From 25d86c3e594b89f8dc65f2ad95409203f090af19 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 5 Oct 2026 16:04:38 +0000 Subject: [PATCH] Document Splunk Enterprise admin advisor skill Co-authored-by: D. Dessy (Splunk) --- README.md | 2 +- docs/README.md | 2 +- docs/poc/DEVELOPER_GUIDE.md | 5 +++-- docs/poc/GRADUATION.md | 2 +- 4 files changed, 6 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 1514473..93b5937 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ make up make verify-mcp-remote ``` -`make up` registers workshop tools **`SA-S4R_*`** on the MCP endpoint (prefer those over ad-hoc SPL). In Cursor: **`/usage`** (tool routing) · **`/demo-prep`** (go/no-go: Splunkbase pins, S4R smoke). Details: [AGENTS.md](AGENTS.md) · [docs/s4r/MCP-TOOLS.md](docs/s4r/MCP-TOOLS.md). +`make up` registers workshop tools **`SA-S4R_*`** on the MCP endpoint (prefer those over ad-hoc SPL). In Cursor: **`/usage`** (tool routing) · **`/demo-prep`** (go/no-go: Splunkbase pins, S4R smoke) · **`/splunk-enterprise-administration-advisor`** (read-only Enterprise admin guidance). Details: [AGENTS.md](AGENTS.md) · [docs/s4r/MCP-TOOLS.md](docs/s4r/MCP-TOOLS.md). | URL | Use | | --- | --- | diff --git a/docs/README.md b/docs/README.md index 00337bc..77d930a 100644 --- a/docs/README.md +++ b/docs/README.md @@ -19,7 +19,7 @@ Local PoC: **Splunk Enterprise** + **Splunk MCP Server** in Docker, optional **S | Install from scratch (long form) | [poc/INSTALLATION.md](poc/INSTALLATION.md) | | PoC graduation / wider rollout impact | [poc/GRADUATION.md](poc/GRADUATION.md) | | Splunk4Rookies workshop | [s4r/README.md](s4r/README.md) | -| Change the repo or use AI agents | [AGENTS.md](../AGENTS.md) — Cursor **`/usage`** (`SA-S4R_*` routing) · **`/demo-prep`** (Splunkbase pins + S4R smoke) | +| Change the repo or use AI agents | [AGENTS.md](../AGENTS.md) — Cursor **`/usage`** (`SA-S4R_*` routing) · **`/demo-prep`** (Splunkbase pins + S4R smoke) · **`/splunk-enterprise-administration-advisor`** (read-only Enterprise admin guidance) | | Present the agentic demo (Marp) | [demo-slides/README.md](../demo-slides/README.md) | ## Source of truth (code wins) diff --git a/docs/poc/DEVELOPER_GUIDE.md b/docs/poc/DEVELOPER_GUIDE.md index 7e24dc2..a7f87af 100644 --- a/docs/poc/DEVELOPER_GUIDE.md +++ b/docs/poc/DEVELOPER_GUIDE.md @@ -15,7 +15,7 @@ Contributing and changing this PoC. Stack design: [ARCHITECTURE.md](ARCHITECTURE | `SA-S4R` packaging / `.github/workflows/package-s4r.yml` | [CI_CD.md](CI_CD.md) and [SA-S4R-APP.md](../s4r/SA-S4R-APP.md) | | Workshop SPL | [S4R-SPL-CATALOG.md](../s4r/SPL-CATALOG.md) only (agents reference this path) | | Agent prompts | `.cursor/agents/s4r-*.md`, [S4R-AGENTS.md](../s4r/AGENTS.md) | -| Cursor project skills (`/usage`, `/demo-prep`) | `.cursor/skills/*/SKILL.md`, root [AGENTS.md](../../AGENTS.md#cursor-skills-project), and [CONFIGURATION.md § Makefile targets](CONFIGURATION.md#makefile-targets) if command behavior changes | +| Cursor project skills (`/usage`, `/demo-prep`, `/splunk-enterprise-administration-advisor`) | `.cursor/skills/*/SKILL.md`, root [AGENTS.md](../../AGENTS.md#cursor-skills-project), and [CONFIGURATION.md § Makefile targets](CONFIGURATION.md#makefile-targets) if command behavior changes | | Marp slides, theme, or `make marp-*` targets | [demo-slides/README.md](../../demo-slides/README.md), [demo-slides/S4R-DEMO.md](../../demo-slides/S4R-DEMO.md), and [CONFIGURATION.md § Makefile targets](CONFIGURATION.md#makefile-targets) | | Secret scanning or pre-commit hooks (`.gitleaks.toml`, `.pre-commit-config.yaml`, CI lint) | [CI_CD.md](CI_CD.md), [SECURITY.md](SECURITY.md), and root [SECURITY.md](../../SECURITY.md) | @@ -65,8 +65,9 @@ Tracked skills live under **`.cursor/skills/`** and are intentionally small, sla | ----- | ------ | -------- | | `/usage` | Static repo cheat sheet for S4R MCP routing, make targets, and MCP park/boot flow | No live health checks unless the user asks. Keep it concise; point to docs instead of duplicating runbooks. | | `/demo-prep` | Live-demo go/no-go: `make demo-prep` (Splunkbase pins + status + verify), S4R MCP smoke, and MCP auth stats | Do not start, clean, or change NK mode unless the user asked. Do not paste secrets. | +| `/splunk-enterprise-administration-advisor` | Read-only Splunk Enterprise administration guidance for local users, roles, capabilities, configuration precedence, `btool`, service ownership, and maintenance readiness | Advisory only: do not mutate users, roles, config files, app state, indexes, services, or cluster state. Keep source-file, `btool`, and runtime evidence distinct; cite current Splunk Enterprise docs for product behavior. | -Both skill files set **`disable-model-invocation: true`** so their bodies are loaded only when invoked. Keep workshop role behavior in **`.cursor/agents/`** and the SPL in **`docs/s4r/SPL-CATALOG.md`**; skills should route users to those sources rather than becoming another runbook. +All skill files set **`disable-model-invocation: true`** so their bodies are loaded only when invoked. The Splunk Enterprise administration advisor is vendored from **`splunk/splunk-agent-skills`** with its Apache-2.0 **`LICENSE`** beside the skill; preserve that license if refreshing it. Keep workshop role behavior in **`.cursor/agents/`** and the SPL in **`docs/s4r/SPL-CATALOG.md`**; skills should route users to those sources rather than becoming another runbook. ## Contributing diff --git a/docs/poc/GRADUATION.md b/docs/poc/GRADUATION.md index d4a1b8d..3d2f42b 100644 --- a/docs/poc/GRADUATION.md +++ b/docs/poc/GRADUATION.md @@ -130,7 +130,7 @@ These reduce the gap versus a greenfield PoC: - **`make clean-y && make up`** for full reset - **`make verify`** / **`/demo-prep`** acceptance path - **MCP-first** workshop mode (`SA-S4R_*` tools); NK toggle via Splunk config REST (`local/eventgen.conf` override) -- Tracked **`.cursor/skills/`** (`/usage`, `/demo-prep`) +- Tracked **`.cursor/skills/`** (`/usage`, `/demo-prep`, `/splunk-enterprise-administration-advisor`) - **SA-S4R** package workflow ([CI_CD.md](CI_CD.md)) - **Cursor Cloud** bootstrap for ephemeral VMs