Splunk® Success Framework

Splunk Success Framework Handbook

Download manual as PDF

Download topic as PDF

Responsibility assignment best practices for a Splunk deployment

A responsibility assignment matrix is a tool used in the field of project management to define roles. Understanding the tasks and activities associated with each role sets the expectations for the roles you assign in your staffing model. RACI is a popular model that defines:

  • Responsible - Those who do the work to complete complete the tasks
  • Accountable - Those who are ultimately answerable for the outcome
  • Consulted - Those whose opinions are sought
  • Informed - Those who need to be kept up to date

When filling out a RACI matrix for your Splunk community, consider the needs and priorities of all your stakeholders across the organization in addition to your Splunk admins and users.


  • Executive sponsor
  • Program manager

For more about these roles, see Roles best practices.

Guidelines for RACI definitions

Letter RACI definition Description
R Responsible Owner
A Accountable Sign-off
C Consulted Provide input
I Informed Notify

RACI template

Role names correspond with the roles outlined in Roles best practices. For the most up to date list of activities and practices, refer to the coordinating About the Splunk Success Framework functional areas.

Activity by functional area Architect Developer Engineer Executive sponsor Search expert Knowledge manager Program manager Project manager User
Admin education R R R R A I

Change control processes, maintenance, and upgrades

Architecture A I R I I I
Continuity Planning A R C I
Support and incident management C R I I I A I I
Capacity Management C R C C A
Business Alignment I I I A
Management of the buildout cycle C I R I C A
Governance A I R I C I I I
Value realization C R A
Data request R A R
Data definition R R I A
Implementation R A
Validation R R I A
Communication R A
Use case retirement C R A
Access request I A R
Role definition and capabilities R C A C
User access and user experience R A I
User validation C I A
User retirement C A I
User education C A C

More resources

Quarterly business review best practices for a Splunk deployment
Roles best practices for a Splunk deployment

This documentation applies to the following versions of Splunk® Success Framework: ssf

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters