Back to Splunk Professional Services
SERVICE GROUP: Implementation & Optimization
Key Data Source Onboarding
Ingestion and normalization of logs, events, and metrics from critical systems into Splunk.
Service objective
Ingest and normalize logs, events, and metrics from critical systems into Splunk, ensuring data is structured and ready to deliver immediate value through searches, alerts, and dashboards.
Scope by SKU
| SKU | Focus | SKU code |
|---|---|---|
| Up to 5 sources | Integration and normalization of up to 5 data sources, applying CIM and parsing best practices. | SRV-IMP-ONB005-GL-01 |
| Up to 10 sources | Integration and normalization of up to 10 sources, basic validation dashboards, and parsing optimization. | SRV-IMP-ONB010-GL-01 |
| Up to 20 sources | Integration and normalization of up to 20 sources, technical validation dashboards, data enrichment, and initial correlation. | SRV-IMP-ONB020-GL-01 |
| Additional source | Unit cost per extra source, applicable to any modality. | SRV-IMP-ONBADD-GL-01 |
Deliverables
- Sources integrated and validated within the Splunk environment.
- Normalization compliant with CIM (Common Information Model), where applicable.
- Verification of related data models.
- Documentation of configured inputs, sourcetypes, and tags.
Prerequisites
- Access to data sources and required credentials.
- Active Splunk Enterprise/Cloud license.
- Infrastructure ready for ingestion (forwarders, connectors, etc.).
Service results
- Sources integrated and visible in Splunk in CIM format for immediate analysis.
- Validated data with no parsing errors.
- Technical dashboards to monitor ingestion.
- A solid base to enable use cases and detect relevant events.
Roles involved
- Data / integration technical consultant.
- CIM specialist (as needed).
- Data architect (optional, depending on complexity).
- Client technical lead.
Differentiators
- Use of Splunk Common Information Model (CIM) for standard normalization.
- Optimized integration to reduce unnecessary license consumption.
- Adapted to LATAM connectivity and compliance realities.
- Detailed documentation for maintenance and future scalability.