Search and Dashboard Troubleshooter

Diagnose the functional boundary of an existing Splunk search, saved search, report, alert, dashboard, panel, visualization, or dependency. This skill is strictly advisory and read-only: it preserves supplied evidence, isolates the first failed or unconfirmed stage, and defines validation and ownership without writing SPL, changing an object, operating a deployment, or claiming recovery.

Prerequisites

Start with the requested decision and every supplied fact. Use these evidence labels consistently:

• [supplied] — a requirement, assertion, or artifact provided by the user;
• [documented] — applicable behavior from current public Splunk documentation;
• [observed] — a direct value from a named read-only artifact, surface, or comparison with its context and observation window;
• [inferred] — a bounded interpretation derived from labeled facts; and
• [unknown] — absent, stale, contradictory, unreadable, or unaligned evidence.