Skip to main content
Os artigos do Splunk Lantern estão agora disponíveis em português.
Splunk Lantern

Enabling users with incentives


User enablement is about motivating your users to learn and grow. When you provide an environment of incentive-driven access, you encourage users to explore and implement best practices, which adds value to the whole user community.

Guidelines for enabling users

To maximize user enablement, focus on these main principles:

  • Incentive-driven user access
  • User experience
  • User roles and capabilities

Limit access until users complete education

Users often want to skip the required education. If you provide users with access and the information they need, this leaves them with little incentive to expand their own knowledge. Make sure users are motivated to learn best practices. This means limiting their access until they've completed certification and education. Once users have completed education, they can own and drive their own basic searching, as well as access capabilities for qualified users only. For recommended education requirements, see Setting roles and responsibilities.

Encourage customer-facing groups to explore value-add activities

Empowering users to become capable of manipulating data themselves leads to richer, dynamic insights. This better enables users to answer their own questions and make data-driven decisions.

Guidelines for managing user experience

Give each team their own workspace

Create an app for each team and set this as their default workspace. For more information, see Building user group workspaces

Create a welcome page for each team

Set up a welcome page for each team to improve the user onboarding experience and facilitate easy access to the resources they need. To create welcome pages, download the Welcome Page Creator from Splunkbase. For more information, see Setting up a welcome page.

Hide all other apps

Remove read permissions for apps the user does not need or is not certified to use. As a general best practice, ensure that users are not distracted by other items deployed to the Splunk environment.

Guidelines for managing user roles and capabilities

Split roles and capabilities

Create roles based on data access and roles based on capabilities. This enables you to customize user access many ways without needing to create new roles. For more information about separating roles and access to capabilities, see Managing data based on role.

Limit permissions

Consider limiting permissions for features such as acceleration, scheduled searches, and real-time searches. If necessary, use search limits. Limiting permissions optimizes your search capacity. When granting capabilities, consider whether the feature you are granting access to could impact Splunk performance in a recurring way, such as scheduled searches, report acceleration, or searches that exceed the Splunk timeout limit.