SOLUTION GUIDE

Splunk Cloud Platform: Shared Responsibility Model

The Splunk Cloud Platform SaaS operates on a shared responsibility model to ensure the optimum customer
experience. This shared model can help relieve the customer’s operational burden as Splunk operates, manages and
controls the Splunk Cloud Platform service components, which includes services from our cloud service provider
partners, as needed. The nature of this shared responsibility provides customers flexibility and control of their
Splunk Cloud Platform environment. Splunk Cloud Platform provides a complete suite of self-service capabilities to
simplify actions customers can take as part of the shared responsibility model.

The following table helps customers better understand the distribution of responsibility for their Splunk Cloud
Platform service. Customer responsibility varies based on many factors, including use case, subscription type, and
the laws and regulations applicable to their organization. Therefore, the following table is for illustrative purposes
only and is not exhaustive. Please see Splunk Documentation for additional detail.

Area Category Splunk Responsibility Customer Responsibility

Application Splunk Supported Apps Splunk publishes the list of You ensure the latest compatible
Lifecycle and Add-Ons: These are Splunk-supported apps and version of the app available
apps and add-ons that add-ons on Splunkbase. In on Splunkbase is installed so
are available through addition, you are informed of any service updates are unblocked.
Splunkbase and marked incompatible apps that need to
as Splunk-supported. be upgraded prior to a service Be prepared for the possibility
update. that the data structures of
Splunk-supported apps and
Splunk reserves the right to add-ons may change. If app data
change app data models and models and data structures do
data structures to optimize change, you can adapt your use
usage of the apps. Splunk may case to the updated models and
deprecate Splunk-supported structures.
apps.

Private Apps: These are Splunk allows you to build, vet When you build your own
apps and add-ons that and install your private apps private apps or add-ons, you are
you build. or add-ons on Splunk Cloud responsible for all aspects of
Platform. Splunk maintains our the app's or add-on’s lifecycle,
cloud app vetting service to vet including planning, development,
your private apps and add-ons release and maintenance.
prior to installation. Splunk may Follow the app lifecycle best
make platform changes for practices as described in the
compliance and security-related Developer Guide for Splunk
changes. Cloud Platform and Splunk
Enterprise. Please be sure to
follow policies specific to Splunk
Cloud Platform.
 SOLUTION GUIDE

Area Category Splunk Responsibility Customer Responsibility

Data Agent-based: Splunk Splunk makes available binaries You manage the full lifecycle of
Collection Forwarder (Splunk to and licenses required for Splunk- Splunk agents deployed in your
Splunk). to-Splunk data collection, such environment.
as for Splunk forwarders and
Pull-based: Data deployment server licenses, to You select which data is
Manager and add-ons help ensure compatibility and collected using the appropriate
with modular inputs, with ease of management at scale. mechanism. You configure this
scripted inputs and with data collection mechanism
apps. Splunk provides documentation based on your use case and
on best practices and Splunk-recommended best
example configurations for practices. You perform timely
data collection. In addition, updates of agent certificates
optional instructor-led and keep all configurations
education courses and Splunk up-to-date to ensure accurate
Professional Services are also collection of data.
available.
You monitor this data collection
Splunk maintains Splunk Cloud mechanism to ensure
Platform endpoints as well as successful forwarding of your
polling-based data collection data.
mechanisms.
As applicable for your
Splunk provides license usage subscription type, you ensure
information. your data collection usage
is in accordance with your
subscription entitlement.

REST-based API: Splunk Splunk maintains HEC data You select which data is
HTTP Event Collector collection mechanisms, collected using this mechanism.
(HEC) data collection including supported push-based You configure and monitor this
mechanisms, including data collection from data buses data forwarding mechanism
supported push-based and streaming solutions. based on your use case and
data collection from data Splunk-recommended best
buses and streaming practices.
solutions.

Data Index Management Splunk enforces retention You manage the lifecycle of data
Retention policies as defined by you on a through index management
per-index basis. settings, as well as the creation,
management and removal of
data indexes, summaries and
other acceleration mechanisms.

Splunk Cloud Platform: Shared Responsibility Model 2

 SOLUTION GUIDE

Area Category Splunk Responsibility Customer Responsibility

Data Storage Management Splunk applies data resiliency You select the best storage
Retention and backup policies in option available for your Splunk
(cont.) accordance with our Splunk Cloud Platform subscription, and
Cloud Platform Service Details. you manage these settings in
Splunk Web or REST-based API.
Splunk Cloud Platform elastically
expands to retain your data You ensure storage usage
per your retention settings. in accordance with your
In addition, we provide data subscription entitlement. If your
retention and storage usage Splunk Cloud Platform storage
telemetry to help you manage usage exceeds your storage
your Splunk Cloud Platform entitlement, you may incur a
subscription entitlement. true-up charge.

Network Splunk maintains ingest, login You ensure the public or private
Connectivity and search endpoints so they internet connectivity between
are reachable from the public all of your users (such as
internet, or on a case-by-case admins and end users) and the
basis, through a private network. Splunk Cloud Platform ingest,
This includes monitoring the login and search endpoints. In
availability of these endpoints. addition, ensure your IP allow
list configuration is updated to
Splunk will provide you with manage access to your Splunk
advanced notice in the rare Cloud Platform environment.
occurrence of a network
address change that impacts You ensure your outbound
the ingest, login and search firewall rules are promptly
endpoints. updated in the rare occurrence
of a network address change
that impacts the ingest, login
and search endpoints.

Search Splunk maintains the search You create your searches using
endpoints per the Splunk Cloud SPL, or using alternative ways
Platform SLA. In addition, to display and analyze data
we provide documentation graphically without composing
and best practices for SPL queries.
composing efficient Splunk
Search Processing Language You ensure your search load
(SPL) queries and creating is in accordance with the
dashboards. documented service limits.

Splunk documents service limits You apply workload

related to search, such as the management rules to prioritize
maximum number of concurrent your search workloads
searches. appropriately.

Splunk provides pre-defined

workload management pools to
assist with search priority in the
event of search congestion.

Splunk Cloud Platform: Shared Responsibility Model 3

 SOLUTION GUIDE

Area Category Splunk Responsibility Customer Responsibility

Search Splunk provides information You review the health and

(cont.) regarding search performance performance of your searches
which may include information using information provided
on long-running searches, through Cloud Monitoring
skipped scheduled searches Console (CMC). As needed,
and average search runtime. you take action to improve the
performance of your searches.

Security The Splunk Cloud Platform You configure your user

Security Addendum (CSA) accounts to be authenticated
sets forth the administrative, using supported identity
technical and physical providers (IdP), including single
safeguards Splunk takes to sign-on (SSO). If required
protect confidential information, for compliance, configure
including customer content, in your IP allow list rules to
Splunk Cloud Platform (Security ensure permitted access to
Program). your Splunk Cloud Platform
environment. Finally, you assign
Splunk updates and publishes the appropriate team members
the FedRAMP, HIPAA and PCI to the sc_admin role, which has
attestations. the permissions to perform self-
service tasks.

The above is a minimal list and

not intended to be exhaustive.

You contact your Splunk

account representative to
review relevant compliance
documentation.

Service Splunk provides notification You ensure your operational

Lifecycle of changes in the service contacts are kept up-to-date
description plus advanced in order for them to receive
14-day notice for service service updates and Splunk-
updates and Splunk-initiated initiated routine maintenance
routine maintenance. For more notifications. In addition,
information, see the Splunk you ensure your assigned
Cloud Service Maintenance maintenance window is kept up-
Policy. to-date to match your business
needs.
In the event of a service-
impacting incident, Splunk If you encounter a service-
will review service level credit impacting incident, you submit
requests when Service Level an SLA incident and credit
Agreement (SLA) incidents are required per SLA guidelines.
submitted by you within the
time constraints.

Learn more: www.splunk.com/asksales www.splunk.com

Splunk, Splunk> and Turn Data Into Doing are trademarks and registered trademarks of Splunk Inc. in the United States and other countries.
All other brand names, product names or trademarks belong to their respective owners. © 2022 Splunk Inc. All rights reserved. 22-22220-Splunk-Cloud Platform Shared Responsibility Model-SG-101