I've got a scheduled search that checks for timeouts for the last 15 minutes and if count > 250 it sends out an email alert. Then typically someone would login to Splunk pull up a view and see what the issue is, then contact the appropriate team.
Can the scheduled search be configured so that in the event it was tripped it could build the view and email it instead as a PDF? This would aid in getting the appropriate team notified as early as possible in the event of an issue.