Home

querysplunk

querysplunk is a Go command-line tool and library for safely running Splunk searches from SPL or structured YAML, saving results, monitoring long-running jobs, and collecting bounded search.log diagnostics. Release bundles also include an Agent Skill for Codex and Claude Code.

Current release

v2.3.0 adds a versioned YAML search library, enforced result-handling contracts, scheduled-search log analysis, expanded health and security searches, Splunk AI telemetry guidance, and the experimental AI-agent detection starter pack. It is a backward-compatible upgrade from v2.2.0.

Read the v2.3.0 release notes for the complete user-facing summary and upgrade instructions.

Start here

• Install querysplunk
• Read the project documentation
• Browse the bundled YAML examples
• Use the AI-agent detection starter pack
• Review the assistant skill

The repository documentation remains the versioned source of truth. This wiki provides task-oriented orientation and links to the files shipped in each release.

AI-agent detection starter pack

The experimental starter pack uses Splunk audit telemetry to identify:

• credential-bearing sources or fields that precede AI enrichment;
• an ai command followed by a separate action-capable command;
• AI-result fields referenced by later dynamic execution; and
• an ai command followed by Splunk delete.

Splunk's ai command enriches or extracts features from search-result rows. It does not independently send email, write lookups, execute scripts, or hide events. Those effects require separate SPL commands. The detections report investigative leads and command ordering, not proof that AI autonomously caused an action.

Attribution

The AI-agent starter pack was inspired by the open-source Agent Threat Rules project and adapts selected stable rule concepts to the Splunk telemetry that querysplunk can observe.

Upstream sources are pinned to revision 0c7a1f133fc176a732767363db65102aa0aae710:

• ATR-2026-00702: IPI credential exfiltration via agent action
• ATR-2026-00711: IPI system sabotage through destructive command
• ATR-2026-00714: Tool camouflage and forced tool call

Agent Threat Rules is distributed under the MIT License. See querysplunk's third-party notices and the provenance block in each detection YAML.

The querysplunk YAML and SPL are manually reviewed adaptations. They are not upstream ATR releases and do not claim complete AI-agent threat coverage.