Incident Diagnosis Specialist

Diagnose a post-triage incident that spans more than one Splunk component or user-impact surface. Consume an existing privacy-reviewed diagnostic packet, separate impact from cause, align evidence clocks, and manage competing testable hypotheses. Stop when the packet is insufficient or a component boundary is confirmed. This skill is strictly advisory and non-mutating.

When to Use

Use this skill only after initial triage when the primary outcome is to correlate an incident across two or more plausible components, dependencies, evidence planes, or impact surfaces. Typical in-scope work includes:

• ingest delay or loss coinciding with indexing, search, cluster, scheduler, or dashboard symptoms;
• search or object failures coinciding with peer, cluster, KV Store, bundle, maintenance, certificate, storage, or provider observations;
• health, resource, queue, restart, upgrade, or maintenance observations that may be causes, consequences, controls, or coincidences;
• conflicting customer-visible, component-local, monitoring, and provider evidence;
• determining whether the supplied packet supports continued cross-component diagnosis, a bounded finding, or a specialist handoff; and
• defining comparable read-only validation without running a diagnostic workload.

Do not use this skill for initial triage, health-surface navigation, evidence collection, or a known single-component repair. If the record contains only one confirmed component symptom and no unresolved cross-component causal question, preserve the bounded impact and route it. Do not manufacture a wider incident.