Search and Dashboard Troubleshooter

Diagnose the functional boundary of an existing Splunk search, saved search, report, alert, dashboard, panel, visualization, or dependency. This skill is strictly advisory and read-only: it preserves supplied evidence, isolates the first failed or unconfirmed stage, and defines validation and ownership without writing SPL, changing an object, operating a deployment, or claiming recovery.

When to Use

Use this skill when an existing search or object is broken, blank, incomplete, missing, wrong, inconsistent, invisible, not running, not triggering, not rendering, or behaves differently by role, app, member, API, schedule, time window, or dashboard context. It performs functional stage isolation for:

• search dispatch, partial or missing results, parser/command errors, time semantics, result shape, and scheduled-versus-interactive differences;
• saved-search, report, alert, dashboard, panel, or visualization existence, revision, namespace, ownership, sharing, visibility, and dependency behavior;
• field, macro, lookup, event-type, tag, data-model, or other knowledge-object dependencies when they explain a functional break;
• dashboard inputs, tokens, base searches, chain/post-process searches, data sources, refresh state, and rendering;
• report dispatch, results, rendering, attachment, schedule, and delivery stages;
• alert dispatch, results, trigger, suppression, action, transport, recipient, downstream, and response-record stages; and
• the functional-versus-performance boundary when symptoms include queueing, timeout, overlap, latency, or resource pressure.

Exact sibling routing

Keep the functional diagnosis here and route only the evidence-backed adjacent job. Use these exact catalog display names, never an internal slug or an invented owner:

• SPL construction, explanation, rewrite, optimization inside a rewrite, or separately authorized execution -> Splunk Search. State the required result contract; never emit replacement SPL.
• Supported classic-to-Dashboard-Studio conversion -> Dashboard Studio Conversion.
• Generic Dashboard Studio panel, data-source, token, input, drilldown, refresh, visualization, layout, or dashboard-definition authoring -> Dashboard Studio Authoring.
• Report business question, definition, time semantics, cadence, format, recipients, permission prerequisites, or acceptance authoring -> Report Authoring Specialist.
• Alert, notable, or detection trigger, suppression, action, recipient, downstream, escalation, or workflow design -> Alerting and Notable Workflows.
• Broad ownership, orphan, ACL, sharing, naming, collision, lifecycle, lookup, packaging, or cross-member object governance -> Knowledge Object Governance.
• Extraction, alias, calculated-field, lookup-semantic, event-type, tag, CIM, normalization implementation, or semantic remediation -> Field Extraction and CIM Mapping.
• One existing functional search that is slow, queued, expensive, timed out, prematurely finalized, or needs Job Inspector/SPL-cost optimization -> Search Performance Optimizer.
• Cross-object dashboard/report/alert latency, queueing, missed or duplicate schedules, dispatch/concurrency pressure, refresh overlap, or panel/data-source fan-out -> Dashboard, Report, and Alert Performance Advisor.

Do not route away the functional diagnosis. A mixed request may retain multiple routes only when each adjacent job is separable and supported by evidence. Wrong or missing results, parser errors, permission failures, absent fields, or rendering defects do not become performance work merely because time or resource language appears in the record.