Program management overview

Change management systems that include approval, tracking, and communication.

Establish a regular schedule for releasing updated Splunk content and software updates

Establish a communication plan (see Establishing and communicating with your Splunk user community)

Everything outlined in standard

Create a change control board

Utilize Splunk notification web messages

Everything outlined in intermediate

Implement a source control system (see Change Management)

Establish an executive review board

Practices to share standards and policies and ensure consistency among the Splunk user community.

Establish standards and policies

Establish naming conventions for indexes, apps, and source types (see Naming conventions)

Use roles to separate access to data from capabilities (see Managing data based on role)

Establish a program that fosters user development (see Enabling users with incentives)

Everything outlined in standard

Publish standards and policies

Everything outlined in intermediate

Enforce standards and policies

Use Splunk software to monitor for configurations and knowledge objects that do not meet standards

Practices to share successes that inspire new ideas across different user communities and expose day-to-day wins to organization management.

Establish an informal or ad hoc community forum

Participate in local Splunk user groups (see user groups)

Attend local Splunk Live events (search for events)

Follow other Splunk users on Splunk Answers (see answers.splunk.com)

Everything outlined in standard

Establish a central network location where users can save and access Splunk content

Establish a stakeholder register (see Managing stakeholders)

Establish office hours for Splunk subject matter experts to consult with your Splunk user community

Everything outlined in intermediate

Establish a Splunk community portal (see Establishing and communicating with your Splunk user community)

Attend the annual Splunk user conference (see .conf) and take education courses from the pre-conference training sessions, Splunk University (see Splunk University)

Publish a regular Splunk newsletter (see Establishing and communicating with your Splunk user community)

Host internal workshops

Practices to maintain staff skills and responsibilities and communicate regularly about responsibilities and assignments.

Establish and maintain a staff list with contact information

Establish Splunk roles and responsibilities on your team (see Setting roles and responsibilities)

Everything outlined in standard

Establish a staffing model (see Staffing a Splunk deployment)

Everything outlined in intermediate

Establish a RACI (responsible, accountable, consulted and informed) matrix as part of your staffing model (see Assigning responsibility for a Splunk deployment)

Practices to ensure that your Splunk implementation stays on track with business goals

Align with stakeholders

Establish a stakeholder register (see Managing stakeholders)

Align with departments

Everything outlined in standard

Hold regular stakeholder coordination meetings

Align with business units

Everything outlined in intermediate

Hold a regular quarterly business review (see Scheduling quarterly business reviews)

Practices to unlock, discover, and demonstrate the value of your Splunk investment.

Demonstrate value to users

Establish a use case registry

Demonstrate value to departments

Everything outlined in standard

Establish metrics (see Setting success metrics)

Publish Splunk use case success stories

Demonstrate value to business units

Everything outlined in intermediate

Assess and optimize the input from data sources

Establish dashboards that demonstrate use case effectiveness

Establish a log that measures the positive effect of Splunk use cases over time

Establish a showback plan and value realization cycle (see Showing the value of your Splunk deployment)