Splunk Data Model Creation

Led the development of a Labs KPI dashboard to support a compliance remediation initiative across the lab environment. Partnered with stakeholders to identify and define the most actionable compliance KPIs for Lab Managers, enabling targeted improvements in operational and security compliance.

One of the primary challenges was integrating datasets with inconsistent levels of granularity. The available data existed across multiple dimensions, including device-level data (IP address, MAC address, serial number), subnet-level data (subnet range, associated firewall), and lab-level data (lab name, lab manager, and primary contacts). To solve this, I designed and implemented a proprietary Splunk data model that unified these disparate data sources into a single, scalable framework.

The solution leveraged multiple base searches from raw datasets and a centralized “sumgen” search that standardized and correlated the data into a consumable structure for dashboard reporting. This enabled users to drill into a device’s compliance status while simultaneously viewing related subnet and lab context.

The resulting dashboard provided Lab Managers with actionable insights and KPI visibility, improving their ability to identify compliance gaps, prioritize remediation efforts, and track overall lab compliance performance.