Manage child organizations

Use child organizations to separate users and data for business units, teams, or environments while allocating subscription quantities from a parent organization.

Each child organization is separate from the parent organization and other child organizations.

Child organization management capabilities

An administrator of an eligible paid parent organization can use the Child organizations page to:

  • View child organizations.
  • Create a child organization.
  • Assign an administrator when creating a child organization.
  • Allocate parent subscription quantities to a child organization.
  • Rename a child organization.
  • Change a child organization's subscription allocations.
  • Decommission a child organization.

Changes made through the page synchronize to Salesforce after the provisioning operation succeeds.

Prerequisites

Before you manage child organizations, confirm the following requirements:

  • You are an administrator of a paid parent organization.
  • Only parent organization admins will be able to see the child organization management page.
  • The child organization name is unique within the parent organization.
  • You have the email address of the person who will administer the child organization.
  • The parent organization has active subscription quantities available to allocate.
Note: Trial organizations and child organizations cannot access parent-level child organization management.

Create a child organization

  1. Log in to the paid parent organization in Splunk Observability Cloud.
  2. In the navigation menu, select Settings, then Child organizations.
  3. Select Create child organization.
  4. Enter a unique name for the child organization.
  5. Allocate one or more subscription quantities from the parent organization.

    The contracted quantity is the quantity purchased for the parent organization. The available quantity is the contracted quantity minus quantities already allocated to active child organizations.

  6. Continue to the administrator step.
  7. Enter the child organization administrator's email address.
  8. Review the child organization name, administrator, and subscription allocations.
  9. Select Create Organization.

After provisioning succeeds, the child organization appears on the Child organizations page. The assigned child organization administrator receives an email with access information.

Rename a child organization

  1. On the Child organizations page, locate the child organization.
  2. Open its actions menu and select Rename.
  3. Enter a unique name.
  4. Select Save.

The updated name appears on the Child organizations page.

Change subscription allocations

Note: Only admins can re-allocate licenses.
  1. On the Child organizations page, locate the child organization.
  2. Select View allocation.
  3. Select Edit.
  4. Change the subscription quantities.

    You can't allocate more than the quantity available from the parent organization.

    Allocate licenses
  5. Select Save Changes.

The allocation view reflects the saved quantities after the operation succeeds.

Decommission a child organization

Warning: Decommissioning a child organization is irreversible.

Contact Splunk Support for guidance before decommissioning a child organization.

  1. On the Child organizations page, locate the child organization.
  2. Open its actions menu and select Decommission. Decomission
  3. Confirm the Decommission action.

Points to note

  • Only administrators of eligible paid parent organizations can access child organization management.
  • A child organization cannot manage other child organizations.
  • The total quantity allocated across active child organizations cannot exceed the parent organization's available subscription quantity.
  • Child organization names must be unique within the parent organization.
  • SAML configuration management is outside the documented UI scope.
  • The feature doesn't provide child organization usage analytics. Use the existing subscription usage reports to view parent and child usage.

Troubleshooting

Table 1. Child organization management issues
Issue Cause Resolution
Child organizations doesn't appear The user is not an administrator, the organization is a trial or child organization, or the feature is not enabled for the organization. Confirm that you are logged in as an administrator of an eligible paid parent organization. Contact Splunk Support if the page remains unavailable.
The child organization cannot be created The name is already in use, the administrator email is invalid, no subscription quantity is selected, or provisioning failed. Enter a unique name, verify the email address, select at least one subscription quantity, and try again. If the issue continues, contact Splunk Support.
No subscriptions are available The parent organization has no active subscription quantities that can be allocated. Confirm the parent organization's subscriptions with your account team.
An allocation exceeds the available quantity Other active child organizations already use part of the parent's contracted quantity. Reduce the requested quantity or reduce an allocation from another child organization.
A rename appears to fail The new name isn't unique, or the child organization list hasn't refreshed yet. Confirm that the name is unique, refresh the page, and verify the current name before retrying.