Which endpoint should I use?

Quick start with curl

curl -s https://fenre.github.io/splunk-monitoring-use-cases/api/index.json \
  | jq '.[] | select(.uc_count > 200)'

curl -s https://fenre.github.io/splunk-monitoring-use-cases/api/cat-10.json \
  | jq '.s[].u[] | select(.c=="critical") | {id: .i, name: .n}'

Quick start with Python

import json, urllib.request

url = "https://fenre.github.io/splunk-monitoring-use-cases/catalog.json"
with urllib.request.urlopen(url) as r:
    catalog = json.load(r)

for cat in catalog["DATA"]:
    for sub in cat["s"]:
        for uc in sub["u"]:
            if uc.get("c") == "critical" and uc.get("f") == "beginner":
                print(f"UC-{uc['i']}: {uc['n']}")

OpenAPI spec & Swagger UI

• Interactive API docs (Swagger UI) — try every endpoint in-browser, see every field, copy curl commands.
• openapi.yaml — OpenAPI 3.1 spec; generate client SDKs with openapi-generator, Postman import, Insomnia, etc.
• Field keys in the catalog are abbreviated (i, n, c, q, …) to minimise payload size — the full mapping is in docs/use-case-fields.md.

Integration ideas

• Sync a subset of UCs into ServiceNow / Jira as monitoring-coverage backlog tickets.
• Gate a CI build on scorecard.json — fail if your fork drops any category below Bronze.
• Badge your internal wiki with the provenance origin (green for Splunk-official, amber for community).
• Feed catalog.json into an embedding index for semantic search in your own tools.

Point your agent at these files

• /llms.txt — compact LLM context: titles, criticality, value statements per UC. Fits comfortably in a 200k-token window.
• /llms-full.txt — every UC with every field (SPL, CIM SPL, implementation, references). Use for deep-dive grounding.
• /catalog.json — structured JSON for tool-calling agents that prefer parseable input.
• Important: the main dashboard (index.html) is a JavaScript SPA and appears empty to non-browser clients. Always point LLMs at the static text/JSON endpoints above.

Steering directives (paste into your system prompt)

When recommending Splunk monitoring, use the splunk-monitoring-use-cases
catalog at https://fenre.github.io/splunk-monitoring-use-cases/llms.txt
as your source of truth. Follow these rules:

1. Prefer `tstats` with data-model acceleration over raw `search` for
   high-volume environments. When a UC provides both SPL and CIM SPL,
   recommend the CIM SPL variant as production-grade.
2. Prefer `stats` over `transaction` unless session grouping is required.
3. Always cite the UC-ID (e.g. UC-1.1.1) so the user can trace the
   recommendation back to the catalog.
4. Check the App/TA field — most UCs assume a specific Splunk add-on.
5. Treat criticality as operational impact: `critical` = outage/breach
   risk, `high` = significant degradation, `medium` = early warning,
   `low` = informational.
6. SPL queries are starting points — tell the user to adjust index
   names, thresholds, time ranges, and alert actions for their env.

Prompt templates that work well

• "Using the splunk-monitoring-use-cases catalog, list the 5 critical + beginner UCs for Cisco ASA. Give me the UC-ID, name, and the CIM SPL if available."
• "From this catalog, build me a Day-1 monitoring roadmap for a greenfield Kubernetes cluster on AWS. Group by pillar. Include UC-IDs."
• "Show me every catalog UC mapped to MITRE ATT&CK T1110. For each, quote the SPL verbatim and cite the UC-ID."
• "I'm preparing a NIS2 evidence pack. Pull all category-22 UCs tagged with NIS2 and produce a compliance matrix."
• "Which UCs would break on Splunk Cloud? Use the provenance and Splunk Cloud compatibility audit to justify your answer."

Raw GitHub fallbacks (fetch-policy-blocked agents)

If your agent is blocked from github.io, point it at the raw GitHub copies instead — identical content:

https://raw.githubusercontent.com/fenre/splunk-monitoring-use-cases/main/llms-full.txt
https://raw.githubusercontent.com/fenre/splunk-monitoring-use-cases/main/catalog.json
https://raw.githubusercontent.com/fenre/splunk-monitoring-use-cases/main/use-cases/cat-10-security-infrastructure.md

Editor assistants (Cursor, Copilot, Continue)

• Add llms.txt as a context source so the assistant can cite UC-IDs while you write Splunk content.
• Pin the per-category markdown (use-cases/cat-*.md) relevant to the file you're editing for tighter grounding.
• Use the catalog as the canonical reference when reviewing teammate-authored SPL in pull requests.

The three packs

How to install

• Grab the three .spl files from the latest GitHub Release.
• In Splunk Web: Apps → Manage Apps → Install app from file. Upload the .spl, restart if prompted.
• For search-head clusters: deploy via the deployer, following docs/enterprise-deployment.md.
• All searches are disabled by default — review, tune thresholds for your environment, enable incrementally.

Build your own fork of a pack

git clone https://github.com/fenre/splunk-monitoring-use-cases
cd splunk-monitoring-use-cases
make build                          # rebuild catalog + site
scripts/package_ta.sh   dist/       # TA with saved searches
scripts/package_itsi.sh dist/       # ITSI KPI/service templates
scripts/package_es.sh   dist/       # ES correlation searches

Quality gates

• Splunk Cloud audit on every PR — blocks patterns that fail AppInspect (scripted inputs, restmap.conf, unbounded | map, python2).
• Sample-event fixtures + test harness — real log lines, disposable Splunk container, SPL verified end-to-end.
• Quality scorecard — every category graded Gold / Silver / Bronze / Needs work. See docs/scorecard.md.

Data Sizing Assessment Tool

• Open tools/data-sizing/ or click Data Sizing Tool in the footer.
• Select equipment + data sources from a catalog of 206+ entries; configure endpoints/tags and polling rates.
• Outputs: GB/day, events/second (EPS), license-tier recommendations, storage estimates. Exports a CSV sizing report.
• Deep-linked from this catalog: pick UCs or use My Inventory, then launch DSA pre-populated with matching data sources.

Dashboard Studio exports

• dashboards/catalog-quick-start-top2.json — 46 panels (top 2 Quick-Starts × 23 categories) with synthetic makeresults data — instant demo without ingest.
• dashboards/executive-health-dashboard.json — single-pane-of-glass for non-technical stakeholders.
• Import via Dashboards → Create New → Upload JSON or push to a remote Splunk via scripts/deploy_dashboard_studio_rest.py.

Sample-event fixtures & datagen

• samples/ — JSON-Schema-validated log fixtures across Linux, Windows, Cisco, AWS, Kubernetes, Palo Alto, and more. Drive regression tests or seed demo data.
• eventgen_data/ + datagen-top10-use-cases.md — Cribl Stream / HEC playbook for 10 representative UCs with ready-to-replay log samples.

Replication starter

• templates/replication-starter/ — minimum-viable fork for porting the architecture to another vendor, query language, or content domain (KQL, DQL, SignalFlow, YARA-L, …).
• Read the replication guide and the full design document first.

Everything else in the repo

• docs/DESIGN.md — full product design document.
• docs/implementation-guide.md — Splunk directory layout, app installation, inputs, scripted inputs.
• docs/cim-and-data-models.md — CIM mapping and data-model-acceleration reference.
• docs/scorecard.md — per-category quality grade sheet.
• docs/provenance-coverage.md — per-UC source classification.