The document discusses using machine learning and predictive analytics with Splunk IT Service Intelligence to move from reactive to predictive IT operations. It describes using techniques like linear regression, anomaly detection, and event correlation on machine data to predict issues, analyze trends, and flag anomalies. The presentation also explains how Splunk ITSI can integrate with VictorOps to enable collaborative incident response and reduce mean time to resolution through centralized visibility and on-call workflows. Key takeaways are that Splunk ITSI provides out-of-the-box prediction capabilities and the ability to build custom models, flag issues rapidly, and that VictorOps improves collaboration and time to remediate incidents.

1. © 2019 SPLUNK INC.© 2019 SPLUNK INC.
Predictive, Proactive,
and Collaborative ML with
IT Service Intelligence
Creating Actionable and Predictive Alerts
Through Analytics

2. © 2019 SPLUNK INC.
During the course of this presentation, we may make forward-looking statements regarding future events or
the expected performance of the company. We caution you that such statements reflect our current
expectations and estimates based on factors currently known to us and that actual events or results could
differ materially. For important factors that may cause actual results to differ from those contained in our
forward-looking statements, please review our filings with the SEC.
The forward-looking statements made in this presentation are being made as of the time and date of its live
presentation. If reviewed after its live presentation, this presentation may not contain current or accurate
information. We do not assume any obligation to update any forward-looking statements we may make. In
addition, any information about our roadmap outlines our general product direction and is subject to change
at any time without notice. It is for informational purposes only and shall not be incorporated into any contract
or other commitment. Splunk undertakes no obligation either to develop the features or functionality
described or to include any such feature or functionality in a future release.
Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in
the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2019 Splunk Inc. All rights reserved.
Forward-Looking Statements

3. © 2019 SPLUNK INC.
1. Why You Need to Stop Being Reactive
2. Data and Machine Learning: How to Get
to a Predictive IT
3. Collaborate and Remediate with
VictorOps
4. Demo
Agenda

4. © 2019 SPLUNK INC.
Why You Need to Stop
Being Reactive

5. © 2019 SPLUNK INC.
The Cost of an Incident
Customer
Satisfaction
Brand
Reputation
Line of
Revenue
*According to “Damage Control: The Impact of Critical IT
Incidents”
$ 141,628
the mean business
cost of an IT incident

6. © 2019 SPLUNK INC.
Predict and Prevent Operational Issues with AI
$ Impact
Proactive
(add logs and metrics)
Effective
$ Impact
Existing
Events
Cost of
Impact
Reactively Alerted
MTTR
Automated Resolution
MTTR
MTTR
Splunk ML Alert

7. © 2019 SPLUNK INC.
Predict and Prevent Operational Issues with AI
$ Impact
Predictive
Proactive
(add logs and metrics)
Effective
$ Impact
Existing
Events
NEGATIVE
MTTR!!
Predict 30 Minutes
in Advance
Time
Return to
Business
Cost of
Impact
Reactively Alerted
MTTR
Automated Resolution
MTTR
MTTR
Splunk ML Alert

8. © 2019 SPLUNK INC.
Data and Machine
Learning: How to Get
to a Predictive IT

9. © 2019 SPLUNK INC.
► What is Machine Learning?
► Supervised / Unsupervised Learning
► Predictive Analytics / Anomaly Detection / Event Correlation
► Predictive Analytics: Linear Regression
► Anomaly Detection
Machine Learning for Predictive IT

10. © 2019 SPLUNK INC.
What is Machine Learning?
Supervised Learning Unsupervised Learning
Reinforcement Learning
Cat
Dog
Machine Learning
to adapt to new circumstances and to
detect and extrapolate patterns

11. © 2019 SPLUNK INC.
Getting Answers From Your Data!
Clustering
• Identify peer groups
• Event correlation
• Reduce alert noise
• Behavioral analytics
• ITSI Event Analytics
Predictive Analytics
• Predict Service Health Score
• Predicting churn
• Predicting events
• Trend forecasting
• Detecting influencing entities
• Imminent outage prediction
• ITSI Predictive Analytics
Anomaly Detection
• Deviation from past behavior
• Deviation from peers
• Unusual changes in features
• ITSI MAD Anomaly
Detection

12. © 2019 SPLUNK INC.
Predictive Analytics

13. © 2019 SPLUNK INC.
Univariate Linear Regression
_time

14. © 2019 SPLUNK INC.
Univariate Linear Regression
_time

15. © 2019 SPLUNK INC.
Multivariate Linear Regression
_time date_hour date_wday

16. © 2019 SPLUNK INC.
Multivariate Linear Regression
_time date_hour date_wday

17. © 2019 SPLUNK INC.
Multivariate Linear Regression
_time date_hour date_wday

18. © 2019 SPLUNK INC.
Multivariate Linear Regression
Predict Algorithm LLP: Seasonal local level

19. © 2019 SPLUNK INC.
Multivariate Linear Regression
Predict Algorithm LLP: Seasonal local level

20. © 2019 SPLUNK INC.
Anomaly Detection

21. © 2019 SPLUNK INC.
Anomaly Detection

22. © 2019 SPLUNK INC.
Anomaly Detection

23. © 2019 SPLUNK INC.
Anomaly Detection

24. © 2019 SPLUNK INC.
Multivariate Linear Regression
Residuals

25. © 2019 SPLUNK INC.
Multivariate Linear Regression
Residuals
Thanksgiving
November 27, 2015

26. © 2019 SPLUNK INC.
Cohesive Anomaly Detection

27. © 2019 SPLUNK INC.
IT Service Intelligence

28. © 2019 SPLUNK INC.
Collaboration and
Remediation with
VictorOps

29. © 2019 SPLUNK INC.
When these products find
broken stuff, they send the
information to VictorOps
VictorOps processes the
stream of event data
VictorOps engages the correct
people to collaboratively solve
the problem
Connect Your Experts with the Right Information

30. © 2019 SPLUNK INC.
TROUBLESHOOTING
MEANINGFUL
ALERTS
Event Analytics
• Reduce Event Noise
• Reduce High Priority
Tickets
• Increase Mean Time
Between Failures
From Monitoring to Collaborative Incident Response
ITSI and VictorOps offer complementary value
Service Insights
• Reduce Mean Time
to Resolution (MTTR)
• Single and Correlated
View of IT and Business KPIs
• Predict and Prevent
Imminent Outages
• On-Call scheduling made simple
• Centralized visibility to alerts
• Customizable Rules and Logic
to automate alerting
• Post-Incident Reviews
and Reporting
• Actionable Mobile Application

31. © 2019 SPLUNK INC.
Demonstration

32. © 2019 SPLUNK INC.
Put AI at the Heart of Your Operations
Splunk ITSI for AIOps
Processed events 8 minutes
faster, on average
15% improvement in SLA
performance
Reduced the number
of IT incidents fivefold,
decreased MTTR
by 65%
Predicted their Service
Health Score’s impact
20-30 minutes into
the future
Effective Proactive Predictive

33. © 2019 SPLUNK INC.
Predict
ITSI and Sophisticated
Machine Learning
Forecast
Statistical Anomalies and
Forecasts (Parts 1,2,3)
Collaborate
Resources
How-To Blogs at Your Disposal

34. © 2019 SPLUNK INC.
What to Remember
and Where to Go if
You Fell Asleep
Key
Takeaways
1. Splunk ITSI provides out of the box KPI Prediction
capabilities
2. Use Machine Learning through MLTK to build
custom prediction models for a repeatable ability to
Predict Service Health
3. Splunk ITSI allows for Rapid Service, KPI, Entity
creation and alerting
4. VictorOps makes on-call suck less through
collaboration and improves the Mean Time to
Remediate Availability Impacting Situations
5. Read the blogs!

35. © 2019 SPLUNK INC.
Questions?
Please feel free