splunkctl 0.1.0__py3-none-any.whl

splunkctl/main.py

@@ -0,0 +1,149 @@
+"""Click entry point and global flags."""
+
+import sys
+from typing import Any
+
+import click
+
+from splunkctl import __version__, output
+from splunkctl.commands.alerts import alerts_group
+from splunkctl.commands.apps import apps_group
+from splunkctl.commands.commands_meta import commands_meta
+from splunkctl.commands.config_cmd import config_group
+from splunkctl.commands.dashboards import dashboards_group
+from splunkctl.commands.indexes import indexes_group
+from splunkctl.commands.info import info
+from splunkctl.commands.inputs import inputs_group
+from splunkctl.commands.lookups import lookups_group
+from splunkctl.commands.parsers import parsers_group
+from splunkctl.commands.rules import rules_group
+from splunkctl.commands.search import search_group
+from splunkctl.commands.skill_cmd import skill_group
+from splunkctl.commands.users import users_group
+
+
+class _CLI(click.Group):
+    """Top-level group with flag hoisting and SDK error handling.
+
+    Rewrites args so global flags (--yes, --json, --format, --fields)
+    work in any position, not just before the subcommand.
+    """
+
+    _HOIST_FLAGS: frozenset[str] = frozenset(
+        {
+            "--yes",
+            "-y",
+            "--json",
+            "--debug",
+        }
+    )
+    _HOIST_VALUE: frozenset[str] = frozenset(
+        {
+            "--format",
+            "--fields",
+            "--timeout",
+            "--config",
+            "-c",
+        }
+    )
+
+    def parse_args(self, ctx: click.Context, args: list[str]) -> list[str]:
+        """Move known global flags to the front of the arg list."""
+        prefix: list[str] = []
+        rest: list[str] = []
+        i = 0
+        while i < len(args):
+            if args[i] in self._HOIST_FLAGS:
+                prefix.append(args[i])
+            elif args[i] in self._HOIST_VALUE and i + 1 < len(args):
+                prefix.append(args[i])
+                prefix.append(args[i + 1])
+                i += 1
+            else:
+                rest.append(args[i])
+            i += 1
+        return super().parse_args(ctx, prefix + rest)
+
+    def invoke(self, ctx: click.Context) -> Any:
+        try:
+            return super().invoke(ctx)
+        except Exception as exc:
+            name = type(exc).__name__
+            if name == "HTTPError":
+                msg = str(exc)
+                if "403" in msg:
+                    output.error(f"Permission denied: {msg}")
+                elif "401" in msg:
+                    output.error(f"Authentication failed: {msg}")
+                elif "404" in msg:
+                    output.error(f"Not found: {msg}")
+                else:
+                    output.error(msg)
+                sys.exit(1)
+            if name == "AuthenticationError":
+                output.error(f"Authentication failed: {exc}")
+                sys.exit(1)
+            raise
+
+
+@click.group(cls=_CLI)
+@click.version_option(version=__version__, prog_name="splunkctl")
+@click.option("--json", "use_json", is_flag=True, help="Force JSON output.")
+@click.option(
+    "--format",
+    "fmt",
+    type=click.Choice(["table", "json", "csv", "jsonl"]),
+    default=None,
+    help="Output format.",
+)
+@click.option("--fields", default=None, help="Comma-separated fields to project.")
+@click.option("--out", "-o", type=click.Path(), default=None, help="Write to file.")
+@click.option("--yes", "-y", is_flag=True, help="Confirm mutation, skip dry-run.")
+@click.option(
+    "--config",
+    "-c",
+    type=click.Path(),
+    default=None,
+    help="Config file path.",
+)
+@click.option("--debug", is_flag=True, help="HTTP request/response logging.")
+@click.option("--timeout", type=int, default=30, help="Request timeout in seconds.")
+@click.pass_context
+def cli(
+    ctx: click.Context,
+    *,
+    use_json: bool,
+    fmt: str | None,
+    fields: str | None,
+    out: str | None,
+    yes: bool,
+    config: str | None,
+    debug: bool,
+    timeout: int,
+) -> None:
+    """CLI tool for Splunk Enterprise SIEM operations."""
+    ctx.ensure_object(dict)
+    ctx.obj["json"] = use_json
+    ctx.obj["format"] = fmt
+    ctx.obj["fields"] = fields
+    ctx.obj["out"] = out
+    ctx.obj["dry_run"] = not yes
+    ctx.obj["config"] = config
+    ctx.obj["debug"] = debug
+    ctx.obj["timeout"] = timeout
+
+
+cli.add_command(alerts_group)
+cli.add_command(apps_group)
+cli.add_command(commands_meta)
+cli.add_command(config_group)
+cli.add_command(dashboards_group)
+cli.add_command(indexes_group)
+cli.add_command(info)
+cli.add_command(inputs_group)
+cli.add_command(lookups_group)
+cli.add_command(parsers_group)
+cli.add_command(rules_group)
+cli.add_command(search_group)
+cli.add_command(skill_group)
+cli.add_command(users_group)

splunkctl/output.py

@@ -0,0 +1,75 @@
+"""Dual output — TTY gets tables, pipes get JSON."""
+
+import csv
+import io
+import json
+import sys
+from pathlib import Path
+from typing import Any
+
+import click
+from tabulate import tabulate
+
+type Rows = list[dict[str, Any]]
+
+
+def render(
+    ctx: click.Context,
+    data: Rows | dict[str, Any],
+) -> None:
+    """Format and output data according to global flags.
+
+    Args:
+        ctx: Click context carrying format flags.
+        data: Single dict or list of dicts to render.
+    """
+    rows: Rows = [data] if isinstance(data, dict) else list(data)
+    obj: dict[str, Any] = ctx.obj or {}
+
+    fields: str | None = obj.get("fields")
+    if fields:
+        keep = [f.strip() for f in fields.split(",")]
+        rows = [{k: row.get(k) for k in keep} for row in rows]
+
+    fmt: str | None = obj.get("format")
+    use_json: bool = obj.get("json", False)
+
+    if use_json or fmt == "json":
+        text = json.dumps(rows, indent=2, default=str)
+    elif fmt == "jsonl":
+        text = "\n".join(json.dumps(r, default=str) for r in rows)
+    elif fmt == "csv":
+        text = _csv(rows)
+    elif fmt == "table" or sys.stdout.isatty():
+        text = (
+            tabulate(rows, headers="keys", tablefmt="simple") if rows else "No results."
+        )
+    else:
+        text = json.dumps(rows, indent=2, default=str)
+
+    out_path: str | None = obj.get("out")
+    if out_path:
+        Path(out_path).write_text(text + "\n")
+        click.echo(f"Written to {out_path}", err=True)
+    else:
+        click.echo(text)
+
+
+def error(msg: str) -> None:
+    """Print error to stderr."""
+    click.echo(f"Error: {msg}", err=True)
+
+
+def info(msg: str) -> None:
+    """Print info to stderr (keeps stdout clean for piping)."""
+    click.echo(msg, err=True)
+
+
+def _csv(rows: Rows) -> str:
+    if not rows:
+        return ""
+    buf = io.StringIO()
+    writer = csv.DictWriter(buf, fieldnames=list(rows[0].keys()), extrasaction="ignore")
+    writer.writeheader()
+    writer.writerows(rows)
+    return buf.getvalue().rstrip("\n")

splunkctl/skill/SKILL.md

@@ -0,0 +1,325 @@
+# splunkctl — Agent Skill Guide
+
+You are operating a Splunk Enterprise instance via `splunkctl`. This guide
+tells you how to authenticate, run commands, and handle common workflows.
+
+## Auth
+
+Set up credentials once — all commands inherit them automatically.
+
+```bash
+# Interactive (human use):
+splunkctl config init
+
+# Non-interactive (agent use):
+splunkctl config init --host localhost --port 8089 \
+    --username admin --password changeme --scheme https --no-verify
+
+# Verify:
+splunkctl config test
+splunkctl config show                  # secrets redacted
+```
+
+Credentials resolve in order: CLI flags > env vars > config file
+(`~/.splunkctl/config.yaml`). Env vars: `SPLUNK_HOST`, `SPLUNK_PORT`,
+`SPLUNK_USER`, `SPLUNK_PASS`, `SPLUNK_TOKEN`, `SPLUNK_SCHEME`.
+
+Token auth: set `SPLUNK_TOKEN` for service-account access without a password.
+
+## Global flags
+
+| Flag | Purpose |
+|---|---|
+| `--json` | Force JSON output |
+| `--format table\|json\|csv\|jsonl` | Output format |
+| `--fields f1,f2` | Project specific fields |
+| `-o, --out file` | Write output to file |
+| `-y, --yes` | Apply mutations (skip dry-run) |
+| `--timeout N` | Request timeout in seconds (default 30) |
+| `-c, --config path` | Config file path override |
+| `--debug` | HTTP request/response logging |
+
+**Dry-run by default.** Every mutation previews what would change. Only
+`--yes` applies it.
+
+## Output behavior
+
+- **stdout**: data payload only (table, JSON, CSV, JSONL)
+- **stderr**: info messages, errors, dry-run previews
+- **JSON format**: always a JSON array of objects, even for single items
+- **Exit codes**: 0 = success, 1 = error. Dry-run exits 0.
+
+## Commands
+
+### Search
+
+```bash
+splunkctl search run 'index=main error | head 10'
+splunkctl search run 'index=main' --earliest -24h --latest now --limit 50
+splunkctl search run 'index=main' --earliest -7d --app search
+splunkctl search export 'index=main | stats count by sourcetype'
+splunkctl search oneshot '| makeresults count=5 | eval x=random()'
+splunkctl search jobs                    # list recent jobs
+splunkctl search job <sid>               # get job status/results
+splunkctl search cancel <sid> --yes      # cancel a running job
+```
+
+SPL is auto-normalized: bare keywords get `search` prepended; pipe-leading
+and generating commands (`makeresults`, `inputlookup`, `tstats`, etc.) are
+passed through unchanged. Use `--app` to scope searches to a specific app.
+
+### Rules (saved searches)
+
+```bash
+splunkctl rules list
+splunkctl rules get 'My Rule'
+splunkctl rules create --name 'New Rule' --search 'index=main error' \
+    --cron '*/5 * * * *' --actions email --description 'Alert on errors' --yes
+splunkctl rules update 'My Rule' --search 'index=main fail' --yes
+splunkctl rules update 'My Rule' --enabled --yes
+splunkctl rules delete 'My Rule' --yes
+splunkctl rules enable 'My Rule' --yes
+splunkctl rules disable 'My Rule' --yes
+splunkctl rules history 'My Rule'
+```
+
+### Alerts
+
+```bash
+splunkctl alerts list
+splunkctl alerts get 'Alert Name'
+splunkctl alerts actions               # list alert action types
+splunkctl alerts suppress 'Alert Name' --duration 7200 --yes
+```
+
+### Dashboards
+
+```bash
+splunkctl dashboards list
+splunkctl dashboards list --app search
+splunkctl dashboards get my_dashboard
+splunkctl dashboards create --name new_dash --file dash.xml \
+    --app search --label 'My Dashboard' --yes
+splunkctl dashboards update my_dash --file updated.xml --app search --yes
+splunkctl dashboards delete my_dash --app search --yes
+splunkctl dashboards export my_dash --out dash.xml
+```
+
+### Indexes
+
+```bash
+splunkctl indexes list
+splunkctl indexes get main
+splunkctl indexes create --name my_index --yes
+splunkctl indexes create --name metrics_idx --datatype metric \
+    --max-size 500 --frozen-period 604800 --yes
+splunkctl indexes update my_index --max-size 1000 --yes
+splunkctl indexes update my_index --frozen-period 2592000 --yes
+splunkctl indexes delete my_index --yes
+splunkctl indexes clean my_index --yes   # remove all events
+splunkctl indexes reload --yes
+```
+
+### Inputs
+
+```bash
+splunkctl inputs list
+splunkctl inputs list --kind monitor
+splunkctl inputs get /var/log/syslog
+splunkctl inputs create --name /var/log/app.log --kind monitor \
+    --index main --sourcetype syslog --yes
+splunkctl inputs update /var/log/app.log --sourcetype json --yes
+splunkctl inputs update /var/log/app.log --disabled --yes
+splunkctl inputs delete /var/log/app.log --yes
+splunkctl inputs enable /var/log/app.log --yes
+splunkctl inputs disable /var/log/app.log --yes
+```
+
+### Lookups
+
+```bash
+splunkctl lookups list
+splunkctl lookups list --app Splunk_Security_Essentials
+splunkctl lookups get my_lookup.csv
+splunkctl lookups upload my_lookup.csv --file data.csv --app search --yes
+splunkctl lookups update my_lookup.csv --file updated.csv --app search --yes
+splunkctl lookups download my_lookup.csv --app search
+splunkctl lookups download my_lookup.csv --app search --out local.csv
+splunkctl lookups delete my_lookup.csv --app search --yes
+```
+
+### Parsers (sourcetypes & extractions)
+
+```bash
+splunkctl parsers sourcetypes           # list all sourcetypes
+splunkctl parsers get syslog            # get sourcetype config
+splunkctl parsers extractions           # list field extractions
+splunkctl parsers create --sourcetype mysource --category Custom --yes
+splunkctl parsers create --sourcetype mysource \
+    --category Custom --transforms my_extraction --yes
+splunkctl parsers update mysource --category Operating_System --yes
+splunkctl parsers delete mysource --yes
+```
+
+### Apps
+
+```bash
+splunkctl apps list
+splunkctl apps get SplunkForwarder
+splunkctl apps install --name my_app --path /path/to/app.tar.gz --yes
+splunkctl apps uninstall my_app --yes
+splunkctl apps update my_app --enabled --visible --yes
+splunkctl apps update my_app --disabled --hidden --yes
+splunkctl apps reload --yes
+```
+
+Note: `apps install --path` refers to the package path on the Splunk server
+filesystem.
+
+### Users
+
+```bash
+splunkctl users list
+splunkctl users get admin
+splunkctl users roles                   # list all roles
+splunkctl users create --name newuser --password 'pass' \
+    --roles user --email user@example.com --yes
+splunkctl users update newuser --roles 'user,power' --yes
+splunkctl users delete newuser --yes
+```
+
+### Config
+
+```bash
+splunkctl config init                   # interactive setup
+splunkctl config init --host h --port 8089 --username u --password p
+splunkctl config show                   # display config (redacted)
+splunkctl config test                   # verify connectivity
+```
+
+### Info & version
+
+```bash
+splunkctl info                          # server info
+splunkctl --version                     # CLI version
+```
+
+### Agent discovery
+
+```bash
+splunkctl commands                      # JSON command tree
+splunkctl skill                         # print this guide
+splunkctl skill install                 # install to ~/.claude/skills/
+```
+
+## Workflow patterns
+
+### Investigate an alert
+
+```bash
+splunkctl alerts list
+splunkctl rules get 'Alert Rule Name'
+splunkctl search run 'index=main error' --earliest -7d --limit 1000
+```
+
+### Audit detection coverage
+
+```bash
+splunkctl rules list --json | jq '[.[] | select(.is_scheduled == "1")]'
+splunkctl rules list --json | jq '[.[] | select(.disabled == "1")]'
+```
+
+### Detection rule lifecycle
+
+```bash
+# Create, test, enable:
+splunkctl rules create --name 'Failed Logins' \
+    --search 'index=main sourcetype=auth action=failure | stats count by user' \
+    --cron '*/15 * * * *' --actions email --yes
+splunkctl search run 'index=main sourcetype=auth action=failure | stats count by user'
+splunkctl rules enable 'Failed Logins' --yes
+splunkctl rules history 'Failed Logins'
+```
+
+### Export a dashboard for version control
+
+```bash
+splunkctl dashboards export my_dashboard --out dashboards/my_dashboard.xml
+```
+
+### Bulk lookup update
+
+```bash
+splunkctl lookups download hosts.csv --app search --out hosts.csv
+# Edit hosts.csv locally...
+splunkctl lookups update hosts.csv --file hosts.csv --app search --yes
+```
+
+### Check index health
+
+```bash
+splunkctl indexes list --json \
+    | jq '.[] | {name, totalEventCount, currentDBSizeMB}'
+```
+
+### User and role audit
+
+```bash
+splunkctl users list --json | jq '.[] | {name, roles, email}'
+splunkctl users roles --json | jq '.[] | {name, capabilities}'
+```
+
+### Discover data sources
+
+```bash
+splunkctl search oneshot '| metadata type=sourcetypes index=*' --limit 500
+splunkctl search oneshot '| metadata type=sources index=main' --limit 100
+```
+
+## SPL tips
+
+| Pattern | Example |
+|---|---|
+| Time range | `--earliest -24h --latest now` |
+| Stats | `index=main \| stats count by sourcetype` |
+| Table | `index=main \| table _time host source message` |
+| Dedup | `index=main \| dedup host` |
+| Where | `index=main \| where count > 10` |
+| Eval | `index=main \| eval dur=end-start` |
+| Timechart | `index=main \| timechart span=1h count by source` |
+| Lookup | `\| inputlookup my_lookup.csv` |
+| Generate | `\| makeresults count=10 \| eval x=random()` |
+| REST | `\| rest /services/server/info` |
+| Metadata | `\| metadata type=sources index=main` |
+| Tstats | `\| tstats count where index=main by sourcetype` |
+| Rex | `\| rex field=_raw "code=(?<code>\d+)"` |
+
+## Error handling
+
+- **Connection errors**: run `splunkctl config test` to verify auth
+- **Timeout**: increase with `--timeout 120`
+- **SSL errors**: SSL verification is off by default. Use `--verify` during
+  `config init` to enable certificate validation for production.
+- **Not found**: commands print `Error: ...` to stderr and exit 1
+- **Dry-run block**: add `--yes` to apply mutations
+- **Permission denied**: check user roles with `splunkctl users get <name>`
+- **Debug**: add `--debug` to see full HTTP request/response logs
+
+## Output piping
+
+```bash
+# JSON to jq
+splunkctl rules list --json | jq '.[] | .name'
+
+# CSV to file
+splunkctl indexes list --format csv --out indexes.csv
+
+# JSONL for streaming
+splunkctl search export 'index=main' --format jsonl > events.jsonl
+
+# Field projection
+splunkctl users list --fields name,roles
+
+# Alternate config
+splunkctl -c /path/to/other.yaml config test
+```

splunkctl-0.1.0.dist-info/METADATA

@@ -0,0 +1,118 @@
+Metadata-Version: 2.4
+Name: splunkctl
+Version: 0.1.0
+Summary: CLI tool for Splunk Enterprise SIEM operations.
+Author: dannyota
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/dannyota/splunkctl
+Project-URL: Repository, https://github.com/dannyota/splunkctl
+Project-URL: Issues, https://github.com/dannyota/splunkctl/issues
+Keywords: splunk,siem,security,cli,detection,spl
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.13
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: splunk-sdk>=2.1.0
+Requires-Dist: click>=8.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: tabulate>=0.9
+Dynamic: license-file
+
+# splunkctl
+
+CLI tool for Splunk Enterprise SIEM operations.
+
+Query, inspect, and manage a Splunk Enterprise instance from the terminal.
+Built on the [splunk-sdk-python](https://github.com/dannyota/splunk-sdk-python)
+fork with [Click](https://click.palletsprojects.com/).
+
+## Install
+
+```bash
+pip install splunkctl
+```
+
+Requires Python 3.13+.
+
+## Quick start
+
+```bash
+splunkctl config init                         # interactive setup
+splunkctl config test                         # verify connectivity
+splunkctl search run 'index=main | head 10'   # run a search
+splunkctl rules list                          # list detection rules
+splunkctl dashboards list                     # list dashboards
+```
+
+## Commands
+
+| Group | Description |
+|---|---|
+| `config` | Setup, show config, test connectivity |
+| `info` | Server info (version, OS, license) |
+| `search` | Run, export, oneshot, job management |
+| `rules` | Detection rules (saved searches) — full CRUD |
+| `alerts` | Fired alerts, alert actions, suppression |
+| `dashboards` | Dashboard CRUD (XML) |
+| `indexes` | Index management |
+| `inputs` | Data inputs (monitor, tcp, udp, script, http) |
+| `lookups` | Lookup table CRUD (CSV) |
+| `parsers` | Source types and field extractions |
+| `apps` | App install, uninstall, update |
+| `users` | User and role management |
+| `commands` | Machine-readable command tree (JSON) |
+| `skill` | Embedded agent operating guide |
+
+## Global flags
+
+```
+--json              Force JSON output
+--format FMT        Output format: table, json, csv, jsonl
+--fields f1,f2      Project specific fields
+--out FILE          Write output to file
+--yes / -y          Apply mutations (skip dry-run preview)
+--timeout N         Request timeout in seconds (default 30)
+--config FILE       Config file path
+--debug             HTTP request/response logging
+```
+
+## Dry-run by default
+
+All write operations preview what would change. Pass `--yes` to apply.
+
+```bash
+splunkctl rules delete 'My Rule'          # shows preview only
+splunkctl rules delete 'My Rule' --yes    # actually deletes
+```
+
+## Output formats
+
+```bash
+splunkctl rules list                      # table (TTY) or JSON (pipe)
+splunkctl rules list --json               # force JSON
+splunkctl rules list --format csv         # CSV
+splunkctl rules list --fields name,cron   # project fields
+splunkctl rules list --out rules.json     # write to file
+```
+
+## Agent integration
+
+splunkctl ships with an embedded operating guide for AI agents
+(Claude Code, etc.):
+
+```bash
+splunkctl skill                           # print the guide
+splunkctl skill install                   # install to ~/.claude/skills/
+splunkctl commands                        # JSON command tree for discovery
+```
+
+## License
+
+Apache-2.0

splunkctl-0.1.0.dist-info/RECORD

@@ -0,0 +1,29 @@
+splunkctl/__init__.py,sha256=jaQAmH6F2QEzLK6CKTTeLVFm_ItSvm0-XYBdWs_z44k,77
+splunkctl/__main__.py,sha256=BFgY3u1UOfyuBe8JM6zFQz0AIfY9YA2ooWnX9keF1Vs,85
+splunkctl/client.py,sha256=XwZ51yZI17wJKVyytdYMRGU_2W5O9tT7Av6BPrcO0zA,3121
+splunkctl/config.py,sha256=bYkgERBS-iTWoR2NJB5LdOlBB4PJW5amXj4u-h6UjP4,2251
+splunkctl/guard.py,sha256=5F6QBx4yPpvR1Cb4BkhtkCZFDC1tPtMFrwaRespiiWo,595
+splunkctl/main.py,sha256=vRUHcBu5UsXfDIkVyKLYByOe-nIAKUDKARKY9Jxfwls,4651
+splunkctl/output.py,sha256=3bPTp1UAEeVrWm8D-N0zxtEB1nb_so1YygHv1iUMPSs,2012
+splunkctl/commands/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+splunkctl/commands/alerts.py,sha256=ScaYrdXXCMRBOG-3T5hFDWgiUBpkj_ajmiicbHSe3AY,2784
+splunkctl/commands/apps.py,sha256=USO02YA2FqqrFeEBEKXmZuG0Mh992-jQSD5LT96mgKU,5052
+splunkctl/commands/commands_meta.py,sha256=lNfWG_R5vcXIyQEC--GiIrmez-yn7F0kFGp4nJGlk6g,2260
+splunkctl/commands/config_cmd.py,sha256=pwudX7vWFDkCHwB0l8qz7rjsNeajkZSAlC9-0IjumYg,2514
+splunkctl/commands/dashboards.py,sha256=_wtypQ9-daQ3blAIiC7QU0KkAxVuEQlum3Nc3vbcawc,6677
+splunkctl/commands/indexes.py,sha256=Tfb5RCPxXN1ziknj5KUqG3un-IbdvGPa7Qb7sw2Gsvo,5532
+splunkctl/commands/info.py,sha256=oOUl37rPKTOSRQa_l3VPXhsu1lqJCAVGHzxtm6unRWA,766
+splunkctl/commands/inputs.py,sha256=EdPT-QcRMfPBR6ocZcC30RdmMFcmOp2IBfSeL-l6raI,5474
+splunkctl/commands/lookups.py,sha256=PDnrFuhAcW45-7J1q2F9Oso1MMQg6AezhR33oUkw_P0,6786
+splunkctl/commands/parsers.py,sha256=CDB6xiWqOObhGaFZsZGanyVhVg93Y0x0ZPDElZgzV-o,5080
+splunkctl/commands/rules.py,sha256=kAuDUnuWmKMOhT4Y-6DgJMavHmk3FAOX5v4Kz2Gz8O4,7523
+splunkctl/commands/search.py,sha256=F-fpx5aNZbOFog3MN_v8GIYka8dkhpVE2qi7URuQIlM,7299
+splunkctl/commands/skill_cmd.py,sha256=AHHyAIQ37-7YE063G4VJt0vEdBeoHpVPNurlZUtFGB0,1286
+splunkctl/commands/users.py,sha256=LnSqzby83_zmoXaJgjWydWcNY1GGm5eeMyN4zF6xYzg,5651
+splunkctl/skill/SKILL.md,sha256=tXwDMQ9K60ZgbGtmMu_tsGMhVNpMcAoea30iZHB9tl8,10148
+splunkctl-0.1.0.dist-info/licenses/LICENSE,sha256=5bLe84fMyhGGYnIjBvpaFTCmsYiTfZg7hII9LgXXtRU,10759
+splunkctl-0.1.0.dist-info/METADATA,sha256=3gUIxZlp9w08K9xguXeItolG0yeXvfgxQxFJc9QI0X0,3732
+splunkctl-0.1.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+splunkctl-0.1.0.dist-info/entry_points.txt,sha256=bmtfsYIWQv5DqX00d4MZEEyZWlmL_qR_uCtj5ZCCCKQ,49
+splunkctl-0.1.0.dist-info/top_level.txt,sha256=xEU2C2YYO7cEc1h7-DOcEsfprA0T_Mvrjr5fW3RKtiQ,10
+splunkctl-0.1.0.dist-info/RECORD,,

splunkctl-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+