Working with Support and the Support Portal2.2 Technical Support Engineer • 24x7 Global Coverage o...

Working with Support and the Support Portal


2

Table of Contents 1 Global Splunk Support ............................................................................................................... 4

2 Support Team Functions ............................................................................................................ 5

2.1 Customer Support Call Center ................................................................................................................... 5

2.2 Technical Support Engineer ....................................................................................................................... 5

3 Beyond the Scope of Support ................................................................................................... 6

3.1 Sales Engineer Services ............................................................................................................................ 6

3.2 Admin On-Demand Services ...................................................................................................................... 6

3.3 Professional Services ................................................................................................................................. 6

4 On-boarding Process ................................................................................................................. 7

4.1 Customer Registration Process .................................................................................................................. 7

5 Types of Entitlement Contacts/Users ....................................................................................... 8

5.1 Community User ......................................................................................................................................... 8

5.2 Authorized Contact ..................................................................................................................................... 8

5.3 Portal Admin ............................................................................................................................................... 8

6 What is the Splunk Case Priority System? ............................................................................... 9

6.1 Classifying a P1 Support Case ................................................................................................................... 9



7 Splunk Customer Validation Policy ........................................................................................ 10

7.1 Calling in to Support ................................................................................................................................. 10

7.2 Submitting a Support Case via the Portal ................................................................................................ 10

7.3 Companies with Multiple Entitlements ...................................................................................................... 10

8 What should you do before Calling or Submitting a case? .................................................. 11


3

9 Finding your Splunk Entitlement Number .............................................................................. 12

9.1 Log in to Splunk.com ................................................................................................................................ 12

9.2 Click on Support and Support Portal ........................................................................................................ 12

9.3 Click on My Entitlements .......................................................................................................................... 13

9.4 Picking Valid Entitlements ........................................................................................................................ 13

10 Submitting a case through the Support Portal ...................................................................... 14

10.1 Log in to Splunk.com ............................................................................................................................. 14

10.2 Click on Support and Support Portal ..................................................................................................... 14

10.3 Click on Submit a Case ......................................................................................................................... 15

10.4 Selecting fields for your case ................................................................................................................ 15

10.5 What information should be in the case? .............................................................................................. 17 10.5.1 What is a Splunk Diagnostic File (Splunk Diag)? ............................................................................... 17

10.6 Splunk Supported Apps and Addons .................................................................................................... 18

11 Case Submission Scenario and Sample ................................................................................. 19

11.1 Good Case Submission ........................................................................................................................ 19

11.2 Bad Case Submission ........................................................................................................................... 19

12 Manage Your Cases .................................................................................................................. 20

13 Escalating a Case ..................................................................................................................... 21

14 Where to Find Resources ......................................................................................................... 22

14.1 Community Support .............................................................................................................................. 22

14.2 Submit a Question on Splunk Answers ................................................................................................. 22

14.3 Working with the Splunk Knowledge Base ............................................................................................ 23

15 Who do I contact? ..................................................................................................................... 25


4

1 Global Splunk Support

https://www.splunk.com/en_us/about-us/contact.html#tabs/customer-support

Splunk is a global organization that provides support 24 hours a day, 7 days a week. During weekends and local holidays, only urgent high priority P1 issues are handled.

Additionally, Support is delivered only in English.

Operating and Assisting Globally

Available 24x7 Support Coverage in English

Phone Support Hotline


5

2 Support Team Functions There are three functional teams in Support. The customer support Investigation team work primarily on non-technical customer issues. Support Engineers help customers with technical product issues and questions.

2.1 Customer Support Call Center • 24x7 Global Coverage

• Provide Live Customer Support to assist in opening cases

• Direct access to Technical Support Engineers based on case priority

• Request additional info: diags, issue clarification, impact, and more

• Handle license reset keys and other license questions

The team works primarily on non-technical requests. They can also request additional information to help clarify the case issues, such as, asking for diags or the impact to their business.

2.2 Technical Support Engineer • 24x7 Global Coverage

• All cases are handled during local regional business hours

• Weekend and local holiday coverage is limited to urgent P1 production issues

• Assist in resolving break-fix technical product issues via:

• Email Case Updates

• Phone

• Web Conferencing

• Engage with internal resources, as needed to reach case resolution

• Bugs

• Workarounds

Technical Support Engineers focus on break-fix technical product issues. If the issue is identified as a product defect, the Engineer will work with the Development team or other internal resources as needed, to deliver a fix or workaround. The Support Engineers are the primary contacts for all case communications and will collaborate with the account team as required.


6

3 Beyond the Scope of Support 3.1 Sales Engineer Services

• How to’s

• Implementation: Demo/POC

• Product Feature Feasibility

3.2 Admin On-Demand Services • Creating Drilldown, Macro, Workflows

• Building lookup, Dashboard, Searches

• Assistance with Data on-boarding

• Ask for Expert

3.3 Professional Services • Premium app implementation

• Customization

• App

• Health Check

• Review their configuration

• Review their plan of action for upgrade

So, what is beyond the scope of Support’s main functions where they may be asked for further information? These may be related to:

• How-to questions such as feature capabilities, providing a demo or “proof of concept.” These would be best handled by your Sales Engineer.

• Admin on Demand services is managed by Professional Services who can help with simple tasks such as creating drilldowns, macro, lookup table, dashboards and so on. They can also provide expert consultation to answer adoption and best practices.

• Anything that requires involved tasks such as Premium App implementation or customization, Professional Services are trained and specialized in these types of engagements.

• They can also perform environment health checks to ensure Splunk’s optimal performance.


7

4 On-boarding Process 4.1 Customer Registration Process

• Sign up at this link: https://www.splunk.com/page/sign_up

• Validate primary business email***

Note: Cases submitted using group alias are not accepted

It is critical to on-board your staff correctly so that they can reach Support Engineers for technical issues in a timely manner.

The process would include:

1. Them registering at: https://www.splunk.com/page/sign_up

2. Next, they should check their email inbox for a Splunk validation message. They must acknowledge the link within 7 days otherwise their access will expire. If they indicate they never saw this email, it is likely the validation email ended up in the junk folder.

3. Once they have validated the Splunk link, this will create an account.

Note: Accounts can take up to 24 hours to process.


8

5 Types of Entitlement Contacts/Users 5.1 Community User

• No case submission via Support Portal

• No case visibility in the Enterprise queue

• No case SLA

5.2 Authorized Contact • Individual contact with primary business email

• Submit and update cases

• Under a valid entitlement

5.3 Portal Admin • Add/delete contacts from entitlement

• Non-Partner Contact

The main difference with an Authorized Contact and the Portal Admin is the admin has the ability to remove or add contacts from their account’s entitlement. They can then manage the individuals assigned to work with Splunk support from their company.


9

6 What is the Splunk Case Priority System?

Support is offered to users with a Paid for Support active Splunk entitlement. The Entitlement ID will be asked for when calling support and is required in order to submit a case through either the Support Portal of via Phone. More details on this can be found in Finding an Entitlement.

6.1 Classifying a P1 Support Case • A production installation of purchased Splunk software is completely inaccessible or most of its functionality

is unusable.

• You must be available to work with one of our engineers immediately via phone to resolve the issue.

• For P1 cases, it is recommended that you call us on one of our global support numbers found here.

• Please ensure you have your Support Entitlement number with you. Instructions on how to find this will be included in Finding an Entitlement.

6.2 Classifying a P2 Support Case • One or more important features of purchased Splunk software has become unusable.

• This requires high attention, but you are not available to work with us via phone immediately.

• Our engineers will begin support via Email and offer a number of support options as needed through the lifecycle of your case.

• Cases can be submitted via the support portal or by calling our support team

6.3 Classifying a P3 Support Case • Any other case where a feature of purchased Splunk software is not operating as documented.

• Should be used for any less essential components that are not working as expected or for How To’s you were not able to find in docs.splunk.com or answers.splunk.com.

STANDARDSTANDARD

P1P1

P2P2

P3P3

P4P4

PREMIUMPREMIUM

Availability: 24x7x365Response: 2 hrUpdate: Daily

Availability: 24x7x365Response: 30 min

Update: 1 hr

Availability: 8x5Response: 1 biz day

Update: Weekly

Availability: 24x7x365Response: 1 hr

Update: 4 hr

Availability: 8x5Response: 2 biz days

Update: None

Availability: 8x5Response: 4 hr

Update: 1 biz day

Availability: 8x5Response: 2 biz days

Update: None

Availability: 8x5Response: 1 biz day

Update: Weekly

Designated Supported Team Access

Enhanced Premium Offering• 24x7 Coverage for P1/P2• P1 Response 30 min / Target Fix: 24 hrs• Direct Access to Advanced Support Team


10

7 Splunk Customer Validation Policy Splunk takes customer data security very seriously and will require a customer to validate that they are authorized to both submit a case and request information on a case when calling in through the support line. Below will define the requirements that must be met for common given scenarios.

7.1 Calling in to Support • To submit a new case

• To receive support on an existing case

For customers looking to submit or retrieve information via phone, you must be prepared to provide the following information to the support representative:

1. Your Name

2. Your Email

3. Your Company Name

4. Your Splunk Entitlement Number

If you do not have your Splunk entitlement number, our teams will walk you through how to log into the Splunk Support Portal to retrieve it.

7.2 Submitting a Support Case via the Portal Submitting support cases and requesting updates through the portal do not require that you authenticate through any other method than logging into the support portal.

7.3 Companies with Multiple Entitlements You are only authorized to receive updates on cases listed under your support entitlement. If you have multiple entitlements under your organization, it is the responsibility of the Portal Admin for other entitlements to determine if you are authorized to be on the company’s additional entitlements. Splunk will not grant you access to those entitlements if you are not already apart of them.


11

8 What should you do before Calling or Submitting a case? • Search for similar issue in Splunk Answers

• Go through Troubleshooting Manual

• If Splunk Answers and Splunk Docs do not help, submit a case using the Support Portal

• Ensure you have an active support entitlement to request support


12

9 Finding your Splunk Entitlement Number Splunk entitlement numbers are used for validating that you have an active support contract with Splunk and are essential for service. Below we will show you where to find your entitlements

9.1 Log in to Splunk.com So normally, a user will login through our Support Portal. They can click the login icon and select login from the drop-down menu. They’ll enter their username and password, select that you are not a robot and click login.

9.2 Click on Support and Support Portal For end users, they’ll be logging in through the support tab here, and clicking on “Support Portal.”


13

9.3 Click on My Entitlements Once logged into the Support Portal, in the menu on the left, click My Entitlements

9.4 Picking Valid Entitlements Valid entitlements will be listed on the right. The Entitlement ID Number will consist of either 1) the letter E followed by 7 digits, or 2) a three-letter code indicating the entitlement type followed by eight digits (e.g. SPL-12345678). If the entitlement is active, it will have a green checkmark beside it.


14

10 Submitting a case through the Support Portal 10.1 Log in to Splunk.com So normally, a user will login through our Support Portal. They can click the login icon and select login from the drop-down menu. They’ll enter their username and password and click login.

10.2 Click on Support and Support Portal For end users, they’ll be logging in through the support tab here, and clicking on “Support Portal.”


15

10.3 Click on Submit a Case So, here’s the landing page. As you can see, this is in a portal admin view, since you have administrative rights where you can add and remove contacts. From this page, you can submit a case and manage deployments, contacts, or licenses.

10.4 Selecting fields for your case This is the form that you’ll be filling out.

1. Depending on the issue, select your entitlement here. There may be several.

2. The Select Deployment field is not required and can be left at none.

a. If you have several Splunk environments, such as, Dev, Stage and Production, a deployment record can be created for each under the ‘My Deployments’ link. This deployment information is then available in the drop-down listing for the future.

3. Select a case priority level from the drop-down menu.

a. Please reference the chart above when selecting a priority.

4. Select the business severity level from the drop-down menu.

5. Provide a one-sentence description of your issue in the subject field.

6. Select the product and version number of the issue you are having trouble with.

7. Select the issue that you are needing help with.

8. Select the “feature/component/app” associated with your issue.

9. Next, select the OS platform and version.

10. Select Cloud or On-Prem in the Deployment Type drop-down menu.

11. Provide all the information as possible in the problem description box.

a. The more details that are provided from the beginning, the less back and forth communication will need to occur between you and support.


16

12. In the “Steps to Reproduce” field, include detailed steps to reproduce in addition a description of your configuration.

13. Click the submit.


17

10.5 What information should be in the case? So, what are the key details a case should include to help Support narrow down the issue or behavior.

It should include:

• Steps on how to reproduce, if applicable

• The symptoms of the issues

• If an upgrade has occurred

• When the problem started

• What has been investigated

• What were the findings and observations

• Screenshots

• Sample events

• Relevant logs or error messages

• Any environment information such as recent OS updates, hardware, or config changes

• Splunk diag file

10.5.1 What is a Splunk Diagnostic File (Splunk Diag)? What’s a Splunk diagnostic file (or diag), and why do we care?

Generating a diag file is necessary in understanding and getting a snapshot view of your configuration in your Splunk environment. Uploading a diag automatically with a case submission will reduce the amount of time required to identify the root cause.

Here are some use cases where a diag is critical:

• Forwarder is not working or reaching the indexer, in which case a diag from both instances would be required

• Data is missing

• Splunkd crash

Please be aware that the diag does not collect your indexed data.

10.5.1.1 How to generate a diag?

• Command is “Splunk diag”

• Produces diag-<server name>-<date>.tar.gz (or .zip)

10.5.1.2 Attach to case through support portal

• You can attach it to your case by logging into splunk.com and going here: http://www.splunk.com/index.php/track_issues

For more information on the diag command, refer to the following document: http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/ContactSplunkSupport#diag.

More details about the Splunk diagnostic file and how to generate can be found in the Troubleshooting Manual in our Splunk documentation.


18

10.6 Splunk Supported Apps and Addons The Splunk Support team accepts cases and responds to issues only for the apps and add-ons which display a Splunk Supported label on Splunkbase.

Some developers support their own apps and add-ons. These apps and add-ons display a Developer Supported label on Splunkbase.

The Splunk developer community supports apps and add-ons which display a Community Supported label on Splunkbase.

For more information, please go to: https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Whatsanapp.


19

11 Case Submission Scenario and Sample Sam searched in the _internal index, where all the logs are indexed within Splunk.

Sam posted findings in the description of the issue during the case submission and included the error messages encountered. In addition, also ran a diag to support the error message, and provided the latest diag by uploading it to the case.

Also, Sam has a sample event of where the problem was. Not everything was broken, only certain events, which were source types.

11.1 Good Case Submission Subject: Embedded report only shows the first 20 events

Description: It seems embedded report returns partial data of actual report on the Splunk Web. I am not sure if this is a limitation or an unexpected behavior.

When clicking on URL, only the first 20 results are shown in embedded report. However, when I check the actual report on Splunk Web, I see more than 20 events.

I checked the following Splunk docs but was unable to find any information on how to change the number of search results in embedded report.

http://docs.splunk.com/Documentation/Splunk/6.5.0/Report/Embedscheduledreports

http://docs.splunk.com/Documentation/Splunk/6.5.0/Report/Optionalconfigurationforembeddedreports

Is this a limitation or an unexpected behavior or a bug? I am expecting more than 20 events and not just the first 20 events.

This is easily reproducible:

1. Run a new search query and see there are more than 20 events

2. Save the search as a report (such as, test report)

3. Select “Edit Schedule” of the search to run as a scheduled report.

4. Select [Embed] of the scheduled report that was edited on step3.

5. Check enabled embedded report, then see the results.

11.2 Bad Case Submission Subject: call me

Description: call me at xxx-xxx-xxxx

Notes: We’ll call as requested, but keep in mind:

• Case will not be assigned to engineer who specializes on the issue you are having trouble

• Delay in case resolution

• Only the engineer handling your case will know your issue. Other engineers reviewing your case who might be able to help will miss


20

12 Manage Your Cases You can view all your cases in Manage Case. To view detail on a particular case, drilldown on the case number or subject link.

Within a case record detail, various options are available to manage a case using the green buttons:

• Back to List

• Add File

• Close Case

• Add Comment

To communicate with the Support Engineer, click Add Comment or to provide more materials to the case, select Add File. Once the root cause of a case is found and resolved, you can also close a case by clicking on Close Case.


21

13 Escalating a Case If your case needs to be escalated for any reason, please call in to the support line so we can have it addressed immediately. Our customer support team will assess the situation and determine the best course of action to ensure you get your case addressed based on our priority system and your needs.

Please be sure to provide them with the below:

• What is the current status of your instance?

• Which components need to be addressed immediately?

• What is the current impact to your organization?

You are welcome to add the comments to your case ahead of time via the portal if there are several details that need to be recorded prior to calling. Once on the phone, provide a general description to the rep informing them that more detail has been added as a comment to the case, so the team understands the issue and how to address it.


22

14 Where to Find Resources • It’s important that you have available resources in addition to Splunk support. At the Community level, Splunk

Documentation and Splunk Answers are key but Splunk blogs/wiki are also useful. You can also get some assistance through the Slack Chat.

• Splunk Support operates under the “follow the sun model” and covers global regions in APAC, EMEA, and AMER.

14.1 Community Support • Splunk Documentation

• Splunk Answers

• Slack Chat

• Splunk Community

14.2 Submit a Question on Splunk Answers When a customer is seeking assistance from the Splunk Community, they can post their question in Splunk answers. Here are the steps to follow:

1. Type in the question.

2. Provide a detailed description.

3. Select a product.

4. Add tags.


23

14.3 Working with the Splunk Knowledge Base Customers who log into their Splunk.com accounts will have access to the Splunk Knowledge Base.

The Search bar at the top of the page can be used to search the Knowledge Base, Splunk Docs and our Answers site.

Enter key words and phrases into the search bar and all relevant Knowledge, Splunk Docs and Answers documentation will be presented.


24

Additionally, you can select the Submit a Case option and an automatic search is done based on the information entered in the subject and product entries. The search will take key words and phrases and conduct a search on the Knowledge Base.


Splunk, Splunk>, Data-to-Everything, D2E and Turn Data Into Doing are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names or trademarks belong to their respective owners. © 2020 Splunk Inc. All rights reserved.

www.splunk.com [email protected]

15 Who do I contact? Sales

Sales Contact information https://www.splunk.com/en_us/about-us/contact.html#tabs/sales

Customer Support

Toll Free Numbers 1.885.775.8657 (855-SPLUNKS)

https://www.splunk.com/en_us/about-us/contact.html#tabs/customer-support

Support Portal https://www.splunk.com/index.php/submit_issue

Education

North America [email protected]

Europe [email protected]

Asia-Pacific [email protected]

Website https://www.splunk.com/view/education/SP-CAAAAH9

Working with Support and the Support Portal2.2 Technical Support Engineer • 24x7 Global Coverage o...

Documents

Transcript of Working with Support and the Support Portal2.2 Technical Support Engineer • 24x7 Global Coverage o...