How to Deliver the Unexpected Experience Every Time –– KGI’s Delivery Framework

The What

In over ten years of professional services engagements, we at Kinney Group have learned a lesson or two about how to really deliver the unexpected experience for our customers. As you can imagine, there are hundreds of elements that factor into delivering a “good” engagement.

Let’s focus on one engagement. You gather your NPS score and feedback in areas like the quality of your technical expertise, project management team communication, and the end solution that your team provided. Then, you place a bet on what made the project a win.

Now take hundreds of engagements, like the 500+ engagements Kinney Group has delivered on behalf of Splunk. This is where you start to identify trends and consistencies that truly made your engagement a win.

Historically, the secret to setting a team up for success on every engagement has been a mystery. But with years of data and customer feedback, we’ve created a new approach that ensures customer and company success… every time.


The How

There are four foundational elements essential to our business operations, each of which ensures a successful delivery framework:

  1. The Three Returns on Investment (3 ROIs)

As a company, we focus not only on the financial savings that our services provide customers, but also on the human and mission returns on investment that a successful delivery brings. Saving an organization the financial dollars, minimizing time spent on human intervention, and ensuring impacts that align with business objectives are the cornerstones of our delivery approach. Heck, we don’t even “close-win” our sales deals without nailing down the 3 ROIs to ensure we’re molding our offerings and services to best fit the customer’s needs.

  1. Culture

At Kinney Group, our CEO Jim Kinney (known to colleagues as JK) likes to say, “culture is our number #1 advantage.” A positive culture lays the foundation for direct communication, strong team structure, and colleague empowerment that ensures our people do good work. And in today’s age of remote work, the work from home stipend doesn’t hurt, either!

  1. Talent & Expertise

It’s no surprise that our world-class talent at Kinney Group is the result of a kick-butt recruitment team and high-quality colleague referrals. We like to think smart people know smart people (and then recruit them to join other smart people at KGI). This technical talent provides the expert knowledge and skill to deliver unparalleled work for our customers. Every team of well-equipped KGI colleagues are experts in their own fields, ready to offer support to customers and colleagues. Our robust recruiting efforts, from sales and marketing to project management and finance, all lead our engineers to deliver the best work for our customers.

  1. Methodologies & Systems

We are a highly technical company, so an obsession with effective systems is built into our operations. With the power of our analytics and automation experience, we “eat our own dog food,” as JK says, when it comes to investing in our systems and automating process to scale. We encourage transparent and consistent practices between our teams through team playbooks. Every internal team has a playbook filled with our documented processes, so when it’s game time, we have the play-by-play ready to hit the field.


The Why

Now for the why. The Kinney Group’s Delivery Framework is inspired by Simon Sinek’s Golden Circle: the What, How, and now the Why. Each of those layers became thoughtful steps we worked through in order to deliver the best services for our customers.

  1. A formula for customer success

If we use the 3 ROIs to truly understand what our customers need, everything we do should be focused around creating business value. Showing up and just completing the items on the statement of work is boring, and it doesn’t always provide the outcomes that leaders are seeking. Getting to the bottom of why our customers engage industry experts is crucial for our team to live up to our potential and showcase what our technology can do.

  1. Enable scale and consistency

Over the last year or two, we’ve really been able to focus on our delivery process. In that time span, we restructured our delivery department, added a customer success team, and implemented post-engagement support. We’ve been able to boil down the process of delighting our customers to a fine science with a consistent rhythm.

  1. Remove risks

With so many different teams working to ensure a positive customer journey, inter-departmental communication is key. We do this by installing an agile champion in each and every department (even the HR and Marketing teams)! Believing in the agile mindset is no small feat. We all have regular team stand-ups and syncs with others across the company. This allows us all to be on the same page and have our eyes on any potential issues that may arise. Keeping these meetings short, sweet, and to the point is crucial to moving at a Silicon Valley speed–even here in the Midwest.

The New Standard: KGI’s Managed Services for Splunk

When the KGI team announced our Managed Services for Splunk offering, we made a pretty heady statement: we are launching the new standard for a managed service capability for customers using Splunk.

You’ve probably heard companies claim statements like the new standard. However, in our experience, backing up that claim is a different story. We see the KGI team as defining a new standard for Splunk managed services in three compelling ways.

1. Differentiated Experience and Expertise

The KGI team has worked with the Splunk platform since 2013, and over that time we have delivered over 600 engineering services engagements tied to the Splunk Enterprise and Splunk Cloud platforms. These engagements have covered projects big and small including both commercial companies as well as U.S public sector organizations.

KGI is a Splunk Elite Services Partner and has been twice recognized as Splunk Public Sector Services Partner of the Year. Our engineering services for Splunk are not limited to security and IT operations use cases – we develop business analytics applications on the Splunk platform that perform a variety of functions.

Specific to security – which is Splunk’s #1 use case – the KGI team offers a unique perspective. Since the company’s origins in 2006, we have supported US Federal defense and intelligence activities that demand stringent approaches to cybersecurity. We apply 15+ years of know-how gained by supporting classified networks in everything we do. A traditional commercial-oriented managed service provider simply will not have this perspective. Your Splunk environment should be secure, and we know how to get it there and keep it there.


2. The Atlas Platform Combined with Expertise on Demand

In November 2020, KGI launched Atlas, the first platform of its kind purpose-built to help organizations achieve exceptional results from their investments in Splunk. Managing a Splunk environment is table-stakes for a managed services provider – enabling organization’s valued colleagues to achieve great things with Splunk is the new standard.

The Atlas platform works with any Splunk environment, whether it’s Splunk Enterprise running on-prem or Splunk Cloud. Atlas addresses the total ecosystem of capabilities that are needed to gain success with Splunk. This includes functions that do not necessarily exist within Splunk technologies, yet are necessary when operating Splunk at scale.

When it comes to managed services, we don’t stop with Atlas – we complement the platform’s capabilities with our Expertise on Demand (EOD) offering. EOD gives end-users immediate access to Splunk experts to assist them in the creation of comprehensive dashboards and reports. With EOD, there are no more struggles figuring out SPL searches or data correlations. Expert help is as close as a phone call or chat session.

And Atlas helps customers save money – big money – with their Splunk investment. From license optimization to the reduction of Splunk’s “soft” costs, pairing Atlas with EOD ensures that an organization’s investment in Splunk is the best it can be.


3. Passionately Focused on Business Value from Splunk: the KGI Delivery Framework

Organizations invest in Splunk to yield business outcomes and expect specific returns on their investments (aka: ROIs).  The KGI Delivery Framework focuses our teams on delivering three ROIs – mission, financial, and human – within every Splunk project that we tackle.

Delivery of technical outcomes should be expected from any managed services provider – and we deliver Splunk technical excellence in everything we do.  Delivery of business results specific to an organization is a key differentiator of KGI’s managed services offering for Splunk. The KGI Delivery Framework is our proprietary delivery methodology, which ensures organizations receive optimal returns on their investments in Splunk. Kinney Group’s managed services offering ensures that business outcomes are every bit as important as technical outcomes.

If organizations cannot achieve business outcomes from the money they’ve invested in Splunk – what’s the point?


The Kinney Group Difference

Deep and differentiated experience with Splunk. Leverage of the Atlas platform and EOD for driving customer success. A focus on business outcomes. All three of these attributes of KGI’s Managed Services for Splunk offering are elements of the new standard we’ve created.

In addition to the outstanding capabilities outlined above, we haven’t yet touched on world-class security MDR support, cyber terrain maps for identifying exploitable vulnerabilities, and specific vertical market solutions via Atlas.

The new standard in managed services for Splunk is here. It’s not a tagline, it’s the new journey that customers embark upon as they pursue outstanding results with Splunk.

Want to learn more about Kinney Group’s Managed Services offering? Fill out the form below!

Kinney Group Core Values: What Is a Chopper?

As part of the team who defined Kinney Group’s five core values back in 2016, I can still remember much of the conversation. We had borrowed a conference room in the basement of IUPUI and locked ourselves away with a bunch of data, word clouds, post-it pads, and a mission to finalize our core values. We knew how critical it was to get it right—if not, we could easily steer our colleagues wrong for years to come. After hours of deliberation, surveys, healthy debate, and gridlock over wordsmithing, I looked at my teammates in a moment of desperation and asked, “WWJKD?” What Would JK Do?

A Founding Vision

As a founder-led organization, much of our culture over time has been grounded in our founder, Jim Kinney (also known as JK). JK is a visionary and leads our team with confidence and passion for our mission. We took each word that we were unsure of and asked again, WWJKD? The five core themes were easy—all of our surveys identified resonant concepts. Finding the right words to convey the spirit of the company was the tricky part.

We came to the fifth value with our core four now in place: Customer-centric, Innovative, Competitive, and Bias to Action. We had a handful of phrases and ideas for the fifth: perseverance, removing barriers, never give up, determination. None of it was right. The concept was there, but it simply didn’t feel like Kinney Group.

Just then, my coworker stared into the corner and muttered, “What if we just call it Chopper?” After a couple of chuckles, someone else muttered, “No one will know what we’re talking about.” All other ideas left my brain.

This was it. That was the point. No one outside would know what it meant, but inside, we would know exactly what it meant to live out the legend of Chopper Man. In interviews, we’d get to answer the question, “What is a Chopper?” Someday, I’d write this blog post to answer our most important cultural question: what is a Chopper?

The Legend of Chopper Man

The history of Chopper at Kinney Group is folklore; we still tell the story at every Quarterly Business Review. In 2011, when the company comprised fewer than ten people, our founder had to make the tough choice that every founder has faced: push through or shut it down. No one knows what JK was searching for when he happened upon the Google image of a man chopping a pile of wood. Now, that image is an emblem of his choice to push through. He opted to remove the obstacles that plagued our organization and pursue his vision and our mission: harness the power of IT to improve lives.

A sepia photograph of a man chopping wood.
The image of Chopper Man that inspired JK in 2011

When things look bleak and another roadblock presents itself, we choose to Chop through. Can’t see the end in sight and lost in the middle of the forest? Start chopping.

When we answer the question for potential new colleagues, there is a gleam in the eye of future Choppers. They get it right away and then want to hear more. The question changes from “what is a Chopper?” to “how do I become a Chopper?”

What Makes a Chopper?

At Kinney Group, we move at Silicon Valley speed. Just as problems drive innovation, ideas then become reality. The ability to persevere and find an innovative way through a process, project, or opportunity is imperative to our success as an organization.

Rather than float a deadline, Choppers will finalize a minimum viable product with the client. This is done to move the ball forward and accomplish the task as initially defined.

Through open book management, we can empower the full organization to chop through a financial target. This transparency ensures we are all moving in the same direction.

If the story of Chopper Man—or these examples of the Chopper mentality at work—inspire you, then consider joining our team! A position at Kinney Group is an investment in your career. See a list of our current openings and apply online here.

2020: The Year in Kinney Group

Although 2020 was fraught with hardship, uncertainty, and unrest, we can all take pride in moments of success despite adversity. Like so many other businesses, Kinney Group transitioned to a remote workforce in mid-March. This change brought some challenges for sure, but it also revealed the resilience and persistence of our Choppers. Now that last year has come to a close, Kinney Group is busy with our 2021 Kickoff, starting the year off right with setting goals and celebrating our successes. We’re taking a moment to look back at some of the 2020 wins here at Kinney Group:


In 2020, our content team published 90 blog posts.

Engineers undertook 120 new engagements/projects in 2020.

Over the course of the year, we held 15 webinars with 370 attendees.

Our audience engagement on LinkedIn grew by 563% (follow us!).

Our incredible team of engineers spent 51,728.75 hours on engagements, delivering exceptional solutions, services, and results for our customers.

We launched 1 incredible new platform for Splunk: Atlas.

Our incredible team of engineers spent 51,728.75 hours on engagements, delivering exceptional solutions, services, and results for our customers.


28% of our colleagues joined after March 12, 2020, meaning that our Work From Anywhere (WFA) policy is the norm for almost one-third of the company.

Our internal IT department resolved 449 tickets for colleagues over the course of the year.

We welcomed 33 new colleagues and offered 32 promotions.

The average tenure for KGI colleagues is 2.75 years, which exceeds the average tenure of tech companies like Apple and Google by nearly a year.

Altogether, colleagues completed 385 assignments on Lessonly.

Over 200 devices were “delivered” to colleagues working from anywhere.

We welcomed 33 new colleagues and offered 32 promotions.


Colleagues recognized each others’ work with 377 culture coin nominations.

100+ songs were featured over the course of the year on our Kinney Tunes colleague playlist.

We ordered 150 #hoodies for our Atlas launch in November.

Our 2021 Kickoff boasted 10 sessions hosted by colleagues, for colleagues, including bread-baking, “For Bees’ Sake,” and a virtual fitness challenge.

Colleagues recognized each others’ work with 377 culture coin nominations.

But Most Importantly…

We are One Team, and we can’t wait to see what 2021 has in store!

As the year progresses, make sure to follow us on Facebook, LinkedIn, and Twitter to stay tuned. We’ll be updating the blog regularly with Splunk tips and tutorials, Atlas announcements, insights into Kinney Group culture, and more! Special thanks to Joi Redmon, John Stansell, Christina Watts, Cory Brown, Alex Pallotta, Wes Comer, Brock Trusty, and Zach Vasseur for their help in gathering data for this report.

Splunk 101: Data Parsing


When users import a data file into Splunk, they’re faced with a dense, confusing block of characters in the data preview. What you really need is to make your data more understandable and more accessible. That’s where data parsing and event breaking come in.

In this brief video tutorial, TechOps Analyst, Hailie Shaw, walks you through an easy way to optimize and configure event breaking— spoiler alert: it boils down to two settings in props.conf.

This function within Splunk can greatly simplify the way you interact with your data. After learning it, you’ll get the insights you need, faster.

Event Breaking

When importing data into your Splunk instance, you’ll want to be able to separate it based on events, which enables legibility and ease of interpretation. Because the imported data file isn’t pre-separated, event breaking is an essential skill. The most important part in separating data is the line breaker within the event boundary, which is how Splunk decides how to group and separate certain events.

LINE_BREAKER is how Splunk separates events into different lines. The default = a sequence of new lines, followed by all carriage returns within parentheses.

SHOULD_LINEMERGE is how Splunk merges separate lines into individual events. The default value = true, but should always be set to false as a best practice. If set to true, the value will automatically set to false once Splunk is supplied with your new regex, which provides a specific guide for breaking up new lines and preventing them from merging.

When you import the data file, the term “<event>” appears several times intermittently within the block of data, which is listed as one large event. By pasting the original block of data into, users can identify the <event>s that should ideally begin new lines. Then enter the regex resulting from this step into Splunk in props.conf, which will populate the desired fields.

By selecting regex as the event-breaking policy and entering the pattern from, the data preview will display your data separated into events (each beginning with “<event>”). The regex in props.conf defines both terms listed above. This data preview can now be saved as a new sourcetype.

Learn More!

Learning event breaking can help make your data more organized and legible for members of your team. Kinney Group’s Expertise on Demand service offers a wealth of Splunk tips and knowledge, tailored by analysts like Hailie to your team’s specific needs. Check out the blog for additional tutorials from our engineers. To learn more about Expertise on Demand, fill out the form below!

Contact Us!