Agent Skills

Skills are reusable capability modules that you attach to agents to shape how they respond, research, and execute tasks.

Parent: Agents
Related: Creating Agents | Chatting with Agents | Understanding Agents

What Are Skills?

Skills package instructions, context, and optional scripts into a reusable unit that agents load on demand. Each skill teaches an agent a specific behavior — concise answers, deep research reports, structured Splunk searches, incident triage workflows, and more. Skills do not replace tools or integrations; they complement them by guiding how the agent uses its tools.

You can think of skills as behavior profiles. When you attach the Search Splunk skill, the agent follows a strict workflow: fetch the SPL cheat sheet, look up command references, construct the query, execute it, and present results. Without that skill, the agent still has access to the same Splunk tools but relies on its general knowledge to decide how to use them.

How to Use Skills

You attach skills in two ways:

Per-Message: Slash Commands in Chat

Type / in the chat input to open the skills menu. Filter by name and select a skill. A pill badge appears above the input showing the attached skill. The skill applies to that single message only — subsequent messages revert to the agent's default behavior unless you attach a skill again.

Type / in the chat input to open the skills menu.
Filter by name and select a skill.
Send your message. The skill applies to that message only.

Permanently: Agent Edit Page

Open an agent's settings and navigate to the Skills tab. Toggle skills on to attach them permanently. Every conversation with that agent loads the selected skills automatically.

Go to Agents → select an agent → Edit.
Open the Skills tab.
Toggle skills on or off. Changes apply to all future conversations.

Available Skills

You browse all available skills from the Skills page in the dashboard sidebar.

Skill	What It Does	Best For
Search Splunk	Follows a structured workflow: fetches the SPL cheat sheet, looks up command references, constructs optimized queries, and executes searches	Any SPL query or Splunk data exploration
Deep Research	Runs a multi-phase research pipeline with source credibility scoring, citation tracking, and report generation	Complex analysis requiring 10+ sources and verified claims
Web Research	Searches the web with multiple queries, synthesizes findings, and cites sources with URLs	Questions that need current, live information
Research	Adopts a fact-finding approach, distinguishes verified facts from assumptions, and flags uncertainty	Evidence-based analysis and grounded answers
CIM Modeling	Guides CIM normalization: maps fields, configures event types, tags, aliases, and extractions for Splunk data models	Normalizing data to the Splunk Common Information Model
Incident Response	Uses a diagnosis-first workflow: summarizes symptoms, ranks root causes, and proposes mitigation paths	Triaging incidents, debugging production issues, root cause analysis
Structured Output	Returns responses in clear sections with headings, bullet points, checklists, and action items	Organized, scannable output for decisions and planning
Dashboard Studio	Follows a structured workflow for building Splunk Dashboard Studio dashboards — gathers context, constructs JSON definitions, applies theming, deploys via MCP, and verifies	Creating, editing, or styling Splunk Dashboard Studio dashboards
Concise	Produces short, direct answers with minimal verbosity — leads with the answer, adds details only when asked	Quick lookups where brevity matters
Splunk Alerting	Creates, manages, and troubleshoots Splunk alerts — builds scheduled and real-time alerts with trigger conditions, throttling, suppression, and alert actions (email, webhook, log event, CSV)	Creating or managing Splunk alerts, configuring alert schedules and actions
Dashboard Studio	Builds themed Splunk Dashboard Studio dashboards using JSON definitions with visualizations, data sources, inputs, tokens, dynamic options syntax, and layout configuration	Creating or editing Dashboard Studio dashboards, applying themes and visualizations
DAP Onboarding	Structures Git repositories for Splunk app deployment via the Deslicer Automation Platform (DAP) — configures directory layouts, CCA metadata, and CI/CD workflows for mono-app and multi-app repos	Setting up Git repos for DAP-managed Splunk app deployment
Splunk Data Input Tracking	Correlates configured inputs with live ingestion staleness, volume, and fleet inventory; builds input-health dashboards and alert-ready saved searches	Monitoring data input freshness, finding stale sources, scheduling ingestion checks
Splunk Environment Documentation	Collects live Splunk and DAP inventory, composes chapterized markdown with Mermaid topology diagrams, and publishes to GitHub via pull request	Documenting fleet topology, data flows, or scheduling weekly docs refresh
Deploy GDI App via Git	Guides governed Git-based deployment of GDI-generated Splunk apps with branch, commit, and PR workflows	Pushing finalized GDI configs to a repository for review
Deploy GDI Config as Draft	Creates DAP change-plan drafts from generated GDI configs without auto-executing	Starting a governed config rollout from onboarding output
Remediate Compliance Finding	Structures remediation change items from DAP compliance violations into approval-ready plan drafts	Fixing compliance failures identified in Security Insights
Observe Fleet Audit	Runs a read-only, evidence-backed Splunk fleet health and posture audit — fleet summary, certificates, security audit, inputs coverage, drift signals, and compliance context	Starting an Observe conversation, fleet health checks, or "what needs attention" reviews before any change
Investigate Config Drift	Deep-read comparison of drifting configuration across peers and tiers, with evidence tables and remediation recommendations	After an audit surfaces drift, or when comparing configs across indexers or search heads
Resolve Plan Target Group	Discovers enrolled hosts and groups, confirms blast radius, and resolves the correct target group before any plan is created	Mandatory prerequisite before authoring a new DAP change plan
Plan Lifecycle (HITL)	Drives an existing plan through dry-run, diff preview, approve, execute, monitor, retry, reject, and delete — with human-in-the-loop gates at every mutating step	Approving, executing, or walking through an existing change plan from chat or the Plans page
Splunk Observability Native Ops	Triages APM services, alerts, traces, and synthetics using Observability MCP reads; plans detectors, muting, and routing as UI handoffs	On-call triage and native Observability operations
Splunk Observability Deep Native Workflows	Cross-cutting reference for service maps, Trace Analyzer, RUM, navigators, and related modern Observability surfaces	Understanding which UI surface an artifact appears in and building deeplink handoffs
Splunk Observability Dashboard Builder	Classic-API dashboards, charts, SignalFlow programs, and validated dashboard JSON payloads	Designing Observability dashboards grounded in live metrics
Splunk Observability SLO Setup	SLI selection, objective windows, error-budget math, and burn-rate alert design	Creating or refining Observability SLOs
Splunk Observability Synthetics Setup	Browser, API, HTTP, SSL, and port synthetic tests with location and alerting guidance	Planning synthetic monitoring coverage
Splunk Observability Metrics Pipeline Setup	MPM rule types (keep, archive, drop, aggregate, route), scope filters, ordering, and volume math	FinOps and cardinality reduction via Metrics Pipeline Management

Skills Page

The Skills page is accessible from the dashboard sidebar. It displays all available skills in a searchable, filterable grid. Each skill card shows:

Name and icon — identifies the skill
Description — explains when and why to use it
Tags — categorize skills (e.g., splunk, research, style)
Capability indicators — icons show if the skill includes scripts, reference documents, or asset files
Slash command — the /slug you type in chat to activate it (e.g., /search-splunk)

You can filter skills by tag or search by name and description. Click Details on any skill card to view its full documentation.

How Skills Work with Tools and Integrations

Skills and integrations serve different roles:

Concept	Role
Integrations	Connect the agent to external systems (Splunk, GitHub, VirusTotal) and provide tools
Tools	Individual actions the agent can perform (run a search, fetch documentation)
Skills	Behavioral instructions that guide how the agent uses its tools

A skill like Search Splunk does not add new tools. It instructs the agent to call get_splunk_cheat_sheet before writing SPL, use run_splunk_search for complex queries, and present results in a specific format. The Splunk MCP integration must still be connected for those tools to be available.

Input File Safety

Skills that include scripts can accept data files as input (for example, a log file to analyze or a JSON report to validate). Deslicer enforces strict safety rules on these input files before they reach the execution sandbox:

Data-only extensions — only non-executable file types are accepted: .txt, .md, .json, .jsonl, .yaml, .yml, .toml, .ini, .cfg, .conf, .csv, .tsv, .xml, .html, .css, .log, .pdf, and others. Executable extensions (.py, .js, .ts, .sh, .so, .rb) are rejected.
No path traversal — paths with ../ segments or absolute paths (/etc/...) are blocked.
No collision with skill code — input file names cannot shadow the skill's own trusted scripts.

These protections run automatically. If you pass a file that violates these rules, the skill returns an error explaining which constraint was not met. You do not need to configure anything — the safety layer is always active.

Tips

Start with slash commands — try a skill per-message before permanently attaching it to an agent.
Combine skills with the right integrations — the Search Splunk skill works best when the Splunk MCP integration is connected.
Use Concise for quick checks — attach /concise when you want a one-line answer instead of a detailed explanation.
Use Deep Research for reports — when you need a comprehensive analysis with citations, attach /deep-research and give the agent a clear research question.