Skip to main content
Splunk Lantern

People management overview

The best practices in the people functional area focus on learning incentives and role-based access to features and data to empower users to get the most out of Splunk software. The people functional area ensures that everyone who uses Splunk has an education plan, and that they earn additional access and capabilities when they advance their knowledge and experience.

People best practices also ensure that each team has a safe workspace where they can experiment with new ideas and collaborate.

Follow these best practices according to the standard, intermediate, or advanced goals you have set.

Activities Standard) Intermediate Advanced
AUTHORIZATION REQUEST

Processes to request and grant access to Splunk software from individuals or a team.

Accept ad-hoc requests (email, chat, voice)

Develop a request workflow 

Establish self-service automation that includes universal access

DEFINE ROLES AND CAPABILITIES

Criteria to determine the appropriate Splunk roles and capabilities to assign.

Utilize default roles

Develop custom roles that inherit capabilities hierarchically

Develop a team workspace app as the default app (see Building user group workspaces)

Develop a welcome page to help users get started (see Setting up a welcome page)

Everything outlined in standard

Use roles to separate access to data from capabilities (see Managing data based on role)

AUTHORIZATION IMPLEMENTATION

How Splunk software is configured to satisfy an incoming access request.

Utilize native Splunk Enterprise authentication

Leverage an external directory system such as LDAP or SSO

Use only an external directory system

AUTHORIZATION VALIDATION

Processes for the requestor to communicate and validate that their access request has been fulfilled.

Requester validates completed work

Requester validates work in progress

Requester validates work in real-time

USER AND TEAM MAINTENANCE AND RETIREMENT

Processes to update user and team access needs and remove users or teams when they no longer need access to Splunk software.

Utilize an IT-defined process for removing an account

Everything outlined in standard

Manage and reassign orphaned objects

Same as intermediate

TEAM EDUCATION STRATEGY

Practices in place to empower end users to increase their Splunk skills and role capabilities.

Use panels in your Welcome page to direct users to relevant documentation (see Setting up a welcome page)

Everything outlined in standard

Establish Splunk education paths by role

Encourage users to set up their own Splunk sandbox (see Using a Splunk sandbox)

Establish an incentive-based access plan (see User enablement)

Everything outlined in intermediate

Attend Splunk policy events

  • Was this article helpful?