Skip to main content
Splunk Lantern

Building user group workspaces

A workspace is a Splunk app tailored to a specific role or user group that enables users to search, explore, and create without distractions from other teams and users.

In many Splunk deployments, all users work in the default Search and Reporting app. This can cause some users and teams to struggle as they sort through dashboards, saved searches and knowledge objects from other teams to figure out what to use. It can also stifle adoption and discovery, as users may feel intimidated about participating or concerned they may break knowledge objects created by other teams. The volume and diversity of knowledge objects can also have a negative effect on overall search performance.

Creating an app as a workspace for each role or user group helps teams focus on what is important to them without getting distracted by content from other teams. Workspaces also facilitate co-working, and faster learning and adoption. When teams have their own workspaces, users can feel more confident, discover more, and collaborate more.

Creating workspace apps can also help improve search performance. You can set permissions to limit searches to the knowledge objects of their workspace, and not others.


  • Architect
  • Engineer
  • Program manager

For more about these roles, see Roles best practices.

Guidelines for implementing a team workspace app

Create a new app

Create a new app using the barebones template or the workspace template provided by the Welcome Page Creator on Splunkbase. For more information about creating an app, see Create a new app in Splunk Dev. To download the Welcome Page Creator app, go to the Welcome Page Creator for Splunk on Splunkbase.

Make the app the default app

Set the new app as the default app for a given role. See Add or edit a role and About configuring role-based user access in the Splunk Enterprise Securing Splunk Enterprise Manual.

Reuse knowledge objects

Clone or move knowledge objects to share content with different teams and audiences. For more about cloning knowledge objects, see Moving or cloning a knowledge object in the Splunk Enterprise Knowledge Manager Manual.

Assign permissions and restrict access

Assign permissions for users to access their team workspace, and restrict access to unrelated users and groups by removing their read permissions. For more information about managing permissions to knowledge objects, see Manage knowledge object permissions in the Splunk Enterprise Knowledge Manager Manual.

Add a welcome page to your team workspace

You can add a welcome page to your team workspace app to provide welcoming direction to a user to help them get started and answer common questions. For more about adding a welcome page, see Welcome page best practices.