Establishing and communicating with your Splunk user community

What's the difference between a community forum and a community portal?

A community forum provides internal Splunk users a comfortable location to ask questions, share information, and connect with experts. You probably already have a platform that can act as a forum, such as Slack or Microsoft Teams. Many of these platforms also allow for easy storage of useful documentation and links.

A community portal is an internal site where users can get an overview of activities the Splunk community is engaged in and resources they need to be successful with Splunk. There is no prescribed layout for a community portal. Design the community portal in the way that works best for your users on a platform they use regularly. Your community portal can feature Splunk resources, updates, announcements, key processes, user questions and answers, and contact information for submitting requests or feedback.

► Click to see how to set up a community portal

Start by identifying the needs of your users, then design and create a draft of your portal.

Identify the needs of your users

• Who are your stakeholders? Identify the Splunk user roles in your environment. Refer to Staffing a Splunk deployment and Setting roles and responsibilities.
• What kind of content do they need to see? Consider what stakeholders need to know. For example, an executive sponsor and program manager may want to see a program status, and an expert user or knowledge manager may want to see discussions about how to model data from certain data sources.
• What collaboration medium or application is best? Portal platforms used by thriving Splunk communities include (but are not limited to) Jive Interactive Intranet, Microsoft Sharepoint, and Confluence. Some organizations start out with a central file repository before choosing a platform. It is likely best to utilize your existing platform that users are already familiar with.

Creating a space for Splunk resources

Your community portal should include a section for Splunk resources, with user roles and relevant content for each user type. The example below shows a matrix of relevant content sorted by user role.

Actions to take after your portal is live

• Test it out on some users to make sure your portal meets their needs.
• Assign a team to add fresh content and monitor any questions posted to the forum.
• Create a maintenance schedule for your portal.

How to communicate with your community

A communication plan outlines events and activities your user community should know about, and how you communicate those events. A communication plan is an essential component of a comprehensive Splunk program management plan.

You can use the worksheet here to define what to communicate to your Splunk community and how. For more information about program management, see Program management overview.

Different methods you can communicate updates to your Splunk community include:

• Splunk banner message
• Email
• Phone call
• SMS alert
• Dashboard panel
• Ticketing system
• Portal (wiki)
• Newsletter

► Click to see how to set up a communications plan

Here is an example of the types of activities that you might want to communicate to your Splunk community. Use these as a guideline, and add to and customize this list according to your own Splunk workflow.

Event	Communication method	Communication audience	Communication frequency
New use case	See the communication options above	N/A	After implementation
Scheduled maintenance	Email	All user communities	1 week prior to maintenance
In-progress maintenance	Email	All user communities	When maintenance begins
Completed maintenance	Email	All user communities	Upon completion
Outage/ongoing issue	Email	All user communities	Within 1 hour of event awareness
Periodic update	See Communication options above	N/A	Quarterly
Workshop	Meeting invites	All user communities	1 month prior to the workshop
User/team-created request	Email	Requester	After implementation
User/team-modified request	Email	Requester	1 week prior to starting the user/team modification
User/team-removed request	Email	Requester	1 week prior to removing the user/team
Use case in progress	Email	Requester	When implementation begins
Use case implemented	Email	Requester	Upon completion
Use case removed	Email	Requester	1 week prior to removing the use case

Actions to take after your communication plan is live

Post your communication plan for your community to see. Use your community portal, team wiki, or preferred platform to do this.

Sending a newsletter to your community

A Splunk newsletter is an effective way to reach a broader audience with news and highlights about activities in your Splunk environment. A newsletter offers several benefits:

• Inspires new ideas from your Splunk community
• Demonstrates the value of Splunk to management and other stakeholders
• Complements a Splunk Community Portal to help keep your organization informed and provide outreach (for more information, see Splunk Community Portal)
• Records your Splunk accomplishments and activities
• Shares use cases and success stories

► Click to see how to create an effective newsletter

Here are some guidelines for putting together a successful Splunk newsletter.

Planning and management

• Think about ways to inform and engage your entire user base. The content should be relevant to all Splunk roles. The newsletter should encourage everyone from basic users to management to participate in the Splunk community.
• Embed statistics from Splunk reports and dashboards.
• Cover events you want to bring to users' attention.
• Budget time in your project schedule to draft content for the newsletter in advance of the planned publication date.
• Think about how often you would like to send out the Splunk newsletter, for example, once a month. If your community is particularly active, you can release more often.

Suggested content

Content you might want to add includes:

• Use case highlights and success stories, with insights gained using Splunk.
• Calendar of events, such as workshops, trainings, or maintenance updates.
• Announcements and important links.
• Platform and user stats that indicate system health or other key metrics related to your Splunk goals.
• Splunk tips and tricks.

Formatting and layout

There is no prescribed layout for a Splunk newsletter. Create a design that works best for your organization. Here are some newsletter layout tips:

• Include a banner that identifies it as your Splunk newsletter. The banner should include:
  • Time span of your newsletter (for example, "September 2022" for a monthly format, or "September 30, 2022" for a weekly format published on Fridays).
  • Key contacts for your Splunk team.
• Identify the most important information you want your users to see, and make sure it's visible without having to scroll down.
• Make sure that any action required of your users is clearly highlighted at the top.
• Include images to increase engagement. Visualizations from Splunk can be very effective. Pictures of people help to engage everyone in the content and the team's success.