Skip to main content
Splunk Lantern

Program management overview

The best practices in the program functional area include business alignment, operations, collaboration, use cases, and staffing, which enable you to realize maximum value from your Splunk deployment. A program manager generally drives these activities and manages interdependencies among the stakeholders.

Follow these best practices according to the standard, intermediate, or advanced goals you have set.

Activities Standard Intermediate Advanced

Change management systems that include approval, tracking, and communication.

Establish a regular schedule for releasing updated Splunk content and software updates

Establish a communication plan (see Communicating with your community )

Everything outlined in standard

Create a change control board

Utilize Splunk notification web messages

Everything outlined in intermediate

Implement a source control system (see Change Management)

Establish an executive review board


Practices to share standards and policies and ensure consistency among the Splunk user community.

Establish standards and policies

Establish naming conventions for indexes, apps, and source types (see Naming conventions)

Use roles to separate access to data from capabilities (see Role-based data management)

Establish a program that fosters user development (see User enablement )

Everything outlined in standard

Publish standards and policies

Everything outlined in intermediate

Enforce standards and policies

Use Splunk software to monitor for configurations and knowledge objects that do not meet standards


Practices to share successes that inspire new ideas across different user communities and expose day-to-day wins to organization management.

Establish an informal or ad hoc community forum

Participate in local Splunk user groups (see user groups)

Attend local Splunk Live events (search for events)

Follow other Splunk users on Splunk Answers (see

Everything outlined in standard

Establish a central network location where users can save and access Splunk content

Establish a stakeholder register (see Managing Stakeholders)

Establish office hours for Splunk subject matter experts to consult with your Splunk user community

Everything outlined in intermediate

Establish a Splunk community portal (see Community portal)

Attend the annual Splunk user conference (see .conf) and take education courses from the pre-conference training sessions, Splunk University (see Splunk University)

Publish a regular Splunk newsletter (see Newsletter)

Host internal workshops


Practices to maintain staff skills and responsibilities and communicate regularly about responsibilities and assignments.

Establish and maintain a staff list with contact information

Establish Splunk roles and responsibilities on your team (see Setting Roles & Responsibilities)

Everything outlined in standard

Establish a staffing model (see Staffing your Splunk deployment)

Everything outlined in intermediate

Establish a RACI (responsible, accountable, consulted and informed) matrix as part of your staffing model (see Assigning Responsibilities)


Practices to ensure that your Splunk implementation stays on track with business goals

Align with stakeholders

Establish a stakeholder register (see Managing Stakeholders)

Align with departments

Everything outlined in standard

Hold regular stakeholder coordination meetings

Align with business units

Everything outlined in intermediate

Hold a regular quarterly business review (see Scheduling Quarterly Business Reviews)


Practices to unlock, discover, and demonstrate the value of your Splunk investment.

Demonstrate value to users

Establish a use case registry

Demonstrate value to departments

Everything outlined in standard

Establish metrics (see Setting Success Metrics )

Publish Splunk use case success stories

Demonstrate value to business units

Everything outlined in intermediate

Assess and optimize the input from data sources

Establish dashboards that demonstrate use case effectiveness

Establish a log that measures the positive effect of Splunk use cases over time

Establish a showback plan (see Showing value)