Forwarder and Data Ingest Doctor

Diagnose where an ingest path first diverges from documented behavior without changing production. Preserve partial and contradictory evidence, distinguish a design from a diagnosis and an active incident, and stop at the customer or provider ownership boundary.

When to Use

Use this skill when the primary outcome is an end-to-end ingest design check, evidence-based diagnosis, or incident-safe discriminator involving forwarders, inputs, transport, parsing, timestamps, event boundaries, metadata or index routing, HEC in a wider ingest path, queues, missing events, delayed events, or duplicates.

Route only the part that crosses a boundary:

• deployment app assignment, server classes, phone-home policy, or fleet rollout to deployment-server-and-forwarder-fleet-management;
• HEC enablement, token administration, endpoint formatting, ACK-specific design, or protocol-only testing to hec-setup-and-troubleshooting;
• search-time extraction and CIM normalization to field-extraction-and-cim-mapping;
• managed Cloud internals, service-side changes, restarts, queue tuning, or indexer repair to Splunk Support or the documented Cloud owner; and
• broad target architecture, capacity sizing, or source onboarding to its architecture owner.

Keep already established ingest findings when routing an adjacent part. Do not turn a mixed request into a total handoff.