Splunk® Center of Excellence

Splunk Center of Excellence Handbook

Download manual as PDF

Download topic as PDF

Program Management and Value Realization

The Program Management and Value Realization service area is concerned with driving your Splunk program and ensuring you realize the full value of your Splunk software investment. Activities in the Program Management and Value Realization service area include general governance, business alignment, collaboration, use cases, and staffing. A program manager generally drives these activities and manages interdependencies among the stakeholders.

Activity matrix for Program Management and Value Realization

Build these activities into your implementation plan according to Good, Better, or Best depending on whether you are implementing Splunk software as a solution, a service, or a strategy.

Activities Good Better Best
CHANGE CONTROL, MAINTENANCE, UPGRADES

Change management systems that include approval, tracking, and communication.

Establish a regular schedule for releasing updated Splunk content and software updates

Establish a communication plan (see In Depth: Communication plan for the Splunk CoE)

Everything achieved in Good

Define a change control board

Utilize Splunk notification web messages

Everything achieved in Better

Implement a source control system (see In depth: Change management for the Splunk CoE)

Establish an executive review board

GOVERNANCE

Practices to share standards and policies and ensure consistency among the Splunk user community.

Establish standards and policies

Establish naming conventions for indexes, apps, and source types (see In depth: Naming convention best practices for the Splunk CoE)

Use roles to separate access to data from capabilities (see In depth: Role separation and data governance)

Establish a program that fosters user development (see In depth: User enablement for the Splunk CoE)

Everything achieved in Good

Publish standards and policies

Everything achieved in Better

Enforce standards and policies

Use Splunk software to monitor for configurations and knowledge objects that do not meet standards

COLLABORATION

Practices to share successes that inspire new ideas across different user communities and expose day-to-day wins to organization management.

Establish an informal or ad hoc community forum

Participate in local Splunk user groups (see user groups)

Attend local Splunk Live events (see Splunk Live)

Follow other Splunk users on Splunk Answers (see answers.splunk.com)

Everything achieved in Good

Establish a central network location where users can save and access Splunk content

Establish a stakeholder register (see In depth: Stakeholder register for the Splunk CoE)

Establish office hours for Splunk subject matter experts to consult with your Splunk user community

Everything achieved in Better

Establish a Splunk community portal (see In Depth: Community portal for the Splunk CoE)

Attend the annual Splunk user conference (see .conf) and take education courses from the pre-conference training sessions, Splunk University (see Splunk University)

Publish a regular Splunk newsletter (see In depth: Newsletter for the Splunk CoE)

Host internal workshops

STAFFING

Practices to maintain staff skills and responsibilities and communicate regularly about responsibilities and assignments.

Establish and maintain a staff list with contact information

Establish Splunk roles and responsibilities on your team (see In depth: Roles and responsibilities for the Splunk CoE)

Everything achieved in Good

Establish a staffing model (see Staffing model for the Splunk CoE)

Everything achieved in Better

Establish a RACI (responsible, accountable, consulted and informed) matrix as part of your staffing model (see RACI Responsibility assignment for the Splunk CoE)

BUSINESS ALIGNMENT

Practices to ensure that your Splunk implementation stays on track with business goals

Align with stakeholders

Establish a stakeholder register (see In depth: Stakeholder register for the Splunk CoE)

Align with departments

Everything achieved in Good

Hold regular stakeholder coordination meetings

Align with business units

Everything achieved in Better

Hold a regular quarterly business review (see In depth: Quarterly business review for the Splunk CoE)

VALUE REALIZATION

Practices to unlock, discover, and demonstrate the value of your Splunk investment.

Demonstrate value to users

Establish a use case registry

Demonstrate value to departments

Everything achieved in Good

Establish metrics (see Metrics for the Splunk CoE)

Publish Splunk use case success stories

Demonstrate value to business units

Everything achieved in Better

Assess and optimize the input from data sources

Establish dashboards that demonstrate use case effectiveness

Establish a log that measures the positive effect of Splunk use cases over time

Establish a showback plan In depth: Showback plan for the Splunk CoE)

PREVIOUS
Platform Management and Support
  NEXT
Use Case and Data Lifecycle

This documentation applies to the following versions of Splunk® Center of Excellence: current


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters