Customer use case presentation

1. Copyright © 2016 Splunk Inc.
Banca Popolare di Sondrio
6 years of Splunk
Piergiorgio Spagnolatti
Head of Infrastructure

2. Banca Popolare di Sondrio – at a glance
Guess what? It’s a bank! ;-)
Based in Sondrio, covering most of northern Italy and Rome
2600-ish employees
330+ branch offices
2 datacenters
Some 1300 servers, 99.7% virtualized

3. Piergiorgio “PJ” Spagnolatti
Name is a tongue-twister, that’s why PJ is there
Head of Infrastructure @ Banca Popolare di Sondrio
VMUG Vice President
VMUGIT co-founder and leader
VMware vExpert ******
Trying to “take the SH out of IT” :-D (courtesy of Splunk t-shirts)

4. I LOVE shells!
• sh? bash? Sure!
• powershell? Indeed!
• grep/regexes? No doubt!
• sed/awk? You bet!
• perl? Don’t even get me started!
• cmd.exe? Ok… not every shell J

5. Once upon a time…
• Searching through logs was fun (for
some)
• Log Management wasn’t a thing.
• Cross-log, much less Cross-server
search wasn’t possible
• High Cost, Low Performance = Bad
Ops

6. Life before Splunk
The “unsolvable” issues:
– Manage logs easily
– Manage logs at scale
– Manage logs securely
– Manage log storage effectively
– Manage hetereogenous data

7. But… there must be a way!

8. Year ONE
Thorough, albeit FAST PoC
Fell in LOVE with the product
First production instance
Mostly ops events/logs/data.

9. Year TWO
Rapid GROWTH in # of users
Rapid GROWTH in ingested data volume
AD Integration (piece of cake!)
First “review” of the arch. model (DS + Search Head, Indexer)

10. Year THREE
INCREASING GROWTH in # of users!!
INCREASING GROWTH in ingested data volume!!!
Log development guidelines <- #protip
Tighter security model (based on event types + AD groups)

11. Year FOUR
INCREASING GROWTH in # of users!!!!
INCREASING GROWTH in ingested data volume!!!!!
Widespread adoption
Growing number of apps from SB, doubled infrastructure

12. Year FIVE
Splunk usage gone wild!:-O
Dashboards, saved searches, etc. popping up all over the place
Lookup tables, DBx integration, “all you can eat” approach
High Availability now a MUST!

13. Year SIX
Splunk promoted to “de facto” core service
Enter… Splunk Enterprise Security
Storage management policies
Integrations, integrations, integrations!

14. Splunk at BPS, Today:
Search Heads Indexers
Light Forwarders
Heavy Forwarder, DBx
Splunk ES
Active Directory
Deployment Server

15. Key Takeaways, Lessons Learned
Log management is possible, indeed.
Scalability is hassle-free.
User Satisfaction is off the charts! (I really mean it).
Splunk Search language is powerful to say the least.
Reporting features get easier at each release, lots of potential towards
biz-centric usage.
Ease of integration is (still) a key advantage.

16. What’s Ahead
Implement “log quality” practices and checks (data cleansing, guidelines
adoption, etc.)
Work on container-based environments (ephemeral, short-lived
instances, shared volume access, etc.)
Promote business usage of IT data (dashboards, etc.).

17. Thank You!
Piergiorgio Spagnolatti
Head of Infrastructure