How to get the most from your Splunk professional services engagement

If you’ve commissioned a professional services team, make sure you get the best results in the shortest time by optimizing the engagement process.

Optimizing engagement to ensure best practices

Once you’ve taken the step of commissioning a professional services team to manage your Splunk implementation, it’s definitely to your advantage – from a cost and resources perspective – to optimize the engagement process. Not only will you achieve better results but you’ll do so in the most time-effective way possible.

Brian Schutz is a Senior Splunk Consultant with Conducive and here are some of his top tips maximizing your Splunk professional services engagements.

Make relevant personnel resources available whenever and wherever they’re needed

It sounds simple but you’d be surprised at how often management teams fail to explicitly notify crucial staff members that they should be available and responsive for the duration of the engagement. Naturally, this is critical for large engagements, or when there are complex departmental silos in place.

You’ll probably want to identify a named, dedicated technical systems resource with the authority to make any changes required as part of the engagement process. If you have a formal change management system in place, you’ll need to ensure that requests can be acted upon quickly and expediently along the chain of command. Which brings us to the next point…

Assign a competent and dedicated point-of-contact for the duration of the project

It’s a good idea to task a member of staff with oversight for the project throughout the engagement – and with nothing else! Splunk should be their number-one priority while the professional services team is on site; if their attention is split, the project is at risk.

Your designated point-of-contact can expect to receive a daily status report from your consultant which may contain updates and recommendations. As a rule of thumb, the shorter the project, the tighter the timescales and the more urgent the actions required. If the professional services team is managing the project, you should also receive detailed reports regarding the overall project, as well as individual tasks, responsibilities and risks.

Outline your expectations and set some practical goals

Before professional services start work on your Splunk project, it’s important to have given at least some consideration to what you want from your data. At its simplest level, this would include listing the problems you’re looking to solve and the reasons you feel the data sources are relevant.

With the benefit of a roadmap – however basic – professional services will be able to prioritize your goals, identifying the value in your data, helping to develop carefully customized searches and giving you a head start on your data-mining projects. Your Splunk certified consultant will also fine-tune functionality, often utilizing underused features and recommending searches you may not have thought of, to deliver the business intelligence you need to meet your challenges head-on.

Collate a complete and prioritized list of data sources identified for onboarding

And, just as importantly, provide unfettered access to the person responsible for curating these sources. Have your Splunk hardware in place in good time and make sure you have IT access ready so that minutes and hours don’t get nibbled away waiting for authorization to be granted.

Your Splunk consultant can start making progress from the first minute if all the necessary protocols are in place, including allocated access to the file system and development environment. Check that you’ve set the consultant up with a valid Active Directory account and opened your firewall ports – issues that, if overlooked, can wreck your schedule, especially where strict change management processes are in place.

Check out our technical and tactical checklist for more tips on optimizing your Splunk professional services engagement or browse Conducive case studies for inspiration and get in touch for more information on how we—and Splunk—can transform your business for the better.