https://austad.dev Short notes on Splunk, AI tooling and GitHub. en https://austad.dev/notes/finding-the-delta-in-splunk https://austad.dev/notes/finding-the-delta-in-splunk Tue, 11 Aug 2026 00:00:00 GMT Splunk Comparing a value to its previous event is one of those things I look up every single time. `streamstats` does it in one line, and here is the version I keep in my snippets file. https://austad.dev/notes/make-timestamps-human-readable https://austad.dev/notes/make-timestamps-human-readable Tue, 28 Jul 2026 00:00:00 GMT Splunk Epoch seconds are fine for machines. For a dashboard someone else has to read, format the field once at search time and never think about it again. https://austad.dev/notes/letting-claude-read-my-repo https://austad.dev/notes/letting-claude-read-my-repo Tue, 14 Jul 2026 00:00:00 GMT AI A short CLAUDE.md worth about ten prompts of pasted context — so the agent stops guessing at conventions it could just read. https://austad.dev/notes/practising-scales-with-a-click https://austad.dev/notes/practising-scales-with-a-click Thu, 02 Jul 2026 00:00:00 GMT Music Two months of metronome work condensed into one take — plus the practice log that made it stick. https://austad.dev/notes/actions-cache-that-actually-caches https://austad.dev/notes/actions-cache-that-actually-caches Fri, 19 Jun 2026 00:00:00 GMT GitHub The cache key was wrong, not the action. Here is the fix that took CI from six minutes to ninety seconds. https://austad.dev/notes/lookups-vs-subsearches https://austad.dev/notes/lookups-vs-subsearches Fri, 05 Jun 2026 00:00:00 GMT Splunk When each one is faster, with the row counts that decided it — so I stop reaching for a subsearch out of habit.