Splunk® Success Framework

Splunk Success Framework Handbook

Download manual as PDF

Download topic as PDF

Workspace best practices for a Splunk deployment

A workspace is a Splunk app tailored to a specific role or user group that enables users to search, explore, and create without distractions from other teams and users.

In many Splunk deployments, all users work in the default Search and Reporting app. This can cause some users and teams to struggle as they sort through dashboards, saved searches and knowledge objects from other teams to figure out what to use. It can also stifle adoption and discovery, as users may feel intimidated about participating or concerned they may break knowledge objects created by other teams. The volume and diversity of knowledge objects can also have a negative effect on overall search performance.

Creating an app as a workspace for each role or user group helps teams focus on what is important to them without getting distracted by content from other teams. Workspaces also facilitate co-working, and faster learning and adoption. When teams have their own workspaces, users can feel more confident, discover more, and collaborate more.

Creating workspace apps can also help improve search performance. You can set permissions to limit searches to the knowledge objects of their workspace, and not others.

Audience

  • Architect
  • Engineer
  • Program manager

For more about these roles, see Roles best practices.

Guidelines for implementing a team workspace app

Create a new app
Create a new app using the barebones template or the workspace template provided by the Welcome Page Creator on Splunkbase. For more information about creating an app, see Create a new app in Splunk Dev. To download the Welcome Page Creator app, go to the Welcome Page Creator for Splunk on Splunkbase.
Make the app the default app
Set the new app as the default app for a given role. See Add or edit a role and About configuring role-based user access in the Splunk Enterprise Securing Splunk Enterprise Manual.
Reuse knowledge objects
Clone or move knowledge objects to share content with different teams and audiences. For more about cloning knowledge objects, see Moving or cloning a knowledge object in the Splunk Enterprise Knowledge Manager Manual.
Assign permissions and restrict access
Assign permissions for users to access their team workspace, and restrict access to unrelated users and groups by removing their read permissions. For more information about managing permissions to knowledge objects, see Manage knowledge object permissions in the Splunk Enterprise Knowledge Manager Manual.
Add a welcome page to your team workspace
You can add a welcome page to your team workspace app to provide welcoming direction to a user to help them get started and answer common questions. For more about adding a welcome page, see Welcome page best practices.
PREVIOUS
Welcome page best practices for a Splunk deployment
 

This documentation applies to the following versions of Splunk® Success Framework: ssf


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters