v2.3.0

querysplunk v2.3.0

Released July 16, 2026.

v2.3.0 expands querysplunk from a safe search runner into a versioned,
assistant-ready library of reusable Splunk diagnostics and security searches.
The CLI and public Go module remain backward compatible with v2.2.0.

Versioned YAML search library

• Bundled searches now use schema_version: "1" and include descriptive
  metadata, platform and capability requirements, provenance, interpretation,
  and review status.
• Existing runtime-only YAML remains valid and is interpreted as schema
  version 1.
• Provenance records distinguish original querysplunk searches from manually
  adapted third-party concepts.

Enforced result safety

• result_handling describes sensitivity, credential content, assistant display
  limits, recommended file permissions, and retention expectations.
• result_contract validates required fields, empty-result policy, and maximum
  row counts before results are presented to an assistant or caller.
• The CLI and public query package enforce the same contracts and preserve
  atomic output behavior.

Expanded bundled searches

• Scheduled-search workflows can diagnose failed jobs with retained
  search.log data and profile successful jobs that approach or exceed their
  observed schedule interval.
• Health searches now cover system messages, orphaned scheduled searches,
  scheduler activity, Splunk Audit web-service errors, and failed modular
  actions.
• Read-only REST examples inspect saved-search definitions, macros, lookup
  definitions, and bounded lookup previews.
• Defender detections cover sensitive or failed audited search activity.
• Authorized penetration-testing examples cover Splunk's stored-credential
  endpoint and possible passwords pasted into username fields. Their results
  are explicitly classified as secret and prohibited from raw assistant
  display.

AI-agent detection starter pack

• A tested Splunk AI command telemetry map documents observable evidence and
  its limits.
• Four experimental searches identify sensitive input before AI enrichment,
  downstream action-capable commands, exact AI-result references used by
  dynamic execution, and AI enrichment followed by Splunk delete.
• Matching safeguards distinguish quoted examples from executable commands,
  inspect all relevant post-AI dynamic commands, and require exact
  ai_result_N fields or $ai_result_N$ substitutions.
• The starter pack credits the Agent Threat Rules project and pins the exact
  upstream revision used for inspiration.

Documentation and project security

• The README, installer guide, assistant skill, examples, and project wiki now
  provide aligned first-use and safety guidance.
• The security policy documents private vulnerability reporting and supported
  release expectations.
• The Splunk MCP comparison explains when MCP network access or interactive
  discovery complements querysplunk's repeatable YAML, CI, SID recovery, and
  bounded diagnostics.

Upgrade

Download the archive and checksums.txt from the
v2.3.0 release,
verify the checksum, extract it, and run:

./install.sh --upgrade

On Windows PowerShell, run ./install.ps1 -Upgrade. The installer preserves
saved YAML, results, credentials, environment files, shell settings, and
unrelated assistant skills.

See the full comparison
for every merged change.

v2.2.0

What's Changed

• Make golangci-lint CI reproducible by @georgestarcher in #55
• Clarify ways to use querysplunk by @georgestarcher in #56
• Add agent-guided read-only Splunk REST inspection by @georgestarcher in #58

Full Changelog: v2.1.0...v2.2.0

v2.1.0

What's Changed

• Add Splunk search safety controls by @georgestarcher in #30
• Make the v2 Splunk package application-ready by @georgestarcher in #34
• Remove legacy mutable Splunk API by @georgestarcher in #35
• Add cross-platform CI coverage by @georgestarcher in #40
• Add caller-controlled structured package logging by @georgestarcher in #41
• Share YAML saved searches and safety policy with Go consumers by @georgestarcher in #42
• Add CLI version and build metadata reporting by @georgestarcher in #43
• Add offline YAML validation and execution plans by @georgestarcher in #45
• Add resumable Splunk job management by SID by @georgestarcher in #47
• Add machine-readable runtime events and diagnostics by @georgestarcher in #49
• Add one-command CLI and AI-assistant installation by @georgestarcher in #51
• Resolve final documentation and workflow QA findings by @georgestarcher in #53

Full Changelog: v2.0.1...v2.1.0

v2.0.1

querysplunk v2.0.1

This patch release updates the release archives so they are useful as complete local CLI bundles, not just standalone binaries.

What's changed

• Release archives now include the platform binary, README.md, examples/health/, and .agents/skills/querysplunk/.
• Added a local assistant skill/runbook for safely operating querysplunk from AI assistant tooling.
• Added release packaging scripts shared by local make package and GitHub Actions.
• Added archive-content verification so CI fails if release bundles drop required docs/examples/skill files or accidentally include generated result files or local env artifacts.
• Fixed release packaging for custom absolute output directories.

Why this matters

Users who download a release archive can now run the CLI, inspect bundled example YAML files, and use the included assistant runbook without cloning the repository.

The .agents/skills/querysplunk/ content is advisory documentation for local assistant workflows. It is not loaded by the querysplunk binary.

Release assets

Prebuilt bundles are attached for:

• macOS amd64
• macOS arm64
• Linux amd64
• Linux arm64
• Windows amd64

Use checksums.txt to verify downloaded assets.

Full changelog: v2.0.0...v2.0.1

v2.0.0

querysplunk v2.0.0

This release turns querysplunk from a simple SPL-file runner into a more complete Splunk search CLI with structured YAML configs, safer job handling, richer diagnostics, and repeatable release packaging.

Highlights

Structured YAML search configs

querysplunk can now run searches from YAML config files with explicit fields for:

• Splunk app context
• output file
• execution mode
• dispatch parameters
• result parameters
• search log diagnostics

A starter config can be generated with:

querysplunk -write-config search.yml

Better Splunk job lifecycle handling

Search jobs now get clearer lifecycle handling, including state/progress logging, terminal-state errors, and remote cancellation when a local timeout or context cancellation occurs after a job has been created.

Search log diagnostics

The CLI can fetch and summarize search.log after a job completes. It reports warnings and errors found in the job log even when Splunk marks the job as DONE, which helps catch non-fatal execution problems that would otherwise be easy to miss.

Safer and more flexible result retrieval

This release adds configurable result endpoint selection:

• auto: try the v2 results endpoint first, then fall back to v1
• v2: force the v2 endpoint
• v1: force the v1 endpoint

It also adds streaming export mode for searches where writing results directly to disk is a better fit than creating and polling a normal search job.

Dispatch time bounds

Use -earliest and -latest for quick one-off dispatch bounds, or set dispatch.earliest_time and dispatch.latest_time in YAML. The CLI warns when a search appears to have no time bounds.

Health-check examples

The repo now includes example YAML searches under examples/health/ for common Splunk health checks, including splunkd health, scheduler status, internal warnings/errors, search concurrency, disk partitions, resource usage, and license warnings.

Live integration coverage

The GitHub Actions workflow now supports manual live Splunk integration runs. The integration path validates both the lower-level Splunk client and the CLI YAML config path using examples/health/splunkd-health.yml.

Release assets

Prebuilt binaries are attached for:

• macOS amd64
• macOS arm64
• Linux amd64
• Linux arm64
• Windows amd64

Use checksums.txt to verify downloaded assets.

Notable PRs

• #12 Add Splunk app context support and release automation
• #19 Improve Splunk job lifecycle diagnostics
• #20 Add structured YAML search config
• #21 Add dispatch time bound flags
• #22 Add configurable result endpoint selection
• #23 Add streaming export mode
• #24 Add Splunk health check example configs
• #25 Add live YAML config integration test
• #26 Refresh CLI documentation

Full changelog: v1.0.0...v2.0.0

Initial Release

This is just an initial release that includes the basic tests.