sparklogs-ask
Query SparkLogs logs and device health/state over time to answer what happened on a host or across a fleet. Counts, timelines, disk, CPU, patches, Windows events, other system and application log events, installed software, collection health. Conversational answers from SparkLogs telemetry.
Pinned to revision 4ff800b6b553, so it is the text this page describes rather than whatever the author pushed since.
Files
- skills/sparklogs-ask/SKILL.md
- skills/sparklogs-ask/references/feeds/sparklogs.agent.log/README.md
- skills/sparklogs-ask/references/feeds/sparklogs.agent.log/enums.md
- skills/sparklogs-ask/references/feeds/sparklogs.agent.log/fields.md
- skills/sparklogs-ask/references/feeds/sparklogs.agent.log/reasons.md
- skills/sparklogs-ask/references/feeds/sparklogs.agent.vector/README.md
- skills/sparklogs-ask/references/feeds/sparklogs.agent.vector/enums.md
- skills/sparklogs-ask/references/feeds/sparklogs.agent.vector/fields.md
- skills/sparklogs-ask/references/feeds/sparklogs.agent.vector/reasons.md
- skills/sparklogs-ask/references/feeds/sparklogs.device.state/README.md
- skills/sparklogs-ask/references/feeds/sparklogs.device.state/enums.md
- skills/sparklogs-ask/references/feeds/sparklogs.device.state/fields.md
- skills/sparklogs-ask/references/feeds/sparklogs.device.state/patterns.md
- skills/sparklogs-ask/references/feeds/sparklogs.device.state/reasons.md
- skills/sparklogs-ask/references/feeds/win.defender.eventlog/README.md
- skills/sparklogs-ask/references/feeds/win.defender.eventlog/enums.md
- skills/sparklogs-ask/references/feeds/win.defender.eventlog/fields.md
- skills/sparklogs-ask/references/feeds/win.defender.eventlog/reasons.md
- skills/sparklogs-ask/references/feeds/win.eventlog.application/README.md
- skills/sparklogs-ask/references/feeds/win.eventlog.application/enums.md
- skills/sparklogs-ask/references/feeds/win.eventlog.application/fields.md
- skills/sparklogs-ask/references/feeds/win.eventlog.application/reasons.md
- skills/sparklogs-ask/references/feeds/win.eventlog.apps/README.md
- skills/sparklogs-ask/references/feeds/win.eventlog.apps/enums.md
- skills/sparklogs-ask/references/feeds/win.eventlog.apps/fields.md
- skills/sparklogs-ask/references/feeds/win.eventlog.apps/reasons.md
- skills/sparklogs-ask/references/feeds/win.eventlog.identity_security/README.md
- skills/sparklogs-ask/references/feeds/win.eventlog.identity_security/enums.md
- skills/sparklogs-ask/references/feeds/win.eventlog.identity_security/fields.md
- skills/sparklogs-ask/references/feeds/win.eventlog.identity_security/reasons.md
- skills/sparklogs-ask/references/feeds/win.eventlog.management/README.md
- skills/sparklogs-ask/references/feeds/win.eventlog.management/enums.md
- skills/sparklogs-ask/references/feeds/win.eventlog.management/fields.md
- skills/sparklogs-ask/references/feeds/win.eventlog.management/reasons.md
- skills/sparklogs-ask/references/feeds/win.eventlog.network/README.md
- skills/sparklogs-ask/references/feeds/win.eventlog.network/enums.md
- skills/sparklogs-ask/references/feeds/win.eventlog.network/fields.md
- skills/sparklogs-ask/references/feeds/win.eventlog.network/reasons.md
- skills/sparklogs-ask/references/feeds/win.eventlog.platform/README.md
- skills/sparklogs-ask/references/feeds/win.eventlog.platform/enums.md
- skills/sparklogs-ask/references/feeds/win.eventlog.platform/fields.md
- skills/sparklogs-ask/references/feeds/win.eventlog.platform/reasons.md
- skills/sparklogs-ask/references/feeds/win.eventlog.security/README.md
- skills/sparklogs-ask/references/feeds/win.eventlog.security/enums.md
- skills/sparklogs-ask/references/feeds/win.eventlog.security/fields.md
- skills/sparklogs-ask/references/feeds/win.eventlog.security/mapping-ecs.md
- skills/sparklogs-ask/references/feeds/win.eventlog.security/mapping-ocsf.md
- skills/sparklogs-ask/references/feeds/win.eventlog.security/patterns.md
- skills/sparklogs-ask/references/feeds/win.eventlog.security/reasons.md
- skills/sparklogs-ask/references/feeds/win.eventlog.security/recipes.md
- skills/sparklogs-ask/references/feeds/win.eventlog.setup/README.md
- skills/sparklogs-ask/references/feeds/win.eventlog.setup/enums.md
- skills/sparklogs-ask/references/feeds/win.eventlog.setup/fields.md
- skills/sparklogs-ask/references/feeds/win.eventlog.setup/reasons.md
- skills/sparklogs-ask/references/feeds/win.eventlog.storage/README.md
- skills/sparklogs-ask/references/feeds/win.eventlog.storage/enums.md
- skills/sparklogs-ask/references/feeds/win.eventlog.storage/fields.md
- skills/sparklogs-ask/references/feeds/win.eventlog.storage/reasons.md
- skills/sparklogs-ask/references/feeds/win.eventlog.system/README.md
- skills/sparklogs-ask/references/feeds/win.eventlog.system/enums.md
- skills/sparklogs-ask/references/feeds/win.eventlog.system/fields.md
- skills/sparklogs-ask/references/feeds/win.eventlog.system/reasons.md
- skills/sparklogs-ask/references/feeds/win.servicing.cbs/README.md
- skills/sparklogs-ask/references/feeds/win.servicing.cbs/enums.md
- skills/sparklogs-ask/references/feeds/win.servicing.cbs/fields.md
- skills/sparklogs-ask/references/feeds/win.servicing.cbs/reasons.md
- skills/sparklogs-ask/references/feeds/win.servicing.dism/README.md
- skills/sparklogs-ask/references/feeds/win.servicing.dism/enums.md
- skills/sparklogs-ask/references/feeds/win.servicing.dism/fields.md
- skills/sparklogs-ask/references/feeds/win.servicing.dism/reasons.md
- skills/sparklogs-ask/references/fields/INDEX.md
- skills/sparklogs-ask/references/fields/family-event.md
- skills/sparklogs-ask/references/fields/family-sparklogs-actor.md
- skills/sparklogs-ask/references/fields/family-sparklogs-capture.md
- skills/sparklogs-ask/references/fields/family-sparklogs-config-change.md
- skills/sparklogs-ask/references/fields/family-sparklogs-data.md
- skills/sparklogs-ask/references/fields/family-sparklogs-delta.md
- skills/sparklogs-ask/references/fields/family-sparklogs-destination.md
- skills/sparklogs-ask/references/fields/family-sparklogs-episode.md
- skills/sparklogs-ask/references/fields/family-sparklogs-epoch.md
- skills/sparklogs-ask/references/fields/family-sparklogs-inventory.md
- skills/sparklogs-ask/references/fields/family-sparklogs-member.md
- skills/sparklogs-ask/references/fields/family-sparklogs-occurrence.md
- skills/sparklogs-ask/references/fields/family-sparklogs-origin.md
- skills/sparklogs-ask/references/fields/family-sparklogs-process.md
- skills/sparklogs-ask/references/fields/family-sparklogs-result.md
- skills/sparklogs-ask/references/fields/family-sparklogs-running-as.md
- skills/sparklogs-ask/references/fields/family-sparklogs-target.md
- skills/sparklogs-ask/references/fields/family-sparklogs.md
- skills/sparklogs-ask/references/fields/topic-agent-overhead.md
- skills/sparklogs-ask/references/fields/topic-agent-pipeline.md
- skills/sparklogs-ask/references/fields/topic-collector-health.md
- skills/sparklogs-ask/references/fields/topic-crash-dump-config.md
- skills/sparklogs-ask/references/fields/topic-crashes.md
- skills/sparklogs-ask/references/fields/topic-disk-volumes.md
- skills/sparklogs-ask/references/fields/topic-drivers.md
- skills/sparklogs-ask/references/fields/topic-feed-health.md
- skills/sparklogs-ask/references/fields/topic-installed-products-summary.md
- skills/sparklogs-ask/references/fields/topic-installed-products.md
- skills/sparklogs-ask/references/fields/topic-performance.md
- skills/sparklogs-ask/references/fields/topic-processes.md
- skills/sparklogs-ask/references/fields/topic-services.md
- skills/sparklogs-ask/references/fields/topic-storage-device-io.md
- skills/sparklogs-ask/references/fields/topic-storage-devices.md
- skills/sparklogs-ask/references/fields/topic-storage-io.md
- skills/sparklogs-ask/references/fields/topic-system-info.md
- skills/sparklogs-ask/references/fields/topic-top-processes.md
- skills/sparklogs-ask/references/fields/topic-volume-map.md
- skills/sparklogs-ask/references/fields/topic-vss-shadowstorage.md
- skills/sparklogs-ask/references/fields/topic-vss-writers.md
- skills/sparklogs-ask/references/fields/topic-windows-update-agent-state.md
- skills/sparklogs-ask/references/guides/app-vocabulary.md
- skills/sparklogs-ask/references/guides/category-classes.md
- skills/sparklogs-ask/references/guides/common-mistakes.md
- skills/sparklogs-ask/references/guides/device-state-fields.md
- skills/sparklogs-ask/references/guides/generated-reference-router.md
- skills/sparklogs-ask/references/guides/lql-reference.md
- skills/sparklogs-ask/references/guides/mcp-tool-decision-tree.md
- skills/sparklogs-ask/references/guides/msp-tool-registry.md
- skills/sparklogs-ask/references/guides/names.md
- skills/sparklogs-ask/references/guides/off-endpoint-causes.md
- skills/sparklogs-ask/references/guides/reference-navigation.md
- skills/sparklogs-ask/references/guides/scope-ladder.md
- skills/sparklogs-ask/references/guides/scope-resolution.md
- skills/sparklogs-ask/references/guides/service-taxonomy.md
- skills/sparklogs-ask/references/guides/stream-kinds.md
- skills/sparklogs-ask/references/guides/stream-kinds/collector-debug.md
- skills/sparklogs-ask/references/guides/stream-kinds/device-state.md
- skills/sparklogs-ask/references/guides/stream-kinds/file-log.md
- skills/sparklogs-ask/references/guides/stream-kinds/wel-classic.md
- skills/sparklogs-ask/references/guides/stream-kinds/wel-defender.md
- skills/sparklogs-ask/references/guides/stream-kinds/wel-security.md
- skills/sparklogs-ask/references/guides/stream-kinds/wel-setup.md
- skills/sparklogs-ask/references/guides/subagent-definitions.md
- skills/sparklogs-ask/references/guides/writing-voice.md
- skills/sparklogs-ask/references/playbooks/backup-failure.md
- skills/sparklogs-ask/references/playbooks/bitlocker-recovery.md
- skills/sparklogs-ask/references/playbooks/certificate-expiry.md
- skills/sparklogs-ask/references/playbooks/directory-replication-failure.md
- skills/sparklogs-ask/references/playbooks/disk-full-or-filling.md
- skills/sparklogs-ask/references/playbooks/memory-or-handle-leak.md
- skills/sparklogs-ask/references/playbooks/playbooks.md
- skills/sparklogs-ask/references/playbooks/raid-or-storage-degraded.md
- skills/sparklogs-ask/references/playbooks/rmm-connectivity.md
- skills/sparklogs-ask/references/playbooks/slow-logon.md
- skills/sparklogs-ask/references/playbooks/windows-update-failure.md
- skills/sparklogs-ask/references/playbooks/windows-vss.md
- skills/sparklogs-ask/references/themes/device-health-and-state.md
- skills/sparklogs-ask/references/themes/endpoint-protection.md
- skills/sparklogs-ask/references/themes/windows-operational-events.md
- skills/sparklogs-ask/references/themes/windows-security-and-audit.md
- skills/sparklogs-ask/references/themes/windows-updates-and-patching.md
Every link opens the file at its source, pinned to the revision this page describes.