splunkbase-skill

Warning

Personal project, not for production use. This is not a Splunk or Cisco product and is not endorsed or supported by Cisco or Splunk. It uses Splunkbase's undocumented API and is provided "as is" under the Apache-2.0 license, without warranty. See SUPPORT.md.

A Claude Skill that resolves Splunkbase apps to their current download URLs (optionally for a given Splunk version) and finds app IDs by name. Built for generating SPLUNK_APPS_URL in splunk/splunk Docker Compose setups.

Install

Download splunkbase-skill.skill from the latest release and add it to Claude (see Using Skills in Claude). For Claude Code, unzip it into ~/.claude/skills/.

Or with the skills CLI, the same installer the official Splunk Agent Skills use:

npx skills add dd-Splunk/splunkbase-skill --agent claude-code --copy --yes

agents/openai.yaml provides the interface metadata for other agents. This skill complements the official lifecycle and product-question skills: they give advice and citations, this one resolves exact release URLs from the live API. It is an unofficial personal project, see SUPPORT.md; licensed under Apache-2.0.

Then ask, for example: "Give me SPLUNK_APPS_URL for Splunkbase apps 4353 and 7931 for Splunk 9.4" or "Find the Splunkbase app for Config Explorer".

Command line

The scripts work without Claude. Python 3.9+ (standard library only):

python3 scripts/splunkbase_urls.py 4353 7931                    # comma-separated URLs
python3 scripts/splunkbase_urls.py --format env 4353 7931       # SPLUNK_APPS_URL=...
python3 scripts/splunkbase_urls.py --splunk-version 9.4 4353    # newest release supporting Splunk 9.4
python3 scripts/splunkbase_urls.py --image splunk/splunk:9.4.2 4353  # same, version read from the image tag
python3 scripts/splunkbase_urls.py --cloud 4353                 # only Splunk Cloud compatible releases
python3 scripts/splunkbase_urls.py --check .env                 # which pinned URLs are outdated (exit 3 if any)
python3 scripts/splunkbase_urls.py --format json 4353           # app, version, compatibility, warnings
python3 scripts/splunkbase_urls.py --search "config explorer"   # find IDs by name

scripts/get_splunkbase_urls.sh (needs curl and jq, works with macOS bash 3.2) provides the same options except --search, --check and the table format.

Exit status: 0 all resolved, 1 at least one app failed (nothing on stdout unless --partial), 2 bad arguments. Warnings go to stderr.

Resolving URLs needs no login; downloading them does. See references/docker-compose.md for the credential setup.

Development

python3 -m unittest discover -s tests          # offline: fake Splunkbase + real fixtures, ~15 s
SPLUNKBASE_LIVE=1 python3 -m unittest tests.test_live   # hits the real API
shellcheck scripts/get_splunkbase_urls.sh

• tests/test_cli_contract.py runs one behaviour suite against both implementations, so they cannot drift apart.
• tests/test_skill_package.py validates SKILL.md frontmatter, the metadata.splunk block, agents/openai.yaml, evals.json, version consistency and links.
• evals.json holds model-graded trigger/behaviour evals in the official format; they need an eval runner and are only structure-checked here.
• .github/workflows/api-check.yml runs the live tests weekly, because the Splunkbase API is unofficial. See references/api.md.

Releasing

1. Bump the version in SKILL.md (metadata.version), both scripts, and add a CHANGELOG.md entry.
2. Merge to main, then git tag v2.1.0 && git push origin v2.1.0.
3. The release workflow checks the tag matches SKILL.md, runs the tests, builds splunkbase-skill.skill from git archive (files marked export-ignore in .gitattributes are left out) and publishes the release with the changelog notes.

Disclaimer & Support

This is a personal project. It is not an official Splunk or Cisco product, is not endorsed by Cisco or Splunk, and is not covered by Cisco TAC, Splunk Support or any commercial support agreement or SLA. Use it at your own risk, test it in a non-production environment first, and open a GitHub issue for questions or bugs (best effort). Details in SUPPORT.md.

License

Copyright 2026 Dominique Dessy. Licensed under the Apache License, Version 2.0; distributed "as is", without warranties or conditions of any kind.