Splunk Search

Use Splunk Search when a user needs current, read-only evidence from Splunk. Run supported live searches with splunkctl, reduce results on the Splunk server, and return only the counts, states, or small excerpts needed to answer the request.

Prerequisites

Live execution requires the separately installed splunkctl CLI. Check it with command -v splunkctl before the first live call.

If splunkctl is unavailable, stop the live execution path with a clear dependency message. Do not substitute the retired bundled splsearch helper, direct REST, or an invented result. SPL authoring, explanation, and review may continue when they do not require live evidence. Offer that non-live help in the same answer when it can still advance the user's request, and label any query or conclusion explicitly as unexecuted with no live evidence collected.