![From Days to Minutes With Splunk
“First
Responder”
2012-12-05 07:04:44 Id=Rd910EAJ City=New York Email.jdoe@gmail.com
product_id=product_i BD-
66.57.19.112 ..[05/Dec/2012 07:05:22:152]”GET /card.do?action=addtocart
&itemid=K9
[1208/12 02:39:03:209 UTC] 000000c6 ConnectionEve A J2CA00561:
ConnectionExeception:[IBM][CLI Driver] SQL1224N
Report and
analyze
Custom
dashboards
Monitor
and alert
Ad hoc
search
2012-12-05 07:04:44 Id=Rd910EAJ
City=New York Email.jdoe@gmail.com
product_id=product_i BD-
66.57.19.112 ..[05/Dec/2012
07:05:22:152]”GET
/card.do?action=addtocart
&itemid=K9
[1208/12 02:39:03:209 UTC]
000000c6 ConnectionEve A
J2CA00561:
ConnectionExeception:[IBM][CLI
Driver] SQL1224N
Outage
Occurs](https://image.slidesharecdn.com/splunkforitoperationsbreakoutsession-151015110019-lva1-app6891/75/Splunk-for-IT-Operations-Breakout-Session-6-2048.jpg)
Uploaded bySplunk
Splunk for IT Operations Breakout Session
This document discusses how Splunk provides new visibility and analytics for IT operations. It notes that IT environments are becoming increasingly complex with more servers, applications, virtualization, and cloud services. Splunk offers a platform for operational intelligence that can consolidate machine data from various sources and provide search, monitoring, and analytics capabilities. It also discusses how Splunk apps can provide deep insights into specific technology areas.
More Related Content
Similar to Splunk for IT Operations Breakout Session
![Devfest Harare 2025 Slides [GDG Harare] - Combined Slide Deck](https://cdn.slidesharecdn.com/ss_thumbnails/ilovepdfmerged12-251029161756-3b829161-thumbnail.jpg?width=640&height=640&fit=bounds)
Splunk for IT Operations Breakout Session
- 1. Delivering New Visibilityand Analytics for IT Operations
- 2. During the courseof this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward- looking statements, please review our filings with the SEC. The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward-looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not, be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release. Splunk, Splunk>, Splunk Storm, Listen to Your Data, SPL and The Engine for Machine Data are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. ©2013 Splunk Inc. All rights reserved. Legal Notices 2
- 3. Copyright © 2015Splunk Inc. CIO Obstacle: Escalating IT Complexity 3 SERVERS STORAGE NETWORKING VIRTUALIZATION INFRASTRUCTURE APPLICATIONS PACKAGED APPLICATIONS CUSTOM APPLICATIONS Identity VPN IP Phone HR Email Finance App Svr DB Web Svr SaaS/PaaS IaaS
- 4. Copyright © 2015Splunk Inc. CIO Obstacle: Escalating IT Complexity 4 SERVERS STORAGE NETWORKING VITUALIZATION INFRASTRUCTURE APPLICATIONS PACKAGED APPLICATIONS CUSTOM APPLICATIONS Identity VPN IP Phone HR Email Finance App Svr DB Web Svr SaaS/PaaS IaaS Complex, silo-based technologies Disconnected and outdated point solutions Over 70% of time spent on maintaining, not innovating
- 5. Before Splunk Data Gathering DB App NW Storage Now What? …. War Room Outage Occurs Humanlatency measured in hours or days
- 6. From Days toMinutes With Splunk “First Responder” 2012-12-05 07:04:44 Id=Rd910EAJ City=New York [email protected] product_id=product_i BD- 66.57.19.112 ..[05/Dec/2012 07:05:22:152]”GET /card.do?action=addtocart &itemid=K9 [1208/12 02:39:03:209 UTC] 000000c6 ConnectionEve A J2CA00561: ConnectionExeception:[IBM][CLI Driver] SQL1224N Report and analyze Custom dashboards Monitor and alert Ad hoc search 2012-12-05 07:04:44 Id=Rd910EAJ City=New York [email protected] product_id=product_i BD- 66.57.19.112 ..[05/Dec/2012 07:05:22:152]”GET /card.do?action=addtocart &itemid=K9 [1208/12 02:39:03:209 UTC] 000000c6 ConnectionEve A J2CA00561: ConnectionExeception:[IBM][CLI Driver] SQL1224N Outage Occurs
- 7. “Splunk reduced our escalationsby 90% and our problem resolution time by 67%. “Escalations reduced by 90% and MTTR dropped by 67%” Splunk im Service Desk: Vodafone Paulo Carvalho Director Operations Theoldway:DisparateITsilosimpactCustomerService • Manuallyintensive,error-proneprocessesresultinconstantescalationsandlongdelays • Expensive,home-growntoolsforlogcollectionandanalysisdon’tprovidethecompletepicture • Disconnectedsystemscreatetroubleinmeetingsecurityandcompliancemandates Thenewway:Providecomprehensivevisibility andcontrol ✓ Asingle Tier1support person can now perform iterative searches across alltheir IT data to investigate, identify, and fixthe problem – escalations reduced by90percent ✓ Splunk consolidates logs from disparate systems into asingle view, providing visibility across end- to-end service delivery from one place -time to problem resolution dropped by67% ✓ Role-based secure access to logs via Splunk ensures SOX compliance ✓ Monitor IT data and find issues before they become visible to customers
- 8. Copyright © 2015Splunk Inc. Splunk : The Better Approach For IT 8 Customer Facing Data Outside the Datacenter Applications Web logs Log4J, JMS, JMX .NET events Code and scripts Networking Configurations syslog SNMP netflow Databases Configurations Audit/query logs Tables Schemas Virtualization & Cloud Hypervisor Guest OS, Apps Cloud Linux/Unix Configuration s syslog File system ps, iostat, top Windows Registry Event logs File system sysinternals Logfiles Configs Messages Traps Alerts Metrics Scripts TicketsChanges Click-stream data Shopping cart data Online transaction data Manufacturing, logistics… CDRs & IPDRs Power consumption RFID data GPS data Powerful, end-to-end, real-time platform for Machine Data
- 9. Copyright © 2015Splunk Inc. Splunk : The Better Approach For IT 9 Customer Facing Data Outside the Datacenter Applications Web logs Log4J, JMS, JMX .NET events Code and scripts Networking Configurations syslog SNMP netflow Databases Configurations Audit/query logs Tables Schemas Virtualization & Cloud Hypervisor Guest OS, Apps Cloud Linux/Unix Configuration s syslog File system ps, iostat, top Windows Registry Event logs File system sysinternals Logfiles Configs Messages Traps Alerts Metrics Scripts TicketsChanges Click-stream data Shopping cart data Online transaction data Manufacturing, logistics… CDRs & IPDRs Power consumption RFID data GPS data Powerful, end-to-end, real-time platform for Machine Data Noupfrontschema Nocustomconnectors NoRDBMS •Any amount, any location, any source.
- 10. Copyright © 2015Splunk Inc. Splunk Enables the Connected Datacenter 10 SERVER, STORAGE, NETWORKING VIRTUALIZATION INFRASTRUCTURE APPLICATIONS PACKAGED APPLICATIONS CUSTOM APPLICATIONS CLOUD SERVICES Operational Visibility Gain operational visibility to make better- informed IT decisions. Proactive Monitoring Monitor infrastructure to identify issues, problems and attacks before they impact your customers and services. Search and Investigation Find and fix problems across the organization using machine data. Business Insights Gain real-time insight from your machine data to make better-informed business decisions.
- 11. Copyright © 2015Splunk Inc. Splunk Apps Accelerate Insight
- 12. Copyright © 2015Splunk Inc. Apps Provide Deep Insights By Role Find and resolve problems fast in individual technology areas Exchange Admin Service Health Performance Message tracking VMware/Win/ Linux Admin Infrastructure Health Performance Anomalies/Outliers Storage Admin Infrastructure Health Performance Anomalies/Outliers 12
- 13. Copyright © 2015Splunk Inc. End to End Correlation With Splunk Enterprise Reduce Costs: Consolidate tools, eliminate silos, find root cause faster! Exchange Admin Linux/Win Admin Network Admin Applications Admin Line of Business User Application Support VMware/Linux/ Win Admin Security Admin Storage Admin IT Management 13
- 14. Copyright © 2015Splunk Inc. Powerful Cross-Tier Operational Analytics Harness IT data for business decision-making Data driven decisions across the enterprise Forecasting and planning Root cause analysis Proactive alerting User/Usage analytics Change monitoring Security and forensics 14
- 15. Copyright © 2015Splunk Inc. Splunk : Platform For IT Operational Intelligence 15 Plug-Ins, Templates and Apps Accelerate Value From Machine Data No rigid schemas– Add in data from any other source. API SDKs UI Server, Storage, Network Server Virtualization Operating Systems Custom Applications Business Applications Cloud Services App Performance Monitoring Ticketing/ and Other Web Intelligence Mobile Applications Stream
- 16. Copyright © 2015Splunk Inc. Splunk For Operating Systems Proactive Monitoring Operational Analytics End-to-End Visibility Get instant insight into infrastructure health OS Metrics for Performance, Capacity & Resource Allocation Analyses Scale And Correlate Across All Tiers Of Your Technology Stack 16
- 17. Copyright © 2015Splunk Inc. Splunk For Virtualization & Storage Proactive Monitoring Operational Analytics End-to-End Visibility Real-time actionable insights into problem spots and health issues Real-time & historical insights into performance, security, capacity, forecasting and change tracking Scalable Big Data solution for holistic visibility across all technology tiers 17
- 18. Copyright © 2015Splunk Inc. Live Demo VM-Ware App 18
- 19. Copyright © 2015Splunk Inc. Splunk For Infrastructure & Business Applications Keep the Business Running Increase Productivity Access to Intelligence Proactively monitor the one service that all other systems actively depend on Analyze, report & monitor via simple dashboards and decrease troubleshooting time Get detailed information on irregular activates affecting security policies or SLA 19
- 20. Copyright © 2015Splunk Inc. Live Demo Exchange App 20
- 21. Copyright © 2015Splunk Inc. Splunk Stream Delivers Wire Data Analytics 21 Enhance Operational Intelligence Efficient, Cloud-ready Wire Data Collection Simple Deployment Supports Fast Time to Value Explore, analyze and visualize real-time wire data for Operational Intelligence Instantly access wire data across infrastructures with a simple software solution; manage wire data volumes with fine-grained filtering Enable rapid deployment and reduced complexity with interface-driven install and configuration
- 22. Copyright © 2015Splunk Inc. The Splunk Developer Platform Gain Application Intelligence Increase the speed and efficiency of application development and testing lifecycle Integrate and Extend Splunk Extend Splunk into other applications using the SDKs, programmatic control over search commands and data ingestion Build Splunk Apps Build Splunk apps with flexible UI, custom dashboard and data visualizations, using the Splunk Web Framework 22
- 23. Copyright © 2015Splunk Inc. Thank You
Editor's Notes
- #2 Welcome to SplunkLive [City]. Thank you for taking the time to attend today’s event.
- #8 Company Background: Vodafone Group Plc is the world's leading mobile telecommunications company, providing a wide range of services including voice and data communications. Paulo Carvalho works in Vodafone's DSSL group supports Vodafone live! Which includes popular mobile video, news, music and other services. Paulo is the Services Network Manager at Vodafone Portugal and is responsible for all services on top of GSM Network, MMS, SMS, Voice Mail, Unified Messaging, streaming, Mobile Portal, VAS Services, Prepaid Services. Other Notes: Vodafone uses Splunk for application troubleshooting and management of services they offer over their 3G network. The environment is complex, with many services being offered, running on many platforms and servers - Solaris, Redhat Linux and introducing virtualized environments. They also have a huge Java and J2EE infrastructure and often need to search quickly for errors or exceptions occurring within the last sixty minutes. Vodafone has been a successful user of Splunk realizing significant material benefits. They have also moved to a proactive phase with Splunk, using it to monitor IT data such as threshold levels for specific systems, and fixing issues before they become visible to their customers.
- #9 So how does Splunk help? We offer a powerful, end-to-end, real-time platform for Machine Data. Splunk can collect data from any source, giving our customers real-time visibility and intelligence into what’s happening across the IT infrastructure – whether it’s physical, virtual or in the cloud.
- #10 Splunk’s highly capable platform for machine data can handle any machine generated data from any location and any source – without the need to transform the data to fit a schema, without the need for custom connectors-because unlike most other tools on the market, Splunk does not have a database backend. Splunk’s proprietary map-reduce based high speed index and retrieval system allows management of very large quantities of data at scale with just commodity x86 servers.
- #11 The result of using Splunk for all types of machine data results in enormous benefits to the IT organization as a whole. With data from all tiers of applications and hardware infrastructure in a single central location, customers benefit not just from faster troubleshooting and analysis –but from increasing value as they progress along the ‘maturity model’ . Customers use Splunk and their machine data across IT and the business to gain Operational Intelligence. Operational Intelligence refers to the new levels of visibility and intelligence you gain by harnessing the vast amounts of machine data directly from the systems that support IT and the business. Remember how our CIOs are faced with the challenges of silo-ed tools and having lots of sources of data in non-standard formats. With Splunk, they can start to go up the maturity ladder. Stage 1 is “search and investigate”. In this stage, customers use data in Splunk to find and fix problems dramatically faster across their organization using IT data. You can think of it as finding that “needle in the haystack”, or “multiple needles in multiple haystacks”. Just by effectively harnessing this data, customers have experienced up to 70% improvements in mean time to identify and resolve issues. This alone removes much of the human latency experienced “in the trenches”. Stage 2 is Proactive Monitoring: Turn any root cause analyses into proactive alerts to prevent the same issues from impacting your infrastructure. Find any patterns across different types of data to fill visibility gaps and proactively adapt monitoring to identify issues before they impact customers and services. Systems that used to experience outages have remained running because of implementation of this approach. Macy’s is an excellent example of this concept. They have had 100% up-time for the macys.com site for two straight seasons even with a 50% increase in transactions. Stage 3 is Operational Visibility. Customers gain end-to-end visibility to track and deliver on IT KPIs and make better-informed IT decisions. Rolling up visibility to align it to IT KPIs (how IT is measured by the business) provides unprecedented intelligence to the NOC and senior IT personnel. Being able to spot SLA infractions in real time, or measure utilization as new services are launched enables IT to meet and exceed its objectives. Finally, stage 4 is about delivering business insight - gain insight from operational data to make better-informed business decision. Combining and correlating machine-generated IT data with business data provides unique business insights. Watching the consumption of new online services by channel or demographics. Combining telecoms call records with tariff databases to get a real time view of revenue and 3rd party charges. There is a diverse set of cases where surfacing machine-generated IT data provides operational intelligence to the business.
- #16 Remember we said before, that Splunk is a “platform” for machine data? Splunk has evolved over the years from an engine for any kind of machine data to a robust platform, complete with a REST API, 6 different SDKs and numerous “apps” that sit on top of Splunk and provide out of the box value from your data. These “apps” are available on Splunkbase and they accelerate getting g data into Splunk and getting pre-built visualizations for that data. Note that these apps are not like connectors because they don’t lock away the data in a silo or restrict its usage to particular sets of views – the data is in Splunk and can be used side by side with any other data in Splun k. You can move dashboards and key indicators across apps or customize them in any way you want. Apps make it faster to get value out of your data and several key apps provide new visibility into areas that were formerly “black box” in the infrastructure – such as the virtualization apps. We also recently introduced the 2 new offerings – one to collect wire data, with the Splunk App for Stream (stemming from the acquisition of Cloudmeter) and MINT (Mobile Intelligence) that stems from our acquisition of Bugsense. The Splunk App for Stream enables the capture of real-time streaming wire data, which is the data transmitted between applications over the network. It enables visibility into application, business and user activity without the need for instrumentation, enhancing various operational use cases across IT, security and the business. And Splunk MINT helps you gain visibility into mobile app performance and quality, so you can deliver better mobile apps Splunk MINT helps you combine and correlate mobile app data with other data in Splunk so you can pinpoint problems faster and analyze user experience/behavior across mobile, desktop and web channels. The main value from the apps is providing context for data from silos and making it available inside Splunk for correlation with other data from other silos. In addition to prebuilt apps, customers can also build their own. What have developers been building using Splunk Enterprise? Examples include the following: Run searches and retrieve Splunk data from existing Customer Service/Call Center applications (Comcast use case) Integrate Splunk data into existing BI tools and dashboard (Tableau, MS Excel) Build mobile applications with KPI dashboards and alerts powered by Splunk (Otto Group use case) Log directly to Splunk from remote devices (Bosch use cases) Build customer-facing dashboards powered by user-specific data in Splunk (Socialize, Hurricane Labs use cases) Programmatically extract data from Splunk for long-term data warehousing We hope this is just the beginning. We hope to open up a whole new world of enterprise apps.