SplunkLive! München - Customer Use Case Splunk @ UniCredit

1. Business Activity Monitoring
Overview about Payments Business Process Monitoring Project BOMBAY
Markus Sprunck (US96007), March 2016

2. Agenda
 UniCredit
 Introduction
 User Interface
 Development & Architecture
 Lessons Learned

3. 3
UniCredit - At a glance
 Banking operations in 17 countries
 International network spanning:
~50 countries
 Global player in asset
management: 223,6 bn
in managed assets*
 Market leader in Central and
Eastern Europe leveraging
on the region's structural strengths
more than
144.000* employees
7.934* branches
* Source: UniCredit Company Profile, data as at December 31, 2015

4. UniCredit Business Integrated Solutions: Identity Card
AUSTRIA
ITALY ROMANIA
POLAND
HUNGARY
UK
SLOVAKIA
GERMANY  ~ 10.000 Fte’s*
( y/y pro forma)
■ 11 Countries**
■ 3 Wholly-owned subsidiaries*
* Data as at December 31, 2015.
** UniCredit Business Integrated Solutions operates also in 2 branches, one located in New York and one in Singapore.
UniCredit Business Integrated Solutions is the first concrete milestone within the Group Strategic Plan 2012
announced in November 2011 to be achieved.
Owned by UniCredit, is created from the integration and consolidation of 16 Group companies (among them
UGIS, UCBP, URE, UC) and is dedicated to providing services in the sectors of Information and Communication
Technology (ICT), Back Office and Middle Office, Real Estate, Security and Procurement.
A new business model, unique in the European banking sector, focused on Business needs
(i.e. Commercial Banking, Global Markets, CEE), not only on providing services.
CZ REP.
 NET EQUITY: € 373,394,771*
 TOTAL REVENUE: € 2,546,092,728*
 NET PROFIT: € 238,903*

5. Introduction (1/2)
Monitoring can be divided into three monitoring levels
5
It checks performance and
availability of application
functionality e.g. by simulation end-
user experience, interfaces,
queues etc. – legal constraints to
be considered.
It checks performance and
availability of end to-end
process leveraging also on
functional monitoring
results/application.
It manages and monitors base
infrastructure in terms of
resources utilization (memory,
CPU, file systems, swap, network,
disk space, throughput…) and
main subsystems activity
(processes, services…)
Business
Process
Function
Level
Technology
 Components on Mainframe/Open
(JCL, DB, Server…)
 Application
 Process
Target
GroupAggregation&Integration
 Business- /
Process-
Owner
 IT
Application
Manager
 IT
Application
Manager
 Application
Owner
 Application
Owner
 Operating/
Provider
Server Data
Base
Sto-
rage etc..

6. Introduction (2/2)
The application landscape of payments in a bank is complex

7. User Interface (1/3)
Tube map is the entry point and summarizes the current situation

8. User Interface (2/3)
Most important indicators in business process monitoring
TOO LOW
 less than the
minimal expected
traffic
 red and yellow
thresholds for every
hour of the day
TOO HIGH
 more than the
maximal expected
traffic
 red and yellow
thresholds for every
hour of the day
TOO LONG
 processing
needs longer
than expected
 red if one bulk is
missing
JAM
 processing needs
longer than
expected
 red or yellow
depending on the
number of missing
bulks

9. User Interface (3/3)
Further supporting functionality makes sense
SPECIAL SEARCHES
 In case an indicator shows
problems it is necessary to
find bulks or files in the
systems
DETAIL VIEWS
 For single bulks or files
detailed views are
available to give additional
information
 This includes a history of
all monitoring points with
exact timestamps
AGGREGATIONS
 To get an overview about
the past, current and future
traffic statistical views are
available

10. Development & Architecture (1/2)
Simplified component view
bma-ct
bma*-sepa
bma-cc bma-dd
dbx**
CC data
bma-edit-
parameter
Forwarder
Indexers
Search Heads
CT data DD data
read (event data with search processing language)
sends raw data
others
changes
dashboards
…
bma-xpe
* bma - Business Monitoring Application
** dbx - Splunk DB Connect

11. Development & Architecture (2/2)
Test driven approach is an important success factor
 Because this is an agile developed
software the topic test automation
and regression test is crucial to
keep high velocity
 For all saved-searches and macros
we write tests based on JUnit
and Splunk Java SDK
 When finding a defect we try to
reproduce the issue with a new
test case and after this fix the bug
 We also work on special tests to
measure and estimate the expected
performance

12. Lessons Learned (1/2)
Strengths of Splunk platform
 General dashboard functionality and usability
 Configuration with CSS and HTML
 Role concept and user management
 Powerful internal logging
 Java SDK & REST API are very powerful
 Good support for fast and agile development
 Query language easy to learn

13. Lessons Learned (2/2)
Things that could be improved in Splunk
 Saved-searches and macros should be stored formatted
 Customization of parameters with UI
 localization of numbers & currencies
 Internationalization of column titles
 Some default settings
(e.g. transaction: keepevicted, maxopentxn, maxopenevents)

14. Contact
Markus Sprunck
Senior IT Architect
Payments AM (US96007)
UniCredit Business Integrated Solutions S.C.p.A.
Zweigniederlassung Deutschland
Am Eisbach 4
80538 München; Deutschland
phone : +49 89 378 21009
mobile: +49 160 7106671
mailto : markus.sprunck@unicredit.de