The file's text, extracted by GovTribe without its formatting.
Splunk Professional Services Statement of Work 02 April 2020
| Task |
| Item Description |
| Duration |
| Performance Parameter |
The objective of the Splunk Professional Services Project is to have a new Linux-based splunk system configured at all four Executive Airlift Communications Network (EACN) sites that provides for local log/data collection with centralized search capability and proper indexing of data from local and remote devices.
It is an objective of this project that the contract define, at a minimum:
| 2.1 |
| Work to-be Performed: |
Specific, performance-based, quantitative terms of the work to-be-done to satisfy this requirement
| 2.1.1 |
| Current Architecture Assessment |
| Remote Day 1 |
| EACN has four sites, three connected logically and one lab/development set. Currently however, all four have a fully isolated instance of Splunk. Contractor will conduct site survey from the Scott AFB location to gain an understanding of the current network. The Contractor shall contact the Splunk Engineer who provides support under the Government’s current maintenance agreement, who has knowledge of our system. |
| 2.1.2 |
| Access EACN Lab, Backup Existing Data |
| Remote Day 2-3 |
| All four Splunk instances currently records data to separate Storage Area Network (SAN) devices. The Government does not anticipate that any action will be required to maintain these files, but contractor must ensure that data is in a location that is not affected by the transition. A gap in collection during cutover will be permitted. The Contractor shall provide instructions for site personnel to repeat on production systems. |
| 2.1.3 |
| Commission Lab Splunk Servers |
| Remote Day 4 |
| The Contractor shall configure a minimum of one Splunk Indexer server and Splunk search head through remote access to the Scott AFB Lab. The Indexer will not be the search head. These servers will be configured in an industry best-practice configuration. |
| 2.1.4 |
| Enable Logging From Devices |
| Remote Day 5-8 |
| After the new Splunk system is operational, the Contractor shall send the data through the old system. The EACN network includes, essentially, Cisco routers and switches, Palo Alto Firewalls, Cisco Unified Communications, Vmware vSphere Enterprise, Windows Servers, and Linux Servers. This can be accomplished with Splunk Universal Forwarders or the appropriate method for a particular device type (e.g. router). Approximately 5 of each device type exist at each production site and in the lab. |
| 2.1.5 |
| Enable Logging From Remote Endpoint |
| Remote Day 9-12 |
| EACN has a new requirement to collect log data from customer sites, which consist of two routers each. Using the lab customer site, the Contractor shall configure Splunk to collect from basic network performance logs, DHCP reservations, and any other relevant common information from the routers. The Contractor shall document any and all changes to include router configuration and/or firewall rule changes, so as to provide the users the capability on the production network. |
| 2.1.6 |
| Enable Built-in Dashboards / Apps as Appropriate |
| Remote Day 13-14 |
| For the device types that exist on network, the Contractor shall enable any free manufacturer apps available on the Splunk base. In addition, the Contractor shall create three to five dashboards that represent commonly requested views in industry. |
| 2.1.7 |
| Validate Proper Functioning of Lab |
| Remote Day 15 |
| The Contractor shall demonstrate to key Scott AFB EACN personnel that all the data for which collection was enabled for the lab is being indexed fully and correctly, to include installed dashboards and applications. |
| 2.1.8 |
| Commission Production Splunk Servers and Enable Logging |
| On Site Day 1-5 |
| The Contractor shall configure a minimum of one Splunk Indexer server at each of three production sites and Splunk search heads at two production sites. Indexers will not be search heads. These servers will be configured in an industry best-practice configuration that allows data from all three sites to be searched simultaneously from any of the installed "search heads." If applicable/desirable, servers may be able to be built on the Lab environment and cloned from lab to the production network using VMware. |
| 2.1.9 |
| Validate Proper Functioning of Production Environment |
| Remote Day 15 |
| The Contractor shall demonstrate to key Scott AFB EACN personnel that all the data for which collection was enabled for the production environment is being indexed fully and correctly, to include installed dashboards and applications. |
| 2.1.10 |
| Provide Troubleshooting Support |
| Remote Day 16-18 |
| The Contractor shall reengage with Scott AFB EACN personnel 10 business days after completion of work to address and correct any encountered issues. |
| 2.1.11 |
| Generate Documentation |
| Remote Day 19-20 |
| The Contractor shall: |
1) Provide a design document that captures the work that was done.
2) The Provide configuration template that was generated during task 2.1.5.
