namht-splunk-reportlisted

# namht-splunk-report — per-app Splunk error digest → Slack Pull error/exception counts from Splunk for each app, roll them up into one table, and post it to Slack. **Read-only** on Splunk; **never** stores or prints credentials. (This skill needs network + Splunk/Slack access — unlike the rest of the kit, which is local-only.) ## Inputs — ASK the user for these (they form the query filter) The base Splunk filter is **`index={A} cai_enviroment={B} cai_app={C}`**. Ask the user for each variable; **if a variable is NOT provided, OMIT that clause entirely** (do not guess a value): - **A = `index`** — the Splunk index. - **B = `cai_enviroment`** — the environment (e.g. prod/staging). *(Field name kept verbatim as it is in the user's Splunk schema — do not "correct" the spelling.)* - **C = `cai_app`** — the app. Accept a **list** of apps → one row per app in the table. If `C` is omitted, query without `cai_app` and break it down in `stats` (`by cai_app`) so the table still has per-app rows. - **Time window** — if not provided, default **last 1 day** (`earliest=-24h@m latest=now`). For a **custom** window accept a friendly value and translate it to Splunk: `4h`→`earliest=-4h@m`, `30m`→`-30m@m`, `7d`→`-7d@d`, `today`→`@d`, or an explicit `earliest=.../latest=...` range (epoch or `MM/DD/YYYY:HH:MM:SS`). Always print the range you used. - **Error criteria** — the user gives a **free-form string**; you **interpret it into a valid SPL search fragment**, then **show the p