Loading repository data…
Loading repository data…
grandcamel / repository
A modular, production-ready Claude Code skills framework for Splunk REST API automation
A transparent discovery signal based on current public GitHub metadata.
This score does not audit code, security, maintainers, documentation quality, or suitability. Verify the repository and its current documentation before adoption.
> "Show me error patterns in the main index from the last hour"
Claude: Running SPL query...
index=main error earliest=-1h | stats count by host, sourcetype | sort -count
Found 847 errors across 12 hosts. Top sources:
web-prod-01 nginx:error 423
api-srv-03 application 298
db-master postgresql 126
index=main sourcetype=access_combined
| eval response_time=response_time/1000
| where response_time > 2
| stats avg(response_time) as avg_rt,
max(response_time) as max_rt,
count by host
| sort -count
| head 10
Hope you remembered the syntax...
"Show me slow API responses over 2 seconds,
grouped by host, top 10"
Just ask.
| Task | Traditional Splunk | Splunk Assistant | Saved |
|---|---|---|---|
| Write complex SPL query | 5-15 min | 30 sec | 90% |
| Check job status & results | 2-3 min | 10 sec | 95% |
| Export large dataset | 5-10 min | 1 min | 85% |
| Create saved search | 3-5 min | 30 sec | 90% |
| Debug search errors | 5-20 min | 1 min | 80% |
Typical user: Save 3-5 hours per week.
# Install from GitHub
claude plugin add github:grandcamel/Splunk-Assistant-Skills
git clone https://github.com/grandcamel/Splunk-Assistant-Skills.git
cd Splunk-Assistant-Skills
pip install -r requirements.txt
# Set environment variables
export SPLUNK_TOKEN="your-jwt-token"
export SPLUNK_SITE_URL="https://splunk.example.com"
# Or create .claude/settings.local.json for profiles
# Install the splunk-as CLI
pip install splunk-as
# Verify installation
splunk-as --version
# CLI usage (recommended)
splunk-as search oneshot "index=main | stats count by sourcetype" --earliest -1h
# Or with Claude Code
> "Search for errors in the main index from the last hour"
That's it. Claude now has full Splunk access.
If you installed via the plugin system, run the setup wizard:
/assistant-skills-setup
This configures:
~/.assistant-skills-venv/requirements.txtclaude-as shell function for running Claude with dependenciesAfter setup, use claude-as instead of claude:
claude-as # Runs Claude with Assistant Skills venv activated
| Variable | Required | Description |
|---|---|---|
SPLUNK_SITE_URL | Yes | Splunk server URL (e.g., https://splunk.example.com) |
SPLUNK_TOKEN | Auth* | Bearer token (preferred). Create in Splunk Web: Settings > Tokens |
SPLUNK_USERNAME | Auth* | Basic auth username (alternative to token) |
SPLUNK_PASSWORD | Auth* | Basic auth password (use with SPLUNK_USERNAME) |
SPLUNK_MANAGEMENT_PORT | No | Management API port (default: 8089) |
SPLUNK_VERIFY_SSL | No | Verify SSL certificates (default: true) |
SPLUNK_DEFAULT_APP | No | Default Splunk app context (default: search) |
SPLUNK_DEFAULT_INDEX | No | Default search index (default: main) |
*Authentication: Either SPLUNK_TOKEN OR both SPLUNK_USERNAME and SPLUNK_PASSWORD required.
flowchart LR
subgraph Input["You Say"]
A["Search for errors"]
B["Export yesterday's logs"]
C["Show my saved searches"]
D["Create an alert"]
end
subgraph Processing["Claude Understands"]
E["splunk-search"]
F["splunk-export"]
G["splunk-savedsearch"]
H["splunk-alert"]
end
subgraph Output["You Get"]
I["Formatted results"]
J["CSV/JSON file"]
K["Search list"]
L["Alert configured"]
end
A --> E --> I
B --> F --> J
C --> G --> K
D --> H --> L
Before Splunk Assistant (45 minutes)
index=security action=failure | stats count by user, src_ip | sort -countAfter Splunk Assistant (5 minutes)
Analyst: "Show me failed logins in the last 24 hours, group by user and source IP, compare to yesterday's baseline, and flag any anomalies"
Claude provides a formatted summary with highlighted anomalies.
Time saved: 40 minutes every morning
| Skill | Purpose | Example Command |
|---|---|---|
splunk-assistant | Hub router with progressive disclosure | "Help me search Splunk" |
splunk-search | SPL query execution (oneshot/normal/blocking) | "Search for 404 errors in nginx logs" |
splunk-job | Search job lifecycle management | "Check status of job abc123" |
splunk-export | High-volume streaming extraction | "Export last week's firewall logs to CSV" |
splunk-metadata | Index, source, sourcetype discovery | "List all available indexes" |
splunk-lookup | CSV and lookup file management | "Upload users.csv as a lookup" |
splunk-tag | Knowledge object tagging | "Tag host web-01 as production" |
splunk-savedsearch | Reports and scheduled searches | "Show my saved searches" |
splunk-alert | Alert triggering and monitoring | "Create alert for high error rate" |
splunk-rest-admin | REST API configuration access | "Get server info" |
splunk-security | Token management and RBAC | "List authentication tokens" |
splunk-metrics | Real-time metrics (mstats, mcatalog) | "Show CPU metrics by host" |
splunk-app | Application management | "List installed apps" |
splunk-kvstore | App Key Value Store operations | "Query the threat intel collection" |
Stop context-switching to Splunk Web.
You're debugging in your IDE. You need to check logs. Stay in your terminal.
claude "Show me errors from my-app in the last hour"
# Done in 3 seconds, never left your terminal
| Task | Command |
|---|---|
| Search logs | "Search for errors in app-name last hour" |
| Check deployments | "Find deployment events today" |
| Debug issues | "Show stack traces from main index" |
| Export for analysis | "Export last 1000 errors to JSON" |
Time saved: ~45 min/week
Accelerate threat hunting and incident response.
"Find all failed SSH attempts in the last 24 hours"
"Show authentication events for user john.doe"
"Search for privilege escalation patterns"
| Task | Command |
|---|---|
| Failed logins | "Show failed logins by user and IP" |
| Suspicious activity | "Find unusual outbound connections" |
| Threat hunting | "Search for indicators: 192.168.1.100, malware.exe" |
| Incident timeline | "Build timeline for host web-01 last 4 hours" |
Time saved: Minutes per investigation
Real-time visibility without the query complexity.
"Show critical alerts from last 24 hours"
"Check system health across all hosts"
"Find hosts with high CPU usage"
| Task | Command |
|---|---|
| Alert review | "Show triggered alerts today" |
| Performance | "CPU and memory stats by host" |
| Capacity | "Disk usage trends this week" |
| Incidents | "Errors across production hosts" |
Time saved: Hours per week on routine checks
Extract data at scale with simple commands.
"Export last week's firewall logs to CSV"
"Stream authentication events to JSON file"
"Download metrics data for analysis"
| Task | Command |
|---|---|
| Bulk export | "Export index=main last 7 days to CSV" |
| Filtered extract | "Export errors from web tier to JSON" |
| Metrics dump | "Download CPU metrics for all hosts" |
| Schema discovery | "Show all fields in sourcetype=nginx" |
Time saved: Hours per data pipeline
flowchart TD
U["User Request"] --> CC["Claude Code"]
CC --> HA["splunk-assistant<br/>Meta-Router"]
HA --> |"Search queries"| SS["splunk-search"]
HA --> |"Job management"| SJ["splunk-job"]
HA --> |"Data export"| SE["splunk-export"]
HA --> |"Discovery"| SM["splunk-metadata"]
HA --> |"Lookups"| SL["splunk-lookup"]
HA --> |"Saved searches"| SSS["splunk-savedsearch"]
HA --> |"Alerts"| SA["splunk-alert"]
HA --> |"Security"| SEC["splunk-security"]
HA --> |"Metrics"| MET["splunk-metrics"]
HA --> |"Apps"| APP["splunk-app"]
HA --> |"KV Store"| KV["splunk-kvstore"]
HA --> |"Tags"| TAG["splunk-tag"]
HA --> |"REST Admin"| RA["splunk-rest-admin"]
SS --> SH["Shared Library"]
SJ --> SH
SE --> SH
SM --> SH
SL --> SH
SSS --> SH
SA --> SH
SEC --> SH
MET --> SH
APP --> SH
KV --> SH
TAG --> SH
RA --> SH
SH --> API["Splunk REST API<br/>Port 8089"]