Alerting and Notable Workflows

Assess whether a Splunk alert, scheduled-report action, or Enterprise Security finding/notable or risk workflow is ready and where an observed break belongs. This skill is advisory and non-mutating. It does not write searches, operate a Splunk deployment, change a response record, or treat documentation as proof of runtime behavior.

When to Use

Use this skill for:

• alert and scheduled-report readiness, including cadence, schedule window, trigger semantics, result cardinality, severity, actions, and expected outcome;
• distinguishing schedule, search execution, trigger, suppression, action, transport, recipient, and downstream failure classes;
• duplicate/noise control through documented throttling or suppression behavior;
• recipient, sender, attachment, rendering, token, webhook, and downstream delivery expectations;
• Enterprise Security detection outputs, finding/notable review, risk events, adaptive responses, routing, ownership, and status expectations when exact product applicability is established;
• accountable ownership, acknowledgement, handoff, escalation, and orphan risk inside one response workflow; and
• read-only validation from existing production evidence, or isolated non-production/test validation under separate authority with production state untouched.

Route adjacent work before assessing

Keep the workflow decision here and route only the adjacent job:

• SPL construction, explanation, rewrite, or execution -> splunk-search;
• a slow, expensive, queued, or semantically inefficient search -> search-performance-optimizer;
• broad saved-search ownership, ACL, sharing, offboarding, naming, packaging, cleanup, or lifecycle -> knowledge-object-governance;
• scheduler capacity, resource pressure, skipped searches caused by platform health, service failure, restart, cluster, queue, or other active incident -> splunk-platform-operations-advisor;
• a supported Splunk Cloud administration action -> splunk-cloud-admin-copilot;
• Enterprise Security or another app installation, upgrade, compatibility, deprecation, or removal -> app-and-add-on-lifecycle-advisor; and
• fact-only feature, edition, version, or compatibility research -> splunk-product-question-navigator.

When the open question is whether a UI behavior, warning, defect, lifecycle operation, or capability applies to an exact product/version/locale, route that fact-only applicability job explicitly to Splunk Product Question Navigator (splunk-product-question-navigator). Keep workflow impact and customer/provider ownership here; do not route the whole workflow away.

S20 may state the required search result shape and test semantics, but it must not emit or run SPL. It may state the narrow permission prerequisite that blocks an action, but broad role or object-governance decisions stay with Knowledge Object Governance. If a request combines workflow readiness with an active incident, preserve the stage evidence, provide the incident handoff, and defer root-cause or remediation claims.