Setting roles and responsibilities

Roles best practices for a Splunk deployment

A Splunk implementation team is made up of roles that demonstrate different strengths and skills with Splunk software and within your general business. These roles reflect the business skills needed to fulfill the associated duties, and do not necessarily map directly to the Splunk platform default user roles. One person on your Splunk team can fulfill more than one role. Roles and responsibilities are a good way to manage an incentive-based access model to encourage your user community to build and grow their Splunk software skills.

Audience

Architect
Developer
Engineer
Executive sponsor
Knowledge manager
Program manager
Project manager
User community

Splunk roles and responsibilities

The following table describes the common roles in a Splunk implementation, their general focus, and the recommended minimum level of Splunk education required for that role. A Splunk implementation team member can have a higher level of Splunk software certification than is required for that role.

Splunk role and responsibilities	Required skills	Recommended education requirements
ARCHITECT
Designs and optimizes Splunk platform architecture for large-scale and distributed deployments Establishes best practices and development standards, and ensures that the team adopts them Maintains a close partnership with Splunk on feature requests, upgrade planning, and product roadmap alignment	Experience with interconnected, heterogeneous systems Strong understanding of industry standards and technologies	Splunk Certified Architect
DEVELOPER
Develops and customizes Splunk apps and dashboards Implements integration with external systems Builds advanced visualizations	Basic web design Scripting (such as Python or other)	Splunk Certified Developer
ENGINEER
Implements and maintains Splunk platform infrastructure and configuration Undertakes day-to-day operational and user support Executes new projects as well as data and user onboarding Staffs help desk for Splunk platform system-related assistance	WIN or *nix systems administration Networking background Familiarity with common infrastructure technologies	Splunk Certified Admin
EXECUTIVE SPONSOR
Endorses and provides resources for the Splunk software investment Brokers political alignment at the executive level	Strong business acumen Management experience Considered an 'influencer' at the organization Actively engaged in promoting Splunk software as a solution, service, or strategy	Splunk Certified User
SEARCH EXPERT
Customizes queries Promotes advanced searching, forensics, analytics Effects creative solutions to complex problems Staffs help desk for search-related assistance	Splunk Search Processing Language (SPL) Splunk solution expert knowledge	Splunk Certified Power User
KNOWLEDGE MANAGER
Manages data onboarding and defining configurations Performs data interpretation, classification, and enrichment Builds data models Manages knowledge objects (fields, extractions, tags, event types, lookups, workflow actions, aliases, macros, and so on) Configures summary-based reports and data model acceleration	Experience with basic Splunk Search Processing Language (SPL) Strong understanding of Splunk platform configuration, web UI and Common Information Model Basic understanding of regular expressions	Splunk Certified Power User
PROGRAM MANAGER
Manages the Splunk implementation team Ensures Splunk implementation meets business requirements Provides oversight on projects and cross-departmental initiatives Spearheads communication to stakeholders Facilitates maturity of the Splunk implementation team and user base through education programs	Strong business acumen Management experience Some project management There should be only one program manager	Splunk Certified User
PROJECT MANAGER
Scopes project requirements Manages project timelines Communicates progress and risks to stakeholders Bridges interactions between stakeholders and Splunk implementation team Chief cat herder	Project management expertise Excellent communication skills Detailed knowledge of organizational and business process	Splunk Certified User
USER COMMUNITY
Appreciates the value returned from Splunk analytics and reports Consumes reports, dashboards, alerts, and other use case-related dashboards May also include users who are Splunk Certified Power Users	Varying levels of technical competencies and experience with SPL Can consume dashboards and alerts or write searches if inclined Experience with web browsers	Splunk Certified User

More resources

For information about how to set up roles and capabilities in Splunk Enterprise, see Define roles on the Splunk platform with capabilities in the Securing Splunk Enterprise manual.
For best practices about how to manage roles, access to data, and access to product features in a more modular and scalable way, see the topic Managing data based on role.
For a staffing model template, see Staffing a Splunk deployment.
For the responsibility assignment matrix, see Assigning Responsibilities

Roles best practices for a Splunk deployment

Splunk roles and responsibilities

More resources

Related articles