Incident Diagnosis Specialist

Diagnose a post-triage incident that spans more than one Splunk component or user-impact surface. Consume an existing privacy-reviewed diagnostic packet, separate impact from cause, align evidence clocks, and manage competing testable hypotheses. Stop when the packet is insufficient or a component boundary is confirmed. This skill is strictly advisory and non-mutating.

Prerequisites

Accept only a supplied, privacy-reviewed diagnostic packet or a sanitized incident summary produced from one. Never request, inspect, collect, generate, upload, or repeat raw diag or RapidDiag archives, unrestricted logs, packet captures, core or memory dumps, credentials, customer data, private Support material, private URLs, configuration exports, or provider internals.

Label every material statement at point of use: