What are the best practices for Onboarding new machine data to ensure APM KPIs are captured and measured?

[davebo1896]

Often when users want to bring their machine data into Splunk, they just want access to their logs so they don't have to (or are not allowed to) grep through them from the command line.

What are the best practices to drive the data onboarding interview process toward having these users identify the KPI metrics that can be obtained from the data?

[sloshburch · Accepted solution]

I say look at the work we've put into Data onboarding best practices for a Splunk deployment.

Step two may be what you're looking for. The key is to have everyone think about the use case, not just the data.

[davebo1896]

That is very helpful, thank you.

I've been thinking about trying to open up the conversation, moving away from just working through the data sources they are presenting to asking "What business decisions will you be making with this data?" This, in order to prompt more of a conversation about performance indicators and possibly bringing in associated data in order to tell more of a story. Less "This is a log I need to find things in it", More "Here is information that affects the business".
So yes, craft the Use Case, but spin it to get a deeper understanding of possibilities.

[sloshburch]

Yaay - thanks for the feedback!