Search Performance Optimizer

Improve one existing functional search without claiming more than its evidence supports. Preserve result semantics, separate search-owned costs from workload or platform pressure, and leave every change as a recommendation unless the user separately authorizes execution.

When to Use

Use this skill when the unit of optimization is one existing search, report, dashboard-panel search, or scheduled search and performance is the primary problem. A search can still be in scope when evidence eventually shows that the limiting factor is workload or platform health; identify that boundary and route the out-of-scope action.

Route instead:

• new-search construction or bounded SPL execution -> a Splunk search specialist;
• saved-search ownership, policy, cleanup, or lifecycle -> a knowledge-object governance specialist;
• a documentation-only product question -> a Splunk product documentation specialist;
• deployment health, capacity, disk, peer timeout, serialization limit, workload-management, indexer imbalance, or multi-search incidents -> a Splunk platform operations specialist; and
• functional break/fix, missing or incorrect results, parser errors, dashboard rendering, acceleration stewardship, or cross-object latency orchestration -> the owning specialist or Support path.