About the Splunk Center of Excellence
The Splunk Center of Excellence (CoE) is a framework of processes and best practices designed to help you accelerate and increase the value you derive from the Splunk platform. You can use the Splunk CoE framework as a guideline for establishing a Splunk team with governance practices tailored to your organization's needs.
The CoE handbook provides reference materials, templates, and expert guidance for every aspect of your Splunk software implementation from data onboarding and platform management to standards for user education.
The CoE framework starts with establishing a foundation, then builds in service areas that define standards for your Splunk platform, your Splunk program, your Splunk data life cycle, and your Splunk users.
Foundations are decisions, agreements, and operating infrastructure that establish the purpose, goals, and ownership of your Splunk implementation. The CoE lays out four foundations:
- A charter states the business objectives of your Splunk implementation.
- Executive sponsor
- An executive sponsor is the business leader(s) accountable for the success of your Splunk implementation.
- Metrics are the benchmarks you set for measuring the success of your Splunk implementation.
- Operating model
- An operating model lays out the standard practices and procedures for your Splunk implementation.
The four foundations set expectations with stakeholders and ensure that your Splunk implementation can grow and expand as your needs grow and expand.
Service areas are groups of activities and best practices that have a common focus or goal. The CoE is organized into four service areas:
- Platform Management and Support
- Activities that support a healthy Splunk platform
- Program Management and Value Realization
- Activities that support a strong Splunk program that yields maximum return on investment
- Use Case and Data Lifecycle
- Activities that support effective use cases and generate useful insights from your data
- User and Team Lifecycle
- Practices that support a healthy Splunk implementation team who can get up and running with Splunk quickly
Activities and implementation options
Each service area lays out a series of activities. Activities are suggested things to do that lead to a successful Splunk implementation. Every activity offers three implementation options, Good, Better, and Best, which enable you to build an implementation plan that best matches your priorities, needs, and goals.
- Splunk software as a solution - Use Splunk software to address use cases for a single team, group, or purpose.
- Splunk software as a service - Use your Splunk implementation team to provide Splunk-related services for multiple teams, groups, and purposes.
- Splunk software as a strategy - Use your Splunk implementation team to provide mature services that position Splunk as a competitive differentiator for your business.
For details about the service areas and their supporting activities, see Activities and service areas for the Splunk CoE.
How to use the Splunk CoE handbook
This documentation applies to the following versions of Splunk® Center of Excellence: current