Establishing and communicating with your Splunk user community
Encouraging collaboration among your Splunk users is a great way to create an internal community that is both engaged and informed. A community forum and portal serves several purposes:
- Exchange ideas and offer support
- Identify common goals and interests
- Build a thriving and growing Splunk community
- Provide space for open collaboration
- Provide a repository for useful documentation
- Share use cases and success stories
What's the difference between a community forum and a community portal?
A community forum provides internal Splunk users a comfortable location to ask questions, share information, and connect with experts. You probably already have a platform that can act as a forum, such as Slack or Microsoft Teams. Many of these platforms also allow for easy storage of useful documentation and links.
A community portal is an internal site where users can get an overview of activities the Splunk community is engaged in and resources they need to be successful with Splunk. There is no prescribed layout for a community portal. Design the community portal in the way that works best for your users on a platform they use regularly. Your community portal can feature Splunk resources, updates, announcements, key processes, user questions and answers, and contact information for submitting requests or feedback.
- ► Click to see how to set up a community portal
-
Start by identifying the needs of your users, then design and create a draft of your portal.
Identify the needs of your users
- Who are your stakeholders? Identify the Splunk user roles in your environment. Refer to Staffing a Splunk deployment and Setting roles and responsibilities.
- What kind of content do they need to see? Consider what stakeholders need to know. For example, an executive sponsor and program manager may want to see a program status, and an expert user or knowledge manager may want to see discussions about how to model data from certain data sources.
- What collaboration medium or application is best? Portal platforms used by thriving Splunk communities include (but are not limited to) Jive Interactive Intranet, Microsoft Sharepoint, and Confluence. Some organizations start out with a central file repository before choosing a platform. It is likely best to utilize your existing platform that users are already familiar with.
Creating a space for Splunk resources
Your community portal should include a section for Splunk resources, with user roles and relevant content for each user type. The example below shows a matrix of relevant content sorted by user role.
Actions to take after your portal is live
- Test it out on some users to make sure your portal meets their needs.
- Assign a team to add fresh content and monitor any questions posted to the forum.
- Create a maintenance schedule for your portal.
How to communicate with your community
A communication plan outlines events and activities your user community should know about, and how you communicate those events. A communication plan is an essential component of a comprehensive Splunk program management plan.
You can use the worksheet here to define what to communicate to your Splunk community and how. For more information about program management, see Program management overview.
Different methods you can communicate updates to your Splunk community include:
- Splunk banner message
- Phone call
- SMS alert
- Dashboard panel
- Ticketing system
- Portal (wiki)
- Newsletter
- ► Click to see how to set up a communications plan
-
Here is an example of the types of activities that you might want to communicate to your Splunk community. Use these as a guideline, and add to and customize this list according to your own Splunk workflow.
Event Communication method Communication audience Communication frequency New use case See the communication options above N/A After implementation Scheduled maintenance Email All user communities 1 week prior to maintenance In-progress maintenance Email All user communities When maintenance begins Completed maintenance Email All user communities Upon completion Outage/ongoing issue Email All user communities Within 1 hour of event awareness Periodic update See Communication options above N/A Quarterly Workshop Meeting invites All user communities 1 month prior to the workshop User/team-created request Email Requester After implementation User/team-modified request Email Requester 1 week prior to starting the user/team modification User/team-removed request Email Requester 1 week prior to removing the user/team Use case in progress Email Requester When implementation begins Use case implemented Email Requester Upon completion Use case removed Email Requester 1 week prior to removing the use case Actions to take after your communication plan is live
Post your communication plan for your community to see. Use your community portal, team wiki, or preferred platform to do this.
Sending a newsletter to your community
A Splunk newsletter is an effective way to reach a broader audience with news and highlights about activities in your Splunk environment. A newsletter offers several benefits:
- Inspires new ideas from your Splunk community
- Demonstrates the value of Splunk to management and other stakeholders
- Complements a Splunk Community Portal to help keep your organization informed and provide outreach (for more information, see Splunk Community Portal)
- Records your Splunk accomplishments and activities
- Shares use cases and success stories
- ► Click to see how to create an effective newsletter
-
Here are some guidelines for putting together a successful Splunk newsletter.
Planning and management
- Think about ways to inform and engage your entire user base. The content should be relevant to all Splunk roles. The newsletter should encourage everyone from basic users to management to participate in the Splunk community.
- Embed statistics from Splunk reports and dashboards.
- Cover events you want to bring to users' attention.
- Budget time in your project schedule to draft content for the newsletter in advance of the planned publication date.
- Think about how often you would like to send out the Splunk newsletter, for example, once a month. If your community is particularly active, you can release more often.
Suggested content
Content you might want to add includes:
- Use case highlights and success stories, with insights gained using Splunk.
- Calendar of events, such as workshops, trainings, or maintenance updates.
- Announcements and important links.
- Platform and user stats that indicate system health or other key metrics related to your Splunk goals.
- Splunk tips and tricks.
Formatting and layout
There is no prescribed layout for a Splunk newsletter. Create a design that works best for your organization. Here are some newsletter layout tips:
- Include a banner that identifies it as your Splunk newsletter. The banner should include:
- Time span of your newsletter (for example, "September 2022" for a monthly format, or "September 30, 2022" for a weekly format published on Fridays).
- Key contacts for your Splunk team.
- Identify the most important information you want your users to see, and make sure it's visible without having to scroll down.
- Make sure that any action required of your users is clearly highlighted at the top.
- Include images to increase engagement. Visualizations from Splunk can be very effective. Pictures of people help to engage everyone in the content and the team's success.