What problem does it solve? Investigating production incidents in Splunk often leads to dumping raw logs without context, wasting time and missing root causes. This Skill enforces a statistics-first workflow so you understand log volume, error rates, and top error patterns before sampling any events. ## Core Features & Use Cases - Statistics-First Investigation: The get_statistics.py script reports total count, error rate, level distribution, top sourcetypes, hosts, and normalized error patterns with an actionable recommendation. - Strategic Log Sampling: The sample_logs.py script supports errors_only, warnings_up, around_time, and all strategies to fetch only relevant events. - SPL Reference: Built-in guidance for filtering, aggregation, anomaly detection, and common query patterns like error rate analysis and response time percentiles. - Use Case: During an outage, run get_statistics.py on the affected index, spot a 12% error rate dominated by one pattern, then sample errors around the spike timestamp to confirm the root cause. ## Quick Start Ask the agent to investigate errors in the main Splunk index over the last hour, starting with statistics and then sampling only error logs.
