sc4s-plugin

Plugin sc4s-plugin from marketplace sc4s-plugins in splunk/splunk-connect-for-syslog. Commands read from the repo's manifest — 19 days ago.

Skills (6)

• manage-sc4s-parsers

  Safely list, inspect, deploy, update, or delete custom parsers on a running SC4S instance through MCP. Use for custom parser inventory, parser content review, parser replacement, removal, and post-change verification.

• manage-sc4s-splunk-metadata

  Manage SC4S Splunk Metadata by safely inspecting, adding, updating, removing, or clearing overrides through MCP. Use for vendor_product index, source, sourcetype, host, or sc4s_template overrides in splunk_metadata.csv.

• create-parser

  Design an SC4S syslog-ng parser from raw log samples, optionally deploy it through the SC4S MCP server. Use when onboarding a new vendor or product, adding a custom log source, or creating parser logic for unsupported logs.

• sc4s-guided-configuration

  Use when users ask to configure SC4S, create an env_file, set Splunk HEC details, tune performance, or apply generated settings to a running SC4S instance through natural conversation.

• sc4s-send-syslog

  Send raw-text test syslog events to the SC4S host through its MCP tool. Use when a user wants to inject sample syslog lines for parser, routing, or ingestion testing; not for PCAP replay or arbitrary hosts.

• troubleshoot-sc4s

  Diagnose a running SC4S instance through its MCP server. Use when SC4S is unhealthy or unreachable, events are missing or misrouted, parser behavior is unexpected, Splunk metadata looks wrong, or a configuration job failed.

Similar plugins