Envy Splunk Health

Which security detections can actually fire on your data? Read-only: maps your real field names to CIM data models, names the missing field costing you the most detections, and grades every sourcetype fresh / aging / stale / STOPPED.Built by Robert Ayers

Default Version 0.4.2

August 27, 2026

Compatibility

Splunk Enterprise, Splunk Cloud

Platform Version: 10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1, 9.0

CIM Version: 8.x, 6.x, 5.x

Rating

(0)

Support

Developer Supported

Envy Splunk Health reads your own indexed data and turns "is my data actually arriving?" into a glance. It grades every sourcetype fresh / aging / stale / STOPPED, shows where your license is being spent, and flags low-value volume you can safely trim — no configuration, read-only, on your own data.