Skip to main content
Version: Atlas v4.0

Using Atlas Assessment

Banner

Atlas Assessment​

Atlas Assessment is a powerful tool designed to evaluate the state of your Splunk environment and identify areas for improvement. With Assessment, you gain visibility into your Splunk environment's health and discover how Atlas can enhance it. It's recommended to begin any Atlas install with an assessment to identify improvement areas in your current Splunk deployment and where Atlas can deliver immediate results. Following assessment recommendations can improve Splunk search speeds, increase data stability, reduce costs, and greatly enhance Splunk adoption.

Atlas Assessment Requirements​

  • Atlas Assessments can be performed using the stand-alone Atlas Assessment, available on SplunkBase. This is available for everyone and does not require an Atlas License.

  • For the best results, you should run Atlas Assessment as a Splunk administrator.

  • You should run Atlas Assessment in your production Splunk Enterprise or Splunk Cloud environment.

note

If you are a Splunk Cloud customer, you must install Atlas Assessment using SplunkBase.

Atlas Assessment Features​

  • Automated checks against your Splunk Environment to identify issues that should be reviewed

  • Issue analysis rates the severity of the issues found and indicates where the issue exists

  • Explanations of impact from discovered issues and recommendations for solutions

  • Exportable list of findings and recommendations for consumption and tracking

note

All findings from Assessment are stored locally and no reports or data is shared with external parties.

Assessment Categories​

Atlas Assessment evaluates your Splunk environment across five key categories, each represented by its own panel on the dashboard. Selecting a panel will filter to those checks

  1. Search Performance: Evaluates the health of your search scheduler and identifies issues that could negatively impact Splunk performance
  2. System Performance: Assesses the health of common system performance items
  3. Data Source Integrity: Evaluates aspects of the data sources coming into your environment and how well they are managed
  4. Splunk Adoption: Measures how well your Splunk environment is being adopted by your user community
  5. License Utilization: Checks how your data is being utilized with respect to your license capacity

Running an Assessment​

To run a new assessment:

  1. Click the Run Assessment button in the top right corner of the dashboard.
  2. The assessment will execute a series of searches in the background and evaluate the results.
  3. As the process runs, you'll see a status indicator that allows you to cancel the assessment if needed.
  4. Only one assessment can be executed at a time. You can navigate away from the interface while an assessment is running, and it will continue in the background.
  5. Assessment results are displayed for the most recently executed assessment. To view historical assessments, change the Assessment ID filter on the top left.

Viewing Assessment Results​

The main assessment results table provides a detailed view of all checks performed. For each check, you can see:

  • Category: The assessment category the check belongs to.
  • Status: The result of the check (pass, warning, alert, or informational).
  • Check Name: The specific aspect being evaluated.
  • Value: The current value found in your environment.
  • Description: Details about what was being evaluated in the Splunk environment.
  • Actions: Additional options related to the check.

Assessment results are rated based on best practices set forth by Splunk or recommended by the Atlas platform:

  • Pass (green) ; The check returned values within acceptable thresholds.
  • Warning (yellow) : The check results are trending in a negative direction and should be evaluated.
  • Alert (red) : The check has determined you are outside of recommended thresholds and action should be taken.
  • Informational (blue) : The check provides valuable information about a Splunk configuration or general element.

Exploring Check Details​

Clicking on any check dropdown in the table expands it to reveal additional details, showcasing thresholds, additional details, the time range that the search was executed under, and any Atlas recommendations, which will point out how Atlas can assist with the issue. Users can also select the Columns button above the table to add the row expansion fields to the main view. Columns can be re-sized and re-ordered to the user's choice.

The Actions column contains the following features:

  • Open in Search: Opens the saved search that powers the check. Some Assessment checks leverage base searches so these may not always work as expected.
  • View History: Opens a Splunk search that reports on previous results from this check.

Exporting Assessment Results​

Assessment results can easily be exported into a CSV or Excel format and saved locally. Simply wait until all checks have finished returning results, then click the Export button above the table on the top left. You can export as CSV to get all fields, or Excel to get all visible fields.

tip

If you want to see how the Atlas platform can help you save money, click on the View ROI Calculator button in the top right corner of the interface. This will take the values determined in the environment gathering process, and automatically plug them into the Atlas ROI Calculator.