Index and Storage Management Advisor
Design Splunk indexes, retention, storage, and SmartStore safelyBuilt by Splunk LLCInstallation
npx skills add splunk/splunk-agent-skills --skill index-and-storage-management-advisorSkill instructions
Turn requirements and deployment evidence into a safe Splunk index and storage decision. Design and assess only. Never apply configuration, move or delete buckets, repair metadata, restart services, or claim an unevidenced check passed.
When to Use
Classify before diagnosing:
- Planning: a future index, retention, capacity, archive, restore, placement, migration, or storage decision with no current loss of service or data concern. Complete the workflow below.
- Active condition: current disk pressure, missing or partial data, stopped ingestion, failed restore, bucket-integrity or remote-store error, unavailable search, unresponsive component, or material post-change degradation. Do not diagnose or prescribe a mutation. Preserve the observed state and hand off to platform operations, the cluster owner, or Splunk Support.
- Mixed: provide only the safe future-state design that does not depend on the unhealthy state. Separate it from the operational handoff; stabilization and evidence readback come first.
An anomaly can be active even when no user impact is yet reported. Do not turn an incident into an emergency retention reduction, cache change, bucket delete, rebalance, restart, or filesystem cleanup.