Splunk Cloud Migration

A Splunk Cloud migration is mostly a migration of things that are not data: apps that fail vetting, knowledge objects owned by people who left, roles that grant more than they should, and forwarders configured by hand over many years. The data itself is the easy part.

VisiCore is accredited for Splunk's Partnerverse Cloud Migration co-delivery model. We run the migration with Splunk's tooling and processes, and we bring the operational experience to make the cutover uneventful.

• Delivered under the Splunk Partnerverse Cloud Migration co-delivery model, alongside Splunk
• Every app vetted and remediated before it reaches the Cloud stack
• Knowledge objects, users and roles arrive intact, so searches work on day one
• Parallel validation and two weeks of hypercare before the Enterprise environment is retired

Service

Splunk Cloud Migration

Part number

VC-PS-MIG-SPLK

Platforms

Splunk, Cloud

Engagement

Fixed-scope project, 120 days service period

Pricing

Stated on the Order Form. Request a quote.

The Splunk Cloud Migration is a fixed-scope consulting engagement that moves a Splunk Enterprise deployment to Splunk Cloud under the Splunk Partnerverse Cloud Migration co-delivery model. It covers readiness assessment, app vetting and remediation, a forwarder and ingest cutover plan, knowledge-object and user and role migration, parallel validation, cutover and hypercare.

A dedicated VisiCore engineer, accredited on Splunk Cloud migration, leads the work with your Splunk administrators and with Splunk where the co-delivery model requires it. Deployments larger than the caps below are scoped as a custom SOW.

VisiCore delivers this service remotely through scheduled working sessions led by a named VisiCore engineer who holds current Cribl and/or Splunk certifications. On-site days can be added under a separate order.

Unless agreed otherwise in writing, the engagement starts within one week of VisiCore accepting the signed order. The working schedule is set at the kickoff meeting.

VisiCore provides an agenda before each session, including which of your team members should attend. Sessions run one to four hours.

Every task, decision and deliverable is tracked as a ticket in the X10 client portal, so your team always has a current record of what was done and why.

Scope summary. The base scope below, delivered in approximately 16 working sessions.

• Readiness assessment: inventory of apps, knowledge objects, data sources, ingest volume and retention requirements
• App vetting against Splunk Cloud requirements, with remediation guidance and fixes for in-scope apps
• Forwarder and ingest cutover plan, sequenced by source and with rollback steps
• Knowledge-object migration: saved searches, dashboards, lookups, field extractions, data models, macros and tags
• User and role migration, including index access and capabilities mapped to the Cloud stack
• Parallel validation of searches, dashboards and alerts against the Enterprise environment
• Cutover execution in agreed change windows
• Hypercare: two weeks of post-cutover support for issues arising from the migration
• As-built documentation of the Cloud stack configuration and migrated content

Quantities

Deliverables

• Readiness assessment and migration plan
• App vetting results with remediation notes for each in-scope app
• Migrated knowledge objects, users and roles on the Cloud stack
• Forwarder and ingest cutover plan with rollback steps, and a post-cutover report
• Parallel validation evidence for searches, dashboards and alerts
• As-built documentation, session recordings and notes in the X10 portal

VisiCore Technology Group provides the services described in this brief under the applicable Order Form and the VisiCore Master Services Agreement, or another written agreement in place between VisiCore and the customer.

Session and hour counts in this brief are planning estimates for the work described, not a guarantee of a fixed number of service hours.

Pricing is stated on the Order Form. Contact VisiCore for a quote.

The following are not included unless added to the Order Form:

• Installation, modification or maintenance of customer hardware, operating systems, containers, firewalls or load balancers
• Changes to the configuration of source or destination systems outside the platform in scope
• Backup and recovery, or day-to-day maintenance, of the customer's environment
• Performance testing and benchmarking
• Formal product training beyond the guidance given in working sessions
• Any service or activity not explicitly listed in the Scope section of this brief
• Splunk Cloud subscription, licensing and stack provisioning
• Historical bucket migration beyond what Splunk's supported tooling provides
• Rewriting apps that fail vetting beyond remediation guidance and in-scope fixes
• Enterprise Security or ITSI content redesign (content moves as it is)
• Decommissioning the Splunk Enterprise infrastructure

120 days.

• The customer has 120 days from the start date (the "Service Period") to schedule and use the services in this brief.
• The service ends automatically at the close of the Service Period unless VisiCore agrees in writing to extend it.
• Unused portions of the service are non-refundable and non-creditable.
• VisiCore may deliver services after the Service Period if the customer gives written notice at least 30 days before it ends and VisiCore agrees.

To deliver this service on schedule, the customer agrees to:

• Name an engagement lead with the authority to make decisions and accept deliverables
• Provide the accounts, access and network connectivity VisiCore engineers need before the first working session
• Attend scheduled sessions (one to four hours each) and complete prerequisite work before them
• Bring the subject-matter experts who own the systems being integrated
• Review each deliverable within five business days of hand-off. Without written feedback in that window the deliverable is accepted; non-blocking issues are handled after acceptance
• Have the Splunk Cloud stack provisioned, licensed and reachable before the first working session
• Provide administrative access to both the Enterprise deployment and the Cloud stack, and to the Splunk support case for the migration
• Provide a complete app inventory with owners before the readiness assessment
• Approve change windows for each cutover phase and have forwarder and source owners available during them

Meetings are scheduled at mutually agreed times during VisiCore business hours.

The customer must give at least 48 hours' written notice to cancel, reschedule or shorten a scheduled meeting. Without that notice, VisiCore may count the meeting as delivered.