Loading...
Loading...
Found 2 Skills
Provide cited, read-only Splunk Enterprise administration guidance for routine local users, roles, capabilities, configuration precedence, service ownership, maintenance readiness, and safe non-mutating validation. Use when an administrator needs to understand documented Enterprise behavior, compare supplied source-file, btool, or runtime observations, identify accountable role owners, or decide what evidence is missing before a safe change. Route identity-provider authentication, knowledge-object governance, index/storage, app lifecycle, cluster operations, upgrade/security, health/diag, platform incidents, license/capacity, and deployment-server or forwarder-fleet work to their owning skills.
Splunk Enterprise and Enterprise Security SPL authoring for detection engineering — index/sourcetype/time discipline, tstats/CIM acceleration, ESCU macro layers, ES correlation searches, notables, and RBA. Use when authoring or reviewing SPL, configurations.splunk MDR blocks, ES correlation searches, or translating KQL hypotheses to Splunk. Pair with detection-engineering and opentide-detection-rule.