Splunk Overview | Splunk for IT Operations | Extend and Accelerate with Apps | Splunk IT Service Intelligence (ITSI) | Splunk for Business Analytics

1. Copyright © 2015, Splunk Inc.
Splunk for IT Opera>ons
and IT Service Intelligence
14. April 2016
Moscow
Philipp Drieger
Sales Engineer DACH & EE
EMEA Central SME IoT & ML

2. Copyright © 2015, Splunk Inc.
Agenda
• Splunk Overview
• Splunk for IT Opera>ons
• Extend and Accelerate with Apps
• Splunk IT Service Intelligence (ITSI)
• Splunk for Business Analy>cs

3. Copyright © 2015, Splunk Inc.
Splunk Overview

4. Copyright © 2015, Splunk Inc. Copyright © 2015 Splunk Inc.
Big Data Comes from Machines
Volume | Velocity | Variety | Variability
GPS,
RFID,
Hypervisor,
Web Servers,
Email, Messaging
Clickstreams, Mobile,
Telephony, IVR, Databases,
Sensors, TelemaEcs, Storage,
Servers, Security Devices, Desktops
4

5. Copyright © 2015, Splunk Inc. Copyright © 2015 Splunk Inc.
Turn Machine Data into Opera>onal Intelligence
INDEX ANY MACHINE DATA: ANY SOURCE, TYPE, VOLUME
Online
Services
Web
Services
Servers
Security GPS
Loca>on
Storage
Desktops
Networks
Packaged
Applica>ons
Custom
Applica>ons Messaging
Telecoms
Online
Shopping
Cart
Web
Clickstreams
Databases
Energy
Meters
Call Detail
Records
Smartphones
and Devices
RFID
On-
Premises
Private
Cloud
Public
Cloud
GAIN REAL-TIME VISIBILITY
ApplicaEon Delivery
Security and
Compliance
Infrastructure
Monitoring
Business AnalyEcs
Internet of Things
5

6. Copyright © 2015, Splunk Inc.
Splunk for IT Opera>ons

7. Copyright © 2015, Splunk Inc.
CIO Obstacle: Escala>ng IT Complexity
SERVERS STORAGE NETWORKING
VIRTUALIZATION
INFRASTRUCTURE
APPLICATIONS
PACKAGED
APPLICATIONS
CUSTOM
APPLICATIONS
Iden>ty
VPN
IP Phone
HR
Email
Finance
App Svr
DB
Web Svr SaaS/PaaS
IaaS

8. Copyright © 2015, Splunk Inc.
CIO Obstacle: Escala>ng IT Complexity
SERVERS STORAGE NETWORKING
VITUALIZATION
INFRASTRUCTURE
APPLICATIONS
PACKAGED
APPLICATIONS
CUSTOM
APPLICATIONS
Iden>ty
VPN
IP Phone
HR
Email
Finance
App Svr
DB
Web Svr SaaS/PaaS
IaaS
Complex, silo-based
technologies
Disconnected and
outdated point solu>ons
Over 70% of >me spent on
maintaining, not innova>ng

9. Copyright © 2015, Splunk Inc.
Before Splunk
Data
Gathering
DB
App
NW
Storage
Now
What?
….
War Room
Outage
Occurs
Human latency measured in hours or days
Не удается отобразить рисунок. Возможно, рисунок
поврежден или недостаточно памяти для его открытия.
Перезагрузите компьютер, а затем снова откройте файл.
Если вместо рисунка все еще отображается красный
крестик, попробуйте удалить рисунок и вставить его
заново.

10. Copyright © 2015, Splunk Inc.
From Days to Minutes With Splunk
“First
Responder”
2012-12-05 07:04:44 Id=Rd910EAJ City=New York Email.jdoe@gmail.com
product_id=product_i BD-
66.57.19.112 ..[05/Dec/2012 07:05:22:152]”GET /card.do?
action=addtocart &itemid=K9
[1208/12 02:39:03:209 UTC] 000000c6 ConnectionEve A J2CA00561:
ConnectionExeception:[IBM][CLI Driver] SQL1224N
Report and
analyze
Custom
dashboards
Monitor
and alert
Ad hoc
search
2012-12-05 07:04:44 Id=Rd910EAJ
City=New York Email.jdoe@gmail.com
product_id=product_i BD-
66.57.19.112 ..[05/Dec/2012
07:05:22:152]”GET /card.do?
action=addtocart &itemid=K9
[1208/12 02:39:03:209 UTC]
000000c6 ConnectionEve A
J2CA00561: ConnectionExeception:
[IBM][CLI Driver] SQL1224N
Outage
Occurs

11. Copyright © 2015, Splunk Inc.
“Splunk reduced our
escala>ons by 90% and our
problem resolu>on >me by
67%.
“EscalaEons reduced by 90% and MTTR dropped by 67%”
Splunk at Service Desk: Vodafone
Paulo Carvalho
Director Opera>ons
The old way: Disparate IT silos impact Customer Service
• Manually intensive, error-prone processes result in constant escala>ons and long delays
• Expensive, home-grown tools for log collec>on and analysis don’t provide the complete picture
• Disconnected systems create trouble in mee>ng security and compliance mandates
The new way: Provide comprehensive visibility and control
✓ A single Tier 1 support person can now perform itera>ve searches across all their IT data to
inves>gate, iden>fy, and fix the problem – escala>ons reduced by 90 percent
✓ Splunk consolidates logs from disparate systems into a single view, providing visibility across end-
to-end service delivery from one place - >me to problem resolu>on dropped by 67%
✓ Role-based secure access to logs via Splunk ensures SOX compliance
✓ Monitor IT data and find issues before they become visible to customers

12. Copyright © 2015, Splunk Inc.
Splunk : The Beher Approach For IT
12
Customer
Facing Data
Outside the
Datacenter
ApplicaEons
Web logs
Log4J, JMS, JMX
.NET events
Code and scripts
Networking
Configura>ons
syslog
SNMP
nejlow
Databases
Configura>ons
Audit/query logs
Tables
Schemas
VirtualizaEon
& Cloud
Hypervisor
Guest OS, Apps
Cloud
Linux/Unix
Configura>ons
syslog
File system
ps, iostat, top
Windows
Registry
Event logs
File system
sysinternals
Logfiles Configs Messages Traps
Alerts
Metrics Scripts Tickets Changes
Click-stream data
Shopping cart data
Online transac>on
data
Manufacturing,
logis>cs…
CDRs & IPDRs
Power consump>on
RFID data
GPS data
Powerful, end-to-end, real->me plajorm for Machine Data

13. Copyright © 2015, Splunk Inc.
Splunk : The Beher Approach For IT
13
Customer
Facing Data
Outside the
Datacenter
ApplicaEons
Web logs
Log4J, JMS, JMX
.NET events
Code and scripts
Networking
Configura>ons
syslog
SNMP
nejlow
Databases
Configura>ons
Audit/query logs
Tables
Schemas
VirtualizaEon
& Cloud
Hypervisor
Guest OS, Apps
Cloud
Linux/Unix
Configura>ons
syslog
File system
ps, iostat, top
Windows
Registry
Event logs
File system
sysinternals
Logfiles Configs Messages Traps
Alerts
Metrics Scripts Tickets Changes
Click-stream data
Shopping cart data
Online transac>on
data
Manufacturing,
logis>cs…
CDRs & IPDRs
Power consump>on
RFID data
GPS data
Powerful, end-to-end, real->me plajorm for Machine Data
No upfront schema
No custom connectors
No RDBMS
• Any amount, any loca>on, any source.

14. Copyright © 2015, Splunk Inc.
Extend and Accelerate with Apps

15. Copyright © 2015, Splunk Inc.
Apps Provide Deep Insights By Role
15
Find and resolve problems fast in individual technology areas
Exchange Admin
Service Health
Performance
Message tracking
VMware/Win/
Linux Admin
Infrastructure Health
Performance
Anomalies/Outliers
Storage Admin
Infrastructure Health
Performance
Anomalies/Outliers

16. Copyright © 2015, Splunk Inc.
Reduce Costs: Consolidate tools, eliminate silos, find root cause faster!
Exchange
Admin
Linux/Win
Admin
Network Admin
Applica>ons
Admin
Line of Business
User
Applica>on
Support
VMware/Linux/
Win Admin
Security Admin Storage Admin IT Management

17. Copyright © 2015, Splunk Inc.
Splunk : Plajorm For IT Opera>onal Intelligence
17
Plug-Ins, Templates and Apps Accelerate Value From Machine Data
No rigid schemas– Add in data from any other source.
API
SDKs UI
Server, Storage,
Network
Server
Virtualization
Operating
Systems
Custom
Applications
Business
Applications
Cloud
Services
App Performance
Monitoring
Ticketing/ and Other
Web Intelligence
Mobile
Applications
Stream

18. Copyright © 2015, Splunk Inc.
Splunk For Opera>ng Systems
Proactive Monitoring
Operational Analytics
End-to-End Visibility
Get instant insight into infrastructure health
OS Metrics for Performance, Capacity & Resource
AllocaAon Analyses
Scale And Correlate Across All Tiers Of Your Technology
Stack
18

19. Copyright © 2015, Splunk Inc.
Splunk For Virtualiza>on & Storage
Proactive Monitoring
Operational Analytics
End-to-End Visibility
Real-Ame acAonable insights into problem spots and
health issues
Real-Ame & historical insights into performance,
security, capacity, forecasAng and change tracking
Scalable Big Data soluAon for holisAc visibility across all
technology Aers
19

20. Copyright © 2015, Splunk Inc.
Splunk for IT Service Intelligence

21. Copyright © 2015, Splunk Inc.
INTRODUCING
Data-driven service insights
for root-cause isola>on and
improved service opera>ons

22. Copyright © 2015, Splunk Inc. Copyright © 2015 Splunk Inc.
Current Challenges
22
Can’t access the data that mahers
Mul>ple products lack deep integra>on
Complex and customized tools require
significant exper>se and >me
IT organizaAons conAnue to struggle with aligning operaAons with business
FRAGMENTED INSIGHTS
SLOW & REACTIVE
INEFFICIENT
& UNSCALABLE

23. Copyright © 2015, Splunk Inc.
Splunk IT Service Intelligence
23
Data Driven
• All IT Data - events, metrics, and logs
Service-awareness
• Provides ac>onable insights into high visibility services
• Personal contextual visualiza>ons
• Mi>gate problems before they impact customers.
Powerful Plajorm
• Fast correla>on across services & KPIs
• Deploys Quickly
• Scalable, flexible and fast >me-to-value
• Scalable Universal Plajorm (any point in >me)

24. Copyright © 2015, Splunk Inc.
What Makes Splunk ITSI Different!
24
Search-Based KPIs
Easy to write, manage and change both
services and KPIs
Reflects business and technology
priori>es
Benefit: Rapidly generate & change KPIs
to align service health with business
Fiserv – 1000s in just weeks
Full Fidelity Service Health
Adaptable and flexible defini>ons of
service health
One solu>on to go seamlessly
from service reports to root
cause, including raw data
Remains adaptable and yet s>ll
maintains complete historical context
Universal Data Plajorm
Data driven: All IT data
including events, metrics and logs
Schema on-the-Fly
Ask any ques>on of the data
Fast Eme to value
Data fidelity

25. Copyright © 2015, Splunk Inc.
Splunk IT Service Intelligence
Data-driven service monitoring and analy>cs
25
SPLUNK IT SERVICE INTELLIGENCE
Time-Series Index
Plajorm for Machine Data
Dynamic
Service Models
Schema-on-Read Data Model
Common
InformaEon Model
At-a-Glance
Problem Analysis
Early Warning
on Devia>ons
Simplified Incident
Workflows

26. Copyright © 2015, Splunk Inc.
ITSI Core Concepts

27. Copyright © 2015, Splunk Inc.
IT Service Intelligence – Core Concepts
Service Requests
Responses
Web
Technical Services Services
Requests
Responses
Mobile API/
Middleware
Requests
Responses
DNS
Support Desk
Requests
Responses
Customer
TransacEons
Requests
Responses
Business Services

28. Copyright © 2015, Splunk Inc.
Packet Network
Hypervisor and Hosts
RDBMSs
Storage Tier
API Services
Web Services In ITSI, a Service is a logical
group of technology
components that a user
deems need to be monitored
together.
IT Service Intelligence – Core Concepts
Service Requests
Responses
Web
Technical Services Services
Customer TransacEons
Web
Customer
TransacEons
Requests
Responses
Business Services
Mobile API/
Middleware
Support Desk
DNS

29. Copyright © 2015, Splunk Inc.
IT Service Intelligence – Core Concepts
Service Requests
Responses
Web
Technical Services
Packet Network
Hypervisor and Hosts
RDBMSs
Storage Tier
API Services
Web Services
Web
KPI: Number of requests
KPI: Error rate
KPI: Average response >me
KPI: Servicer CPU load
KPI: Server network I/F errors
KPIs
KPIs and Health scores
cons>tute the means
by which Services are
monitored.
Health Score

30. Copyright © 2015, Splunk Inc.
IT Service Intelligence – Core Concepts
30
A Health Score is a score form 0-100 (0 being cri>cal and
100 being normal) that helps determine the health of a
Service. It is calculated based on all KPIs importance and
its status (e.g. green, orange, red), once every minute.
A Key Performance Indicator (KPI) is a Splunk saved
search created within the ITSI UI that helps monitor a
specific field like CPU, Memory, Number of Errors and so
on. KPIs are contained within Services.
Service Analyzer – Auto generated filterable and >led
view of Service health scores and KPIs

31. Copyright © 2015, Splunk Inc.
IT Service Intelligence – Core Concepts
31
A Glass Table is a customizable free form
drawing dashboards to view Health scores and
KPIs of choice with visual tools to create
context with live widgets
Go Deeper to a
Deep Dive View

32. Copyright © 2015, Splunk Inc.
IT Service Intelligence – Core Concepts
32
Deep Dives – Swim lane analysis
dashboard to show all those
indicators over >me for
inves>ga>ons

33. Copyright © 2015, Splunk Inc.
IT Service Intelligence – Core Concepts
33
MulE KPI Alerts – Visual tool to create
correla>on searches based on KPIs

34. Copyright © 2015, Splunk Inc.
Notable Events
34
Notable Events are generated by correla>on searches that indicate service
degrada>on. They are like Notable Events in ES but have a slightly different
field set The Correla>on searches are generated either through the correla>on
search UI or Mul> KPI Alert UI.

35. Copyright © 2015, Splunk Inc.
Splunk for Business Analy>cs

36. Copyright © 2015, Splunk Inc. Copyright © 2015 Splunk Inc.
Real Time C level Glass table…

37. Copyright © 2015, Splunk Inc. Copyright © 2015 Splunk Inc.
..drills down to individual BPA Stake holder t glass
table ….
37

38. Copyright © 2015, Splunk Inc. Copyright © 2015 Splunk Inc. 38
..drills down to the individual pa>ent journey

39. Copyright © 2015, Splunk Inc.
Adap>ve Thresholding

40. Copyright © 2015, Splunk Inc.

41. Copyright © 2015, Splunk Inc.

42. Copyright © 2015, Splunk Inc.

43. Copyright © 2015, Splunk Inc.
Thanks – Q&A