AI Component Health Advisor¶
Overview¶
The AI Component Health Advisor handles two components in a single advisor with dynamic per-component tool selection:
WLK (Workload Monitoring) — the execution health of Splunk scheduled saved searches: skip rate, error count, execution delay, versioning drift.
MHM (Metric Host Monitoring) — the lag of hosts reporting metric data (the metric-equivalent of DHM), including per-class lagging thresholds.
The same advisor code drives both because the threshold-management surface is structurally identical and the decision-making pattern is the same (read history → compare peers → recommend). At launch the advisor selects only the tools for the component in scope, so a WLK run never sees MHM tools and vice versa.
See The AI Advisors for the shared inspect/act model, the consent-card bridge, and the structured output contract.
When to use it¶
WLK
A WLK entity is RED because the skip rate exceeded its threshold and you want to know if the threshold is realistic for this saved search’s load profile.
An app deployment introduced new scheduled searches with default thresholds and you want them validated after a week.
A saved search’s error count is bursting and you want to inspect peer thresholds across the app.
MHM
A metric host is RED because of excessive lag and you want to check whether the lag is genuinely problematic or the threshold is too tight.
The tenant’s lagging classes (platinum / gold / silver) have stale threshold values and you want them reviewed.
What it reads and writes¶
For WLK, inspect reads the full entity context, the execution history (skip rate, error rate, execution time per day), the breach history, and peer thresholds in the same app. In act mode it can add / update / delete execution-metric thresholds and update the entity’s monitoring state or priority (decommission-gated).
For MHM, inspect reads the entity context, the metric-lag history, the breach history, and the tenant’s lagging-class definitions. In act mode it can update the per-entity metric-lag threshold and the entity’s monitoring state or priority.
Note
The advisor can recommend a lagging-class-level change for MHM but cannot apply one — class-level changes are tenant-level and go through the admin UI or the AI Concierge. For WLK, if the error count is consistently non-zero with no deployment change, the advisor recommends investigating the saved search itself rather than raising the threshold to mask a broken search.
Example — a WLK schedule in error¶
The Component Health Advisor is launched from a WLK entity’s AI Health Advisor tab via the
Launch Workload Health Advisor button. In this example the saved search
DA-ESS-sandbox:...:Threat - UC003 - Disallowed accesses - Rule is RED with
execution_errors_detected — the schedule is failing, not merely slow.
The advisor inspects the entity, reading the execution context, the execution-error history, the execution history, and the breach history via its live tool feed.
It then returns a structured verdict and recommendations — here correctly diagnosing that the search itself is failing and that the fix is to investigate the SPL rather than relax the threshold.
Where to find it¶
The advisor appears as the AI Health Advisor (WLK) tab on WLK entity overviews and as the AI MHM Advisor tab on MHM entity overviews — both run the same backend with the appropriate component selected. It can also be proposed by the AI Assistant as a consent card, and it participates in the nightly automated batch (one batch per component). See AI Agents automation.