> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vortexiq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk on Vortex IQ

> Monitor Splunk health, cost and reliability signals, and catch incidents and runaway spend early.

Monitor Splunk health, cost and reliability signals, and catch incidents and runaway spend early.

[Connect or manage this source](https://app.vortexiq.ai/workbench/settings/sources) · [How connecting works](/integrations/connector-catalogue) · [Create a workflow](https://app.vortexiq.ai/workbench/flows/create?connector=splunk)

<CardGroup cols={5}>
  <Card title="19">
    performance signals
  </Card>

  <Card title="4">
    automated checks
  </Card>

  <Card title="Build your own">
    automated fixes
  </Card>

  <Card title="Ready to build yours">
    workflows
  </Card>

  <Card title="10">
    API operations
  </Card>
</CardGroup>

<Tabs>
  <Tab title="Overview">
    ### What you can achieve

    Capabilities are grouped around merchant outcomes, not API terminology.

    <CardGroup cols={2}>
      <Card title="Protect revenue">
        Find failures, leaks and risks before they cost sales.
      </Card>

      <Card title="Run operations">
        Monitor orders, fulfilment, delivery and settlement.
      </Card>

      <Card title="Customer experience">
        Find storefront, speed, accessibility and journey problems.
      </Card>

      <Card title="Control risk and change">
        Keep tracking, access and change under governed control.
      </Card>
    </CardGroup>

    ### From connection to verified outcome

    The controlled sequence every capability follows. Nothing changes a connected system without the approval step.

    <Steps>
      <Step title="Connect">
        Authorise the source. Scopes are shown before access is granted.
      </Step>

      <Step title="Monitor">
        Watch the signals against your own baselines, not universal defaults.
      </Step>

      <Step title="Detect">
        Run checks and gather evidence specific to your store.
      </Step>

      <Step title="Recommend">
        Explain what happened, why it matters and the proposed action.
      </Step>

      <Step title="Approve">
        You review scope, risk and reversibility before anything changes.
      </Step>

      <Step title="Execute">
        Apply through governed connector operations.
      </Step>

      <Step title="Verify">
        Confirm the intended result and keep the receipt.
      </Step>
    </Steps>

    No changes are made without the configured approval policy. Read-only operations do not modify the connected system; schedules, access scopes, API usage and data handling remain governed by Vortex IQ controls.
  </Tab>

  <Tab title="Monitor (19)">
    ### Monitor performance

    19 performance signals. Open an outcome to see its signals and how each one alerts. Read-only operations do not modify the connected system.

    <AccordionGroup>
      <Accordion title="Run operations (11 signals)">
        | Signal                       | Alert behaviour              | What it tracks                                                                           |
        | ---------------------------- | ---------------------------- | ---------------------------------------------------------------------------------------- |
        | **Alerts Acknowledged**      | Watch only                   | Alerts a responder has acknowledged - distinguishes 'seen' from 'firing-but-ignored'.    |
        | **Alerts Firing**            | Alert band 0 / 1             | Detectors currently in a firing state.                                                   |
        | **Incidents Open**           | Alert band 0 / 3             | Open On-Call incidents not yet resolved.                                                 |
        | **Incidents Resolved (24h)** | Watch only                   | Incidents closed in the trailing 24 hours - throughput of the on-call rotation.          |
        | **Mean Time To Acknowledge** | Alert band 300000 / 1800000  | Average time from incident trigger to first human acknowledgement.                       |
        | **Mean Time To Resolve**     | Alert band 1800000 / 3600000 | Average time from incident trigger to resolution - the headline reliability number.      |
        | **SLA Compliance**           | Merchant rule                | Percentage of SLO targets met across the window.                                         |
        | **Services Degraded**        | Merchant rule                | Services in a degraded (warning) state - early-warning surface before full outage.       |
        | **Services Down**            | Merchant rule                | Services reporting fully down - any non-zero value is an active outage.                  |
        | **Services Healthy**         | Watch only                   | Count of APM services reporting a healthy state.                                         |
        | **Top Alerting Services**    | Merchant rule                | Services ranked by alert volume - concentration on one service is the regression signal. |
      </Accordion>

      <Accordion title="Customer experience (6 signals)">
        | Signal                   | Alert behaviour       | What it tracks                                                                                  |
        | ------------------------ | --------------------- | ----------------------------------------------------------------------------------------------- |
        | **Apdex Score**          | Alert band 0.95 / 0.7 | Application performance index - satisfied/tolerating/frustrated request ratio.                  |
        | **Avg Response Time**    | Alert band 200 / 1000 | Mean APM service response time over the window.                                                 |
        | **Error Rate**           | Alert band 0.5 / 2    | Share of requests returning errors across APM services, from SignalFlow over the chosen window. |
        | **Throughput (req/min)** | Alert band 0 / -10    | Requests per minute across APM services - sustained drops flag capacity or outage.              |
        | **p95 Latency**          | Alert band 200 / 1000 | 95th-percentile service latency - the tail that customers feel.                                 |
        | **p99 Latency**          | Alert band 200 / 1000 | 99th-percentile latency - worst-case experience for the slowest 1%.                             |
      </Accordion>

      <Accordion title="Protect revenue (1 signals)">
        | Signal                              | Alert behaviour | What it tracks                                                                                           |
        | ----------------------------------- | --------------- | -------------------------------------------------------------------------------------------------------- |
        | **Revenue at Risk (services down)** | Merchant rule   | Live \$/min on fire while a commerce-path service is down or degraded - the COO's number, not the SRE's. |
      </Accordion>

      <Accordion title="Control risk and change (1 signals)">
        | Signal              | Alert behaviour | What it tracks                                                                  |
        | ------------------- | --------------- | ------------------------------------------------------------------------------- |
        | **Top Error Types** | Watch only      | Most frequent error classes across services - where to point remediation first. |
      </Accordion>
    </AccordionGroup>
  </Tab>

  <Tab title="Audit (4)">
    ### Audit risks and opportunities

    A fix status appears only where the action, inputs, approval, verification and recovery controls are mapped. Candidate remediations are never executable. Open a check for the detail.

    <AccordionGroup>
      <Accordion title="Error rate above 2%">
        **Severity** critical · **Outcome** Customer experience · **Fix status** Report only

        More than 1 in 50 requests is failing right now. Depending on which endpoints are affected, this can mean pages failing to load, checkout steps failing silently, or background jobs dropping work, and a rate this high is an active problem, not background noise.

        Vortex IQ detects and explains this; resolution is manual, with evidence and recommended steps.

        Reference: `MONITORING-ERROR-001`
      </Accordion>

      <Accordion title="Apdex score below 0.85">
        **Severity** high · **Outcome** Customer experience · **Fix status** Report only

        Apdex below 0.85 means a meaningful share of visits are experiencing the site as slow or frustrating rather than satisfying, using the same industry-standard scoring that tells you when performance complaints are about to start, even before anyone files one.

        Vortex IQ detects and explains this; resolution is manual, with evidence and recommended steps.

        Reference: `MONITORING-APDEX-001`
      </Accordion>

      <Accordion title="Avg response time above 1500ms">
        **Severity** medium · **Outcome** Protect revenue · **Fix status** Report only

        Average response time over 1.5 seconds is well past the point where shoppers notice the delay, and slow response times are a documented driver of higher bounce and lower conversion; this is a revenue issue wearing a performance-metric label.

        Vortex IQ detects and explains this; resolution is manual, with evidence and recommended steps.

        Reference: `MONITORING-PERF-001`
      </Accordion>

      <Accordion title="Throughput dropped > 30% week-over-week">
        **Severity** medium · **Outcome** Run operations · **Fix status** Report only

        Requests handled dropped more than 30% versus the prior week. This can mean genuinely lower traffic (worth knowing on its own) or it can mean the application is silently failing to serve requests it would otherwise handle, two very different problems that look identical in this one number.

        Vortex IQ detects and explains this; resolution is manual, with evidence and recommended steps.

        Reference: `MONITORING-THROUGHPUT-001`
      </Accordion>
    </AccordionGroup>

    #### Build your own automated fixes

    Turn any finding into an automated fix with a Vortex IQ workflow: **over 13,000 read and write operations across more than 200 connectors** are available as building blocks, with approval, verification and rollback on every change.
  </Tab>

  <Tab title="Automate">
    ### Automate approved work

    Vortex IQ is integrated with **8 read** and **2 write** operations across alertmutings, apipublicincidents, apipublicincidentacks, apipublicreportingmetrics, apmservices, detectors on Splunk. Combine them with anything from the **over 13,000 operations across more than 200 connectors** to automate the work in your own words.

    Changes follow your configured approval policy: the target, proposed change, affected records, risk, reversibility and verification plan are shown before execution.

    [Create a workflow](https://app.vortexiq.ai/workbench/flows/create?connector=splunk)

    #### Ready to build your first Splunk workflow

    Pick a trigger, add the operations above as steps, and every step that changes data pauses for your approval. Monitoring and audits are live now and can start any workflow you build.

    <Accordion title="Browse the operations you can build with">
      | Resource                  | Read operations | Write operations |
      | ------------------------- | --------------- | ---------------- |
      | alertmutings              | 1               | 0                |
      | apipublicincidents        | 1               | 0                |
      | apipublicincidentacks     | 0               | 1                |
      | apipublicreportingmetrics | 1               | 0                |
      | apmservices               | 1               | 0                |
      | detectors                 | 1               | 0                |
      | incidents                 | 1               | 0                |
      | organizations             | 1               | 0                |

      Signed-in users see the full catalogue in the workflow builder, filtered to the sources they have connected.
    </Accordion>
  </Tab>
</Tabs>