Splunk® Center of Excellence

Splunk Center of Excellence Handbook

Download manual as PDF

Download topic as PDF

In depth: Staffing model for the Splunk CoE

A role is not a person or job description, a role is a collection of responsibilities delegated to existing staff member(s). Think about roles and responsibilities before you think about the individual members on your team. When you approach staffing by role rather than by individual, you can better estimate your staffing needs.


Guidelines for creating a staffing model

Create a resource that identifies who is on your Splunk team and the roles they fulfill. Post it in a place where stakeholders and team members can access it easily. Include contact information, such as an email link and a picture, so people know who to look for and where they are located. Consider this as information you share on your communication portal. For more information about a communication plan, see In Depth: Communication Plan for the Splunk CoE.

As you complete the staffing model, keep in mind that any team member can be assigned to multiple roles. Multiple team members can also fulfill the same role.

This graphic shows an example of how to assign Splunk roles. Team member number one is assigned to the roles program manager, architect, and engineer. Team member number two is assigned to the roles knowledge manager and developer. Team member number three is assigned to the role executive sponsor.

Staffing model template

Team member Program manager Developer Engineer Executive sponsor Search expert Knowledge manager Architect Project manager
Joe Smith x x x
Sally Brown x x x
John Doe x

More resources

In depth: Disaster recovery for the utility tier
In depth: Staffing recommendations for the Splunk CoE

This documentation applies to the following versions of Splunk® Center of Excellence: current

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters