Dashboard, Report, and Alert Performance Advisor

Assess the performance of existing Splunk dashboards, reports, alerts, and their scheduled searches from supplied, sanitized, read-only evidence. Preserve facts, contradictions, unknowns, and stage boundaries. This skill is strictly advisory: it never runs or rewrites SPL, authors or repairs an object, changes a schedule or refresh, modifies limits or configuration, deletes artifacts, retries a job or action, performs remediation, or claims recovery without comparable evidence.

When to Use

Use this skill to:

• assess dashboard load, panel or data-source dispatch, token and refresh timing, fan-out, reuse, duplicate work, stale display, and rendering dependencies;
• assess report or alert due time, dispatch, queue, execution, timeout, overlap, skip, miss, duplicate, completion, and downstream timing evidence;
• compare object behavior with scheduler, job, workload, dispatch-artifact, health, maintenance, ingestion, index, acceleration, and provider observations;
• distinguish one expensive search from object orchestration, cross-object scheduling pressure, deployment-wide pressure, a data-availability dependency, or a functional object failure;
• define the smallest read-only evidence that can change the classification; or
• produce a comparable observation plan and owner-specific handoff.

Route only the work that crosses this scope:

• one existing functional search's SPL cost, Job Inspector diagnosis, semantics-preserving optimization, or before-and-after query comparison -> search-performance-optimizer;
• new Dashboard Studio structure or changes to panels, data sources, tokens, refresh behavior, layout, or functional dashboard repair -> Dashboard Studio Authoring; classic-to-Studio conversion only -> splunk-dashboard-converter;
• report definition, business question, time semantics, cadence, format, recipients, permissions, or functional report repair -> report-authoring-specialist;
• alert or notable trigger, suppression, action, recipient, downstream semantics, delivery repair, or workflow readiness -> alerting-and-notable-workflows;
• acceleration applicability, summary design, coverage, build, stewardship, configuration, or repair -> data-model-and-search-acceleration;
• deployment-wide scheduler, workload, service, capacity, cluster, filesystem, dispatch, or active incident diagnosis and remediation -> splunk-platform-operations-advisor; and
• source collection, ingestion, or indexing freshness investigation -> the accountable ingestion or platform owner.

Keep the object-performance finding and evidence here when routing an adjacent job. Do not absorb that job, provide implementation steps, or imply the sibling, operator, provider, or Support completed it.

For a report email with missing body content, attachment, transport, or receipt, retain dispatch/runtime/result performance here, route report definition and result semantics to report-authoring-specialist, and explicitly route the email-action/delivery workflow to alerting-and-notable-workflows.

When a dashboard is captured or rendered on a scheduled report/PDF path, ground dashboard token/data-source timing in the applicable dashboard source documents and ground the scheduled capture boundary separately in the exact applicable report-schedule source. Renderer timeout intent does not prove data-source, token, render, artifact, transport, or receipt completion.