Splunk Search

Use Splunk Search when a user needs read-only Splunk evidence but the result set may be too large for the agent context. The splsearch CLI writes search results to a local SQLite table and returns compact JSON with the table name. Treat the saved table as the artifact, then bring only focused summaries, small samples, or exact evidence back into the conversation.

Prerequisites

The splsearch CLI is installed and available on PATH, or the runtime provides an equivalent splsearch binary for this skill. In this repository, the packaged Go source for that CLI lives in tools/splsearch. From the repository root, build the tool artifact with make -C tools/splsearch build, then put tools/splsearch/bin on PATH before using the skill locally.