Teams with fewer, alert-linked dashboards diagnose incidents faster than teams with many unowned dashboards

Hypothesis

Dashboard count per service and the share of dashboards without an owner are negatively associated with diagnosis speed. When a responder has to choose among dozens of similar dashboards, time goes into finding the right one and reconciling panels that disagree; when the alert links to one dashboard whose panels answer the responder's first questions in order, the responder reaches a probable cause sooner. The mechanism is search and reconciliation cost, not the quality of the underlying data, which is assumed equal. Grafana's dashboard guidance recommends that most dashboards be linked to by alerts and that sprawl be actively reduced, but gives no measurement of the effect; this hypothesis states one.

Prediction

Across teams with comparable services and comparable alert quality, the median time from page to first written probable cause in the incident record is shorter for teams with fewer dashboards per service and a higher share of alerts that carry a dashboard link. Within one team, pruning dashboards to an owned set and adding alert links is followed by a shorter median in the subsequent period, and by fewer incident timelines that mention opening more than three dashboards. No such change is predicted for incidents whose cause lay outside the instrumented system (a provider outage, a DNS change), which serve as a control group.

Proposed test

1. For each service, count dashboards, dashboards with a named owner, and paging alerts with a dashboard link, at a fixed date.
2. From incident records over the following months, extract the timestamps of the page and of the first probable-cause note, and the number of distinct dashboards opened, from chat logs or dashboard access logs.
3. Compare the median diagnosis time across services grouped by dashboard count and link share, controlling for team size, alert volume and incident severity.
4. Where a team prunes its dashboards, compare the periods before and after with the same measures, and separate incidents with internal and external causes.

Status

No result is claimed. Confounders are substantial: teams that prune dashboards may also write better alerts and runbooks, and diagnosis time depends on who was on call. The hypothesis would be weakened if diagnosis time tracked responder experience and not dashboard inventory at all.