Skip to main content
 
Splunk Lantern

Program management overview

 

The best practices in the program functional area include business alignment, operations, collaboration, use cases, and staffing, which enable you to realize maximum value from your Splunk deployment. A program manager generally drives these activities and manages interdependencies among the stakeholders.

Follow these best practices according to the standard, intermediate, or advanced goals you have set.

Activities Standard Intermediate Advanced
CHANGE CONTROL, MAINTENANCE, UPGRADES

Change management systems that include approval, tracking, and communication.

Establish a regular schedule for releasing updated Splunk content and software updates

Establish a communication plan (see Establishing and communicating with your Splunk user community)

Everything outlined in standard

Create a change control board

Utilize Splunk notification web messages

Everything outlined in intermediate

Implement a source control system (see Change Management)

Establish an executive review board

COMMUNITY MANAGEMENT

Practices to share standards and policies and ensure consistency among the Splunk user community.

Establish standards and policies

Establish naming conventions for indexes, apps, and source types (see Naming conventions)

Use roles to separate access to data from capabilities (see Managing data based on role)

Establish a program that fosters user development (see Enabling users with incentives)

Everything outlined in standard

Publish standards and policies

Everything outlined in intermediate

Enforce standards and policies

Use Splunk software to monitor for configurations and knowledge objects that do not meet standards

COLLABORATION

Practices to share successes that inspire new ideas across different user communities and expose day-to-day wins to organization management.

Establish an informal or ad hoc community forum

Participate in local Splunk user groups (see user groups)

Attend local Splunk Live events (search for events)

Follow other Splunk users on Splunk Answers (see answers.splunk.com)

Everything outlined in standard

Establish a central network location where users can save and access Splunk content

Establish a stakeholder register (see Managing stakeholders)

Establish office hours for Splunk subject matter experts to consult with your Splunk user community

Everything outlined in intermediate

Establish a Splunk community portal (see Establishing and communicating with your Splunk user community)

Attend the annual Splunk user conference (see .conf) and take education courses from the pre-conference training sessions, Splunk University (see Splunk University)

Publish a regular Splunk newsletter (see Establishing and communicating with your Splunk user community)

Host internal workshops

STAFFING

Practices to maintain staff skills and responsibilities and communicate regularly about responsibilities and assignments.

Establish and maintain a staff list with contact information

Establish Splunk roles and responsibilities on your team (see Setting roles and responsibilities)

Everything outlined in standard

Establish a staffing model (see Staffing a Splunk deployment)

Everything outlined in intermediate

Establish a RACI (responsible, accountable, consulted and informed) matrix as part of your staffing model (see Assigning responsibility for a Splunk deployment)

BUSINESS ALIGNMENT

Practices to ensure that your Splunk implementation stays on track with business goals

Align with stakeholders

Establish a stakeholder register (see Managing stakeholders)

Align with departments

Everything outlined in standard

Hold regular stakeholder coordination meetings

Align with business units

Everything outlined in intermediate

Hold a regular quarterly business review (see Scheduling quarterly business reviews)

VALUE REALIZATION

Practices to unlock, discover, and demonstrate the value of your Splunk investment.

Demonstrate value to users

Establish a use case registry

Demonstrate value to departments

Everything outlined in standard

Establish metrics (see Setting success metrics)

Publish Splunk use case success stories

Demonstrate value to business units

Everything outlined in intermediate

Assess and optimize the input from data sources

Establish dashboards that demonstrate use case effectiveness

Establish a log that measures the positive effect of Splunk use cases over time

Establish a showback plan and value realization cycle (see Showing the value of your Splunk deployment)