Frequently Asked Questions

General

Q: How do I know if a device is being monitored?

Confirm the target exists in inventory, is discovered by Prometheus or the expected ingress path, has fresh telemetry, and is selected by the expected dashboard/search. Inventory alone is not live-health proof.

Q: Who do I contact if an alert seems wrong?

Capture the alert name, labels, query result, time window, dashboard/search link, and current data freshness. Route it to the owning device or observability team based on whether the service signal or telemetry path is wrong.

Grafana

Q: I can't see a dashboard — what do I do?

Confirm access, folder, data source, time range, variables, and whether the device page records a verified dashboard. Some infrastructure dashboards are still coverage gaps.

Q: How do I change the time range on a dashboard?

Use the time picker in the upper-right corner. For incidents, select an absolute range and note the time zone so another responder can reproduce it.

Splunk

Q: My search is returning no results — what should I check?

Check regional instance, index, time range/time zone, field names, source forwarding, ingress health, and unknown_syslog.

Q: How do I find logs for a specific device?

Start with index=<expected_index> earliest=-30m device_name="<device_name>". If device_name is absent, inspect a recent event and use its actual host/device field.

Alerts

Q: How do I silence an alert during maintenance?

Use the approved silence process with the smallest safe label match, owner/reason, and expiry. Never disable a shared rule as a shortcut.

Q: An alert fired but the device seems fine — what now?

Check alert labels, evaluation window, pending duration, current value, and data freshness. Determine whether it is a scrape/visibility alert rather than a service alert before changing the threshold.