SSO login in a browser (Playwright); saves cookies for the Splunk REST API. Auth is SSO-cookie only. If IdP redirects or automation block the session, delete the reported cookie file and retry, and complete SSO fully in the opened window.

Return the official Splunk documentation references you MUST consult before authoring SPL or dashboards. Call this first when writing queries or dashboard definitions. Optional topic: spl | studio | classic | rest.

Show the Splunk username the current session authenticates as. New dashboards are created under this profile.

List dashboards you can see (Splunk enforces visibility by your account). Filter by app, owner, or a name/label substring. Wildcards: omit app/owner to search all.

Fetch one dashboard's full definition (Dashboard Studio JSON or Classic Simple XML), its app/owner/sharing, detected format, and your can_write flag.

Check whether you can edit a dashboard BEFORE trying to update it. Reads the Splunk ACL and reports can_write with a plain-language verdict.

Create a NEW dashboard under YOUR profile (owner = your Splunk user, private by default). Supports Dashboard Studio (JSON) and Classic (Simple XML). Requires docsConsulted=true. DOCUMENTATION-FIRST: read the official Splunk docs (use the splunk_docs tool) before writing SPL or a dashboard definition; do not guess syntax or schema.

Update an EXISTING dashboard's definition. Pre-checks your edit access and REFUSES if Splunk ACL denies write. Requires docsConsulted=true. DOCUMENTATION-FIRST: read the official Splunk docs (use the splunk_docs tool) before writing SPL or a dashboard definition; do not guess syntax or schema.

Run an SPL search and return results (runs as you; Splunk enforces data access). Use the splunk_docs tool (topic 'spl') to verify command syntax before composing queries. DOCUMENTATION-FIRST: read the official Splunk docs (use the splunk_docs tool) before writing SPL or a dashboard definition; do not guess syntax or schema.

List saved searches classified as reports (not alerts) that you can see. Filter by app/owner/name.

Get one report (saved search): its SPL, schedule, ACL, and full config.

Create a report (saved search) under YOUR profile. Optionally scheduled via cron. Requires docsConsulted=true. DOCUMENTATION-FIRST: read the official Splunk docs (use the splunk_docs tool) before writing SPL or a dashboard definition; do not guess syntax or schema.

Update an existing report. Pre-checks edit access; refuses if can_write is false. Requires docsConsulted=true. DOCUMENTATION-FIRST: read the official Splunk docs (use the splunk_docs tool) before writing SPL or a dashboard definition; do not guess syntax or schema.

List saved searches classified as alerts (scheduled + triggering) that you can see.

Get one alert (saved search with alerting): SPL, schedule, trigger condition, actions, ACL.

Create an alert (scheduled saved search with a trigger condition) under YOUR profile. Requires docsConsulted=true. DOCUMENTATION-FIRST: read the official Splunk docs (use the splunk_docs tool) before writing SPL or a dashboard definition; do not guess syntax or schema.

Update an existing alert. Pre-checks edit access; refuses if can_write is false. Requires docsConsulted=true. DOCUMENTATION-FIRST: read the official Splunk docs (use the splunk_docs tool) before writing SPL or a dashboard definition; do not guess syntax or schema.