How Checks Work
How the SCMA check execution framework operates, what data is collected, the available export options, FedRAMP handling, and performance considerations.
Overview
SCMA checks run serially to ensure as little impact as possible on the customer's environment — one check at a time, one search at a time.
Each check is a KPI (Key Performance Indicator) that measures an aspect of the customer's Splunk deployment. The KPIs are automatically compared against the public Splunk Cloud Service Description and internal Sweet Spot documentation to determine cloud-migration fit. They also drive automatic generation of a draft Statement of Work (SOW) for Professional Services.
Execution framework (v5.0+)
As of version 5.0, SCMA replaced the legacy Health Check framework (shipped with the Splunk Monitoring Console) with custom JavaScript and Python scripts. This change has two major benefits:
- 24-hour timeout per search — the default Splunk search timeout is 10 minutes. The new framework runs jobs in the background, extending the timeout to 24 hours. Timeouts have not been observed since this change.
- Resilient to interruptions — checks continue running even if you navigate away from the page or reboot your computer. When you return to the checks page, the run picks up where it left off.
Results storage
Each check is written with a macro at the end that writes search results to the
_introspection index. This is beneficial for environments with intermittent
search issues because:
- Each check can be run days apart and results are still collectable.
-
The export function looks for results in
_introspectionfor the past 30 days and includes only the latest results if checks have been run multiple times. - If checks were run more than 30 days ago, they must be re-run to ensure current data is included.
Export options
The export functions are available in the 4 - Data Export dashboard.
| Option | Output | Description |
|---|---|---|
| Export Results |
{customer_name}-scma_data_export.zip{customer_name}-scma_dsg_detail_gen.csv
|
Collects check results and bundles them into a ZIP archive. Also produces a CSV with selected storage and license ramp volumes. Review the CSV using the SCMA DSG Detail Inspection dashboard. |
| Export Document | {customer_name}-scma_data_export.docx |
Renders the check results as a DOCX file. |
| Copy PS LOE Parameters | JSON array (clipboard) | Parameters used to determine the level of effort to complete a migration to Splunk Cloud. |
| Copy Sizing Parameters | JSON array (clipboard) | Parameters used for environment sizing inside Stack Composer (workload sizing calculator). |
FedRAMP customers
When working with FedRAMP customers, refrain from exporting their data. The SCMA team has implemented a solution that allows data to be reviewed directly on the server where it was collected, eliminating the need for an export.
Steps to review SCMA results from the customer's environment:
- Open the SCMA app on the server where the data was collected.
- From the top SCMA navigation menu, select the Tools dropdown, then choose SCMA Review.
- Ensure the Customer Name and RAW Data options are selected. All SCMA results are available within the familiar dashboard tabs.
- If sharing results, take and email screenshots of the desired data. This ensures compliance while maintaining the integrity of the FedRAMP data.
Never export FedRAMP customer data. Use the in-app SCMA Review dashboard for all result review and sharing via screenshots only.
Why checks can take a long time
The SCMA can complete all checks in a 200 TB+ environment in about 45 minutes — but can also take several hours in a 200 GB environment. The main causes of long runtimes are:
Undersized Monitoring Console
If the MC is a virtual machine, ask the customer to upsize it for 24 hours while checks run, then roll it back after data is collected. If the MC is undersized and cannot be changed, run the checks overnight. Since only one search runs at a time, the impact on the production environment is minimal.
SmartStore / S3-backed indexes
If a customer has _internal, _audit, or
_introspection data stored in S3 via SmartStore and it is not cached
locally, all of that data is retrieved from S3 before it is searched. Running the same
check more than once will appear faster on subsequent runs because the data has been
brought back into cache by the first run. If this is the scenario, you must wait for
the data to return to cache.
TSIDX reduction
TSIDX reduction is a storage-saving methodology that deletes the data structures that make Splunk searches fast. If TSIDX reduction has been applied to internal indexes, searches will complete but will take much longer — and may time out.
Consider restoring TSIDX files by following the steps in Splunk Docs: Reduce tsidx disk usage.
SCMA Health Check items are just Splunk searches. If a customer cannot complete searches in a reasonable amount of time, troubleshoot the issue like any other Splunk search performance problem.
File uploads
Permissions
When uploading data to Splunk in the Export dashboard, the customer uses their Splunk.com credentials to authenticate. As long as they have access to the Support Portal, they will be able to use the file upload features.
Standard upload path
The standard path places data in Splunk internal systems automatically via API calls within the app. When data is uploaded, metadata is added to the file that includes the Account Name of the person who uploaded it.
If a Splunk employee uploads data on a customer's behalf, the Account Name in Splunk's internal systems will be recorded as "Splunk Inc.", not the customer's Account Name.
Alternative / manual upload
Exported data can also be manually uploaded to the Support Portal via the file upload feature:
- In the SCMA App > Data Export dashboard, click Export Options at the lower-right hand corner.
- Click Upload File to be redirected to the Splunk Support Portal (you may need to login).
- In the Support Portal under Select Purpose, select "Cloud Assessment" and submit.
- In the next page, browse or drag the unmodified zipfile downloaded from the SCMA Data Export dashboard and click Upload.
See also the How-To Guides for full Support Portal upload instructions.