Splunk ITSI: Somerford’s approach for delivering business value.

Release Date: 29/06/2020

Author: Paul Winchester


Splunk’s ITSI product is a powerful fully featured tool, leveraging the industry leading power of Splunk, and building on that a Service focused approach to managing IT systems. The Service Intelligence gained allows businesses to progress from reacting to incidents, to proactively preventing them, whilst giving full visibility of all levels of vital IT and Business components.

Such a comprehensive and complex tool requires a well managed delivery framework. This is important to ensure that value is delivered, and key processes are the focus of the project. Somerford has a wealth of experience building effective ITSI solutions, and has refined this into an approach that we refer to as the Glass Table Methodology.

The important differentiator to this and other approaches is that we do not attempt to represent all Services within your organisation in one go. We deliver Services in phases, incrementally providing value to the business, giving results quickly.

We use a prescriptive set of very structured analytics tools and templates to define Services. We know in advance how long each task will take and which stakeholders we need to engage with to collect the information we require. This ensures that the small selection of Services we are focusing on are clearly defined, with a coherent operational approach.

Once we have built the Service structures in ITSI, we start to work on the function elements that will be required to deliver the operational model for that Service. Since all the data and Service content is in place we can refine and fine tune these tools, with a clear understanding of the impact of each change that we make. This allows us to deliver a much more accurate and efficient implementation of ITSI.

1. Initiation

A series of calls, meetings, and demos that take place at the start of the project to set expectations, agree and communicate the schedule, and to ensure that all stakeholders are aware of and ready to discuss the key ITSI concepts.

2. Analysis

At the start of the Analysis Phase we consider all of the candidate services that we might potentially develop, prioritise them using our Scorecard, and select the initial 1-2 services to work on. This is called Service Identification.

At this point, Analysis becomes iterative – we run a series of workshops to ‘decompose’ each of the chosen target services, dependencies, and entities; this is to understand how we are going to implement those services in the ITSI deployment. The objectives of those workshops are clear and according to our prescribed templates; the workshops drive the design and it is critical that they follow the ‘formula’ because getting it wrong can lead to suboptimal outcomes.

3. Data On-Boarding & ITSI Installation

It is only once Service Identification and Decomposition have been completed that we have clarity as to what data will be required to deliver the solution; only then can we know what has yet to be on-boarded in Splunk and the likely challenges and how much effort and elapsed time it will take to complete. Consequently we run the Data On-Boarding and ITSI Installation as separate projects outside the scope of the ITSI project and in parallel. This benefit ensures the entire ITSI project will not grind to a halt because of lack of data, but other services will continue to be decomposed and built whilst data on-boarding is taking place.

4. Delivery

Initially the delivery phase is where an engineer uses the specifications from service decomposition to actually build out the ITSI services to the analysts’ definition. Armed with something real to show, we then run UI workshops to understand the customer’s operational model and hammer out how the glass tables, dashboards, alerts, and notable events will be built and work in practice. Only at this point do we specify and develop these user artefacts. Delivery is an iterative process – once we have built the user artefacts we show and workshop them with their users, we rework them, and we loopback round to ensure that the delivered software delivers the Business and Technology value to its potential.

5. Handover

Working with the user community to make a service operational with a smooth transition to BAU is the critical last phase; success is only achieved when the services are actually adding value to the business.


Whilst a successful ITSI deployment can bring massive positive value to business and technology Services, it is essential to avoid the many implementation challenges and pitfalls along the road. Somerford Consultants have worked to deploy ITSI with many customers, and the experience of what does and what does not work has been captured and has evolved into the Glass Table Methodology.

At Somerford, we have found that developing and on-boarding Services incrementally and according to our prescriptive pattern consistently delivers success. Our specialists know how to lead that success.

Above all else Somerford offers expert guidance for ITSI- learn and understand the best practices and recommendations for getting the most out of your ITSI investment, and use us to ensure that your ITSI projects and initiatives deliver to their potential.

We are running “Hands On” workshops and webinars for organisations to understand the power of Splunk ITSI. Further details on agenda and dates can be found here.

Get Notified for New Blogs:

We post regularly on the platforms below, notifying our audience when we publish new pieces.

All views expressed on this blog are the author’s own and do not represent the opinions of any entity whatsoever with which the author 
has been, is now or will be affiliated, inc. this organisation whose website the blog is hosted on, or any partner of this organisation.

Scroll to Top