Scheduling Inspector ensures your Splunk searches are meeting best practices by investigating your alerts and scheduled searches for common errors when it comes to time spans and ownership. Scheduled Searches can be improperly set to where the time span and schedule differ, leading to either missed alerts and events or wasteful searches that are overtaxing your system with overlapping time spans.
Scheduled Searches can also lose their ‘owner’ and become an Orphaned Search, decreasing visibility and longevity of the environment. Atlas not only identifies these problematic searches but enables easy access for further investigation and automation to quickly remedy the issues, enabling your Admins to quickly tune up their environment and improve Splunk for their mission and users.
Scheduling Inspector Capabilities
Reveals misconfigured Scheduled Searches that are missing data based on its schedule and time range
Illuminates misconfigured Scheduled Searches that are producing overlapping searches on data, possibly wasting system resources
Provides tools to investigate searches further and edit their SPL if necessary
Automation to easily fix any identified search with time range issues
Identifies orphaned searches and provides automation to reassign them to active Splunk owners, or use automation to delete them