAML, LDAP, or local authentication; the identity-provider family; and whether the question is readiness, login, mapping, or authorization
• who is affected, the first-seen time, the last known-good state, and recent identity-side or Splunk-side changes
• the exact symptom and sanitized error text, rather than a presumed cause