Splunk® Success Framework

Splunk Success Framework Handbook

Download manual as PDF

Download topic as PDF

Quarterly business review best practices for a Splunk deployment

A Quarterly Business Review (QBR) is a quarterly status meeting for the stakeholders in your Splunk implementation. The purpose of a QBR is to provide updates on the overall plan, goals, and roadmap for your Splunk implementation. QBRs should include an executive dashboard and summaries of key activities and metrics. QBRs and executive dashboards provide your Executive Sponsor an opportunity to regularly engage with Splunk business goals and priorities.

Audience

  • Architect
  • Executive sponsor
  • Search expert
  • Knowledge manager
  • Program manager
  • Project manager
  • User community

For more about these roles, see Roles best practices.

Plan your QBR

Planning a successful QBR requires some networking and outreach. Hosts should include the Splunk owner, architect, and program manager.

Encourage executive involvement
QBRs are most effective when your Executive Sponsor is involved as a key point stakeholder. This ensures visibility into the initiatives, highlights, and challenges associated with your Splunk implementation.
Bring in a diverse audience from different teams
Encourage leaders from all the different teams using Splunk to participate. Bringing in different teams ensures cross-functional review and collaboration, and provides access to diverse data sources for your Splunk correlation.
Involve your Splunk operations team
Consider including stakeholders from your computing and storage infrastructure team. This can drive their engagement in the Splunk infrastructure, help them understand the business criticality of Splunk systems, and foster partnership for upcoming maintenance and scaling plans.

Design a QBR

A common format for a QBR is a presentation using a tool like Microsoft PowerPoint or Google Slides. A QBR presentation is a good opportunity to showcase the talents of your Splunk team, and to encourage the input and participation of key members. A QBR should contain the following information:

Business objectives

  • Splunk project status
  • Use case initiatives
  • Cross-functional Splunk-related activities
  • Key Performance Indicators (KPIs)
  • Deployment overview

License usage

  • Platform performance
  • Capacity planning
  • Service Level Objectives (SLOs)

User enablement updates

  • Number of Splunk users
  • Educational program status

Value realization updates

  • Return on Investment (ROI)
  • Accomplishments

Use case showcase

  • Key success stories
  • Live demos

Risk assessment

  • Challenges and roadblocks
  • Areas of concern

Your QBR should focus on quarterly and annual goals, and avoid tactical details, such as specific platform configurations, issue root cause analysis, or how to build a dashboard. Save implementation details for a Splunk team meeting.

Create an executive dashboard

A Splunk executive dashboard is useful for showing essential Splunk utilization metrics and system health statistics. For example:

Executive Dashboard Example.png

For an example of how one company uses Splunk to populate business-critical dashboards for executive overviews and daily operations, see Keeping Your Medical Center CIO Engaged, a presentation given by a Splunk customer at Splunk .conf2017.

PREVIOUS
Newsletter best practices for a Splunk deployment
  NEXT
Responsibility assignment best practices for a Splunk deployment

This documentation applies to the following versions of Splunk® Success Framework: ssf


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters