jev-for-splunk
Splunk search command that asks Jev typed questions about events and adds probabilities, choices and scores as fields.
Overview
Jev for Splunk adds a | jev search command that asks TypeSafe Jev typed questions about events and writes the answers as fields. A noul returns a probability, which SPL can sum into an expected count, turning a sentence into a metric; a choice returns one of your options for grouping or joining; a score returns a position on levels you describe for ranking. Several questions can be batched in one request.
The README shows replacing a pile of regexes with one question, for example finding Bash commands run by Claude Code that contain a password or API key in plain text and keeping those above 0.9. Answers are cached in the KV store per model, question and named fields (without event text), so repeated searches only pay for new events. It requires Splunk Enterprise 9.3 or later with the KV store enabled, outbound HTTPS to api.typesafe.ai and a TypeSafe key.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Does the customer say they were overcharged? | — |
| Choice | Which part of the shop is this message about? | pricing · delivery · other |
| Score | How upset is the customer? | Calm question · Annoyed · Angry |
| Yes / no | Does this command contain a password or API key in plain text? | — |
How it works
- Write an SPL search with | jev and a question
- Command sends event fields and questions to Jev
- Answers become fields, cached in the KV store
- Sum, group or rank on the fields in SPL
Strengths
- Natural-language predicates in SPL
- Caching avoids paying twice for the same event
- Probabilities sum to expected counts
Caveats
- Requires Splunk Enterprise 9.3+ and outbound access
- Custom licence
Getting started
Install the app on a Splunk search head with the KV store enabled and configure a TypeSafe API key.At a glance
- Type
- App
- Status
- beta
- Language
- Python
- Runtime
- Splunk app (custom search command)
- Has code
- yes
- License
- Custom license
Use cases and integrations
How curated lists describe it
Splunk app: the | jev search command asks TypeSafe Jev typed questions about your events and adds calibrated probabilities, choices and scores as fields, cached in the KV store.
logicrw/awesome-jev-projects
Frequently asked questions
What does Jev decide?
Any Noul, Choice or Score question you write about Splunk events.
How are costs controlled?
Answers are cached in the KV store, so only new events are judged.
Is event text stored in the cache?
No, the cache keys on model, question and named fields without the event text.
Related projects
Scores OpenTelemetry logs with Jev for diagnostic value, priority and routing before any expensive LLM analysis.
ProjectbetaTypeScriptRust CLI and TUI that streams Kubernetes logs, applies offline rules and Jev analysis to flag what matters, then hands off.
ProjectbetaRustSmart-meter fleet dashboard where code pre-filters telemetry and Jev classifies anomalies for remediation across millions of endpoints.
ProjectprototypeTypeScriptUnix filters (grev, tagv, rank, sortv, cutv, uniqv and more) that select, label and rank lines by meaning with Jev.
CLIbetaGoExample of using Jev as a webhook guardrail inside the agentgateway proxy to inspect model requests and responses.
ProxyproductionRustLarge Claude Code plugin of skills, agents and hooks that can optionally ask Jev to classify a session's work category.
ProjectproductionTypeScript