An architect never assumes data is flowing correctly — they build monitoring for the data pipeline itself. Splunk's Monitoring Console provides health metrics for indexers, search heads, and forwarders. The architect also implements a "data gap" detection system: scheduled searches that alert when an expected log source stops sending data.
A missing firewall feed is not a quiet network — it is a blind spot. The architecture must distinguish between "no events" (log source is silent) and "no alerts" (clean traffic). This is typically implemented as a lookup-based check: expected sourcetypes are compared against actual incoming data, and gaps trigger high-priority alerts.