Gov Day Sacramento 2015 - IT Service Intelligence
•
3 likes•639 views
Improving citizen services: Splunk IT Service Intelligence William Von Alt II, ITOA Lead Practitioner, Splunk
Recommended
More Related Content
What's hot
What's hot (18)
Viewers also liked
Viewers also liked (14)
Similar to Gov Day Sacramento 2015 - IT Service Intelligence
Similar to Gov Day Sacramento 2015 - IT Service Intelligence (20)
More from Splunk
More from Splunk (20)
Recently uploaded
Recently uploaded (20)
Gov Day Sacramento 2015 - IT Service Intelligence
- 1. Copyright © 2015 Splunk Inc. Improving Citizen Services: Splunk IT Service Intelligence William Von Alt II ITOA Lead Practitioner
- 2. Agenda Introduction to Splunk IT Service Intelligence (ITSI) What is a Service? The value of Splunk ITSI: See the forest and the trees Product Highlights Demo Wrap Up LUNCH! 2
- 3. Escalating IT Complexity… SERVERS STORAGE NETWORKING VITUALIZATION INFRASTRUCTURE APPLICATIONS PACKAGED APPLICATIONS CUSTOM APPLICATIONS Identity VPN IP Phone HR Email Finance App Svr DB Web Svr SaaS/PaaS IaaS 3
- 4. … Plaguing IT Operations 4 Complex, silo-based technologies Disconnected and outdated point solutions Reactive brute-force problem resolution Over 80% of time spent maintaining vs. innovating
- 5. Why Another Splunk Solution? 5 Data-centric approach is needed Service context maximizes Splunk value Integrated solution accelerates customer successes
- 6. Data-driven service insights for root-cause isolation and improved service operations INTRODUCING…
- 7. What is a “Service”? (and other fundamental concepts)
- 8. What is a Service? Service Requests Responses In ITSI, a Service is a logical group of technology components that a user deems need to be monitored together. It can often be generalized as a “black box” which we send requests, and expect responses 8
- 9. What is a Service? DNS Requests Responses Technical Services Auth Requests Responses Web Requests Responses Services can be lower level (technical)… 9
- 10. What is a Service? DNS Requests Responses Technical Services Customer Transactions Requests Responses Business Services Auth Requests Responses Web Requests Responses Support Desk Requests Responses But services may also be higher level (business). 10
- 11. What is a Service? Packet Network Hypervisor and Hosts RBMDBs Storage Tier API Services Web Services CustomerTransactions Mobile API/Middleware PartnerPortal DNS Services encompass multiple tiers of the IT domain. Services may also depend upon other services. 11
- 12. What is a KPI? DNS Requests Responses KPI: Number of requests KPI: Error rate KPI: Average response time KPI: Servicer CPU load KPI: Server network I/F errors Customer Transactions Requests Responses KPI: Number of transactions KPI: Error rate KPI: Average response time KPI: Count of Incident Tickets KPI: Synthetic Transx Health KPIs and Health scores constitute the means by which Services are monitored. 12
- 13. Key Performance Indicators (KPIs) 13 A Key Performance Indicator (KPI) is a Splunk saved search created within the ITSI UI that helps monitor a specific field like CPU, Memory, Number of Errors and so on. KPIs are contained within Services.
- 14. Service Health Scores 14 A Health score is a score form 0-100 (0 being critical and 100 being normal) that helps determine the health of a Service. It is calculated based on all KPIs importance and its status (e.g. green, orange, red), once every minute.
- 15. Forests, trees, and leaves (Oh My!?)
- 16. Achieve Service Visibility Faster Service Analyzer High-level view of services and composite health scores Glass Tables Personalized visualizations of your services Deep Dives Organized view of performance indicators across silos Multi KPI Alerts Correlation rules to generate notable events Notable Events Easy-to-understand report on results of correlation searches Anomaly Detection and Adaptive Thresholds Machine learning to baseline normal operations and identify anomalous behavior 16
- 17. Service Analyzer, Glass Tables, Deep Dives 17 Service Analyzer: Auto generated filterable and tiled view of Service health scores and KPIs Glass Tables: Customizable free form drawing dashboards to view health scores and KPIs of choice with visual tools to create context Deep Dives: Swim lane analysis dashboard to show all those indicators over time for investigations
- 18. Multi KPI Alerts, Notable Events 18 Multi KPI Alerts: Correlation searches on service degradation Notable Events: Event framework for Multi KPI Alerts
- 19. 19 Demo Time!
- 21. 21 Customizable Visualizations of Services (Glass Table)
- 22. First Approach
- 23. First Approach
- 24. Using ITSI
- 25. Using ITSI
- 26. 26
- 27. 27
- 28. 28 Unified insights: data integrations from other tools 11,000 to 100s Reduced incident tickets Alerting on service KPI’s instead of server performance Usage baselines to identify anomalies Splunk IT Service Intelligence at
- 29. 29 Server-based to Services-based monitoring Top-down and deep- dive service insights 200+ services and 1500+ KPIs monitored Flexible creation and modification of services and KPIs Alerting on service KPIs instead of server performance Real-time, holistic and proactive “client” view Splunk IT Service Intelligence at
- 30. If you remember only these 3 things…
- 31. Splunk ITSI Expands the Value of Your Data Platform for Machine Data Forwarders with Technology Add-Ons Mobile Stream Servers Storage Hypervisor Integrations APM Monitoring IT Service Intelligence OS Hypervisor App Server Web Server DB Server Storage Load Balancer 31
- 32. Key Takeaways • Rapid Time-to-Value – hours or days vs. weeks – for you and your constituents • See the forest, trees and leaves (i.e. actionable service intelligence) – At a glance problem identification – Service Analyzer – In-context data viz – Glass Tables – Time-based KPI review/Compare to past trends – Deep Dives – Proactive alerting – Multi-KPI Alerting • Service intelligence == Smarter operations 32
- 33. This is awesome! Where can I get it?
- 34. Try it: SPLUNK.COM/ITSI Free trial. In Splunk Cloud.
- 35. Thank You
Editor's Notes
- NOTE: This is the single customer-facing deck for ITSI through the broader launch at .conf2015 (to be repurposed for analysts & partners as necessary). Assumptions: The customer seeing this deck is ALREADY A SPLUNK CUSTOMER The customer seeing this is a large enterprise (>$1B in revenues) with a complex IT environment, several existing point monitoring solutions and an IT-as-a-Service mentality (has the resources to map IT services and sees the value in doing so) Here are the target customer criteria: 50GB or more of Enterprise/Cloud license Understands the concept of IT services Delivers multiple services to the business Needs better approach and effective way to map services and KPIs Likely (but not strictly) larger, more mature IT organizations
- In order to solve these evolving needs, a certain class of customers began to leverage the platform and take advantage of the data they already had indexed within Splunk. They built some pretty sophisticated use-cases to improve operational efficiencies. And they way they are doing this is by adding a service perspective to the data they already have in Splunk. What became apparent as we spoke to those customers was that we have the ability to transform this age-old problem of troubleshooting and monitoring with a new approach driven by machine data. Given our customers had custom built service insights using the data they already had in the platform, it was a natural evolution for us to build an integrated solution based on our customers successes and make Splunk service-aware. This helps our customers to maximize the value they can get from Splunk with a machine data driven approach to monitoring and analytics.
- That brings us to Splunk IT Service Intelligence – a packaged solution that enables real-time visibility into services driven by machine data. Splunk ITSI speeds and simplifies service monitoring and analytics and enables IT to make better, smarter and informed business decisions. This solution allows you to gain a deep understanding of your services. With Splunk ITSI, you have real-time views into the health of your services, and can use advanced analytics to find patterns, detect anomalies and trends to proactively monitor and address issues. As a result you have improved service visibility, reduced resolution times, and a transformative approach to monitoring and analytics driven by machine-data.
- Available on HOD
- A services can literally be sources of data a customer wants to group together to monitor in a single healthscore or just wants to logically group together because they need to be managed by a specific team or needs to be reported in such a way. Services derive their value when KPIs are defined within them or dependencies are defined to other services. Therefore you could have a more abstractly defined service which only depends on other services to derive its own health. E.g. Partner portal is a conceptual service which depends on the API service which in turn has its own KPIs but depends on Web Services. Alternatively you could have Partner portal depend on each and every one in blue, or not even have all the ones in blue and have all the Kpis be inside Partner portal. Everything you see in the diagram above could be a service in ITSI.
- A services can literally be sources of data a customer wants to group together to monitor in a single healthscore or just wants to logically group together because they need to be managed by a specific team or needs to be reported in such a way. Services derive their value when KPIs are defined within them or dependencies are defined to other services. Therefore you could have a more abstractly defined service which only depends on other services to derive its own health. E.g. Partner portal is a conceptual service which depends on the API service which in turn has its own KPIs but depends on Web Services. Alternatively you could have Partner portal depend on each and every one in blue, or not even have all the ones in blue and have all the Kpis be inside Partner portal. Everything you see in the diagram above could be a service in ITSI.
- A services can literally be sources of data a customer wants to group together to monitor in a single healthscore or just wants to logically group together because they need to be managed by a specific team or needs to be reported in such a way. Services derive their value when KPIs are defined within them or dependencies are defined to other services. Therefore you could have a more abstractly defined service which only depends on other services to derive its own health. E.g. Partner portal is a conceptual service which depends on the API service which in turn has its own KPIs but depends on Web Services. Alternatively you could have Partner portal depend on each and every one in blue, or not even have all the ones in blue and have all the Kpis be inside Partner portal. Everything you see in the diagram above could be a service in ITSI.
- A services can literally be sources of data a customer wants to group together to monitor in a single healthscore or just wants to logically group together because they need to be managed by a specific team or needs to be reported in such a way. Services derive their value when KPIs are defined within them or dependencies are defined to other services. Therefore you could have a more abstractly defined service which only depends on other services to derive its own health. E.g. Partner portal is a conceptual service which depends on the API service which in turn has its own KPIs but depends on Web Services. Alternatively you could have Partner portal depend on each and every one in blue, or not even have all the ones in blue and have all the Kpis be inside Partner portal. Everything you see in the diagram above could be a service in ITSI.
- A services can literally be sources of data a customer wants to group together to monitor in a single healthscore or just wants to logically group together because they need to be managed by a specific team or needs to be reported in such a way. Services derive their value when KPIs are defined within them or dependencies are defined to other services. Therefore you could have a more abstractly defined service which only depends on other services to derive its own health. E.g. Partner portal is a conceptual service which depends on the API service which in turn has its own KPIs but depends on Web Services. Alternatively you could have Partner portal depend on each and every one in blue, or not even have all the ones in blue and have all the Kpis be inside Partner portal. Everything you see in the diagram above could be a service in ITSI.
- KPIs are created by the user and the user has to define which Splunk field to monitor, what stat operations to use (e.g. avg cpu, max cpu etc.), what the thresholds for good bad ugly should be, what the frequency of monitoring that field should be and how important it is towards the health of the service. Images: KPIs on the left, health scores on the right.
- KPIs are created by the user and the user has to define which Splunk field to monitor, what stat operations to use (e.g. avg cpu, max cpu etc.), what the thresholds for good bad ugly should be, what the frequency of monitoring that field should be and how important it is towards the health of the service. Images: KPIs on the left, health scores on the right.
- Here is a list of features that we just walked you through. In Splunk ITSI, a Service is a logical group of technology components that you need to be monitored together. These can be business centric or technology specific – end-to-end or siloed – however you want to define it. Once you’ve applied that concept, you have all these visualizations that you can leverage Splunk for. Service Analyzer: Auto-generated filterable and tiled view of service health scores and KPIs Glass Tables: customizable free form drawing dashboards to view health scores and KPIs of choice with visual tools to create context Deep dives: swim lane analysis dashboards to show all those indicators over time for investigations Multi-KPI Alerts: correlation searches on service degradations Notable Events: event framework for multi-KPI alerts that includes incident workflows and lastly Anomaly detection and adaptive thresholds: the ability to leverage machine learning to notice early warning signs of failures and determine subtle pattern changes to detect anomalies and employ machine learning to baseline normal operational patterns and adapt thresholds to changing behavior in real-time
- These are the 4 main dashboards that are in ITSI, SA is for the quick view and quick filtering to see only the Services and KPIs of choice, Glass table is for those who want to represent their own workflow and want to take the time to make things look pretty. Deep Dive is for the investigative work when things go wrong, Multi KPI alerts is to build alerts for when there is a desire to be alerted by email or just view the notable event review dashboard (like Incident review in ES).
- Think ES when talking about notable events. They are nearly identical to ES notable events other than the fact that they are some other fields like Service and the actions you can perform on them are a little different. Like going to Deep Dive or creating ticket in service now. The correlation searches that create these notable events can be designed through the correlation search interface like in ES, or through the Multi KPI alert UI. They are stored in the notable events summary index.
- So we also wanted to give users a good way of looking at this data from a dashboarding perspective. So we built two types of visualization, one called Glass Table and one called Deep Dive. Glass Table provides a powerful, clear way to visualize and organize service data across services/silos in a time-series manner. This is the type of visualization that can be projected on a NOC screen as an overview-like dashboard. One of the features of Glass Table is the ability to upload a PNG or other custom image and overlay given KPIs. But we also have a diagraming tool that is internal to the product. The tool allows users to draw basic shapes, add text, and update colors and borders and basic layers. And then add basic searches and choose from any of the pre-configured KPIs. This view is popular for CIOs.
- Colors are important(green-good, red-bad)…. Performance issues with the network and the storage layer.
- Vodafone is the world’s second largest telecommunications company and provides voice, messaging, data, and fixed communications to over 400 million customers. Vodafone’s offshore IT operations team lacked visibility into the health and performance of the services that were getting rolled out constantly by the project teams, designers and architects in Germany. For example, Vodafone recently rolled out Identity Access Manager, a complex Oracle & WebLogic stack‐based application that governs identity management for Vodafone. Vodafone, an existing Splunk customer, now relies on Splunk IT Service Intelligence to provide its offshore team with the insights they need to support, troubleshoot and monitor services, in real-time. Splunk IT Service Intelligence is integrated with HP Business Service Management and the team can now use the KPIs in IT Service Intelligence to see trends and detect patterns and anomalies, enabling them to act upon that data proactively. With data from Vodafone’s Remedy systems the operations team can also easily see various KPIs including number of open tickets, the status of these tickets and number of impacted users. With Splunk IT Service Intelligence, Vodafone is able to gain end-to-end visibility of the performance and behavior of their IT services, allowing them to improve the performance and uptime of critical services and reducing the number of incident tickets opened every day from over 11,000 to hundreds, improving customer satisfaction and reducing support costs. “Splunk IT Service Intelligence gives Vodafone a real-time understanding of how our services are performing overall and at the more granular level," said Oliver Hoppe, solutions architect, Vodafone. "We have KPIs mapped to critical service components and can provide relevant insights to stakeholders across the business, including management, service owners and the security team. The glass table visualizations in Splunk ITSI make it quick and easy to identify and resolve any issues, preventing any impact on our users. Now we can be much more proactive about our services.
- Fiserv is a global financial services technology provider behind essential services such as mobile and online banking, payments, risk management, data analytics and core account processing - more than 1 in 3 U.S. financial institutions rely on Fiserv for core processing services. Lacking a consistent monitoring approach and frustrated with too many tools, Fiserv initially deployed Splunk Enterprise to deploy Splunk to collect and process data that can feed into existing incident management process. While Splunk Enterprise was supporting faster troubleshooting and issue resolutions, Fiserv needed a way to quickly react to changing environment conditions to alert and prevent reoccurring events BEFORE they happened. The team was struggling to build Splunk dashboards that surfaced the right information and led to decisive action. Fiserv also needed to perform continual education across business units, across support tiers and across shifts on the latest dashboards that looks for specific client impacting conditions. The team had a mandate to achieve these goals in just 90 days. Enter Splunk IT Service Intelligence – with Splunk ITSI, Fiserv was able to: Deliver service based monitoring in a much shorter time frame Empower a tier 1 user with a tool kit to triage and act as a higher tier Develop model out of a problem review to add new KPIs to roll into the service as a hole. Easily correlate issues through a drill down and determine cause vs effect and then dive right into the logs Fiserv leveraged Splunk IT Service Intelligence to enhance their service-based monitoring and empower their users. With Splunk IT Service Intelligence, the Fiserv team is able to collect and process data from multiple sources and locations and integrate that data into an existing incident management process. …all within 90 days from inception to delivery.
- Splunk host/presenter to recap a few points that you want the audience to remember. This is especially relevant for sessions being co presented with a customer to help transition from the customer back to the Splunk host to close out the session. Identify a few points you heard from the customer that tie back to the bigger Splunk picture you outlined in your initial slides that framed the customer story.
- Try before you buy. Get technical. Go try it out in Splunk Cloud right no. We have a sandbox trial ready for you to play in Go see for yourself what it can do. Get your hands dirty and most importantly, have fun. Thank you for your time today. I hope you feel that together, we’re going bring the sexy back to IT services.