Presented at SplunkLive! Warsaw 2016

1. Copyright © 2016 Splunk Inc.
Splunk IT Service
Intelligence
Hans-Henning Gehrts

2. What We Hear From Our Customers!
“My CIO is demanding we look at IT from a business service perspective.”
“Splunk is great for break-fix, but I need to show we’re meeting SLAs.”
“I need everyone to be able to see the same thing at the same time.”
“I just want to throw data at Splunk and have it find problems for me.”
“Show me what my data can do for me!”

3. Rethinking and Improving How IT Operates
3
Traditional IT Data-Driven IT
• Structured data
• Brittle tools and integrations
• Obsession with “faults” and “traps”
• Focus on components parts
• Search oriented
• Structured and unstructured data
• Robust data integrations
• Real-time insights from big data
• Focus on the whole service
• Machine learning-driven analytics

4. 4
What Is Service Intelligence?
Enabling a business-aware IT
Measuring and reporting on indicators that matter
Unlocking operational efficiencies
Collaborating across silos to improve service operations
Data-based decision making
Solving problems and anticipating pitfalls with
sophisticated analytics and powerful insights

5. Machine learning-powered analytics for real-time service
insights, simplified operations and root-cause isolation

6. Why Another Splunk Solution?
6
A data-centric approach is needed
Service context maximizes Splunk value
An integrated solution accelerates customer success

7. Splunk IT Service Intelligence
Machine Learning-Powered, Analytics-Driven IT Operations
Simplify service operations
Prioritize incidents with context Redefine the role of IT
Combine events & metrics
across silos with ease,
flexibility & scale in days
Unify siloed monitoring
Leverage machine learning to
detect anomalies & highlight
events that matter
Deliver business & service context to prioritize
incident investigation & action
Support decisions & communicate results
with powerful service-level insights

8. Key Concepts

9. Terminology Matters
9
Logical grouping of
operations
Online banking,
authentication,
virtualization
EXAMPLES
SERVICES
Set of actions
performed with
specific business goals
Sell products,
fulfill orders,
process payroll
EXAMPLES
BUSINESS PROCESSES
Component required
to deliver a service
Hosts,
users,
OS processes
EXAMPLES
ENTITIES
Metrics used to
evaluate success
Service health,
order revenue,
latency
EXAMPLES
KEY PERFORMANCE
INDICATORS

10. Splunk IT Service Intelligence – Core Concepts
Service Requests
Responses
Web
Technical Services Services
Requests
Responses
Mobile
API/Middleware
Requests
Responses
DNS
Support Desk
Requests
Responses
Customer
Transactions
Requests
Responses
Business Services

11. Packet Network
Hypervisor and Hosts
RDBMSs
Storage Tier
API Services
Web Services In Splunk ITSI, a service is a
logical group of technology
components that a user
deems need to be
monitored together
IT Service Intelligence – Core Concepts
Service Requests
Responses
Web
Technical Services Services
Customer Transactions
Web
Customer
Transactions
Requests
Responses
Business Services
Mobile
API/Middleware
Support Desk
DNS

12. IT Service Intelligence – Core Concepts
Service Requests
Responses
Web
Technical Services
Packet Network
Hypervisor and Hosts
RDBMSs
Storage Tier
API Services
Web Services
Web
Number of requests
Error rate
Average response time
Servicer CPU load
Server network I/F errors
KPIs
KPIs and health scores
constitute the means
by which services are
monitored
Health Score

13. Defining an Entity
13
An entity is an optional sub-element of a KPI.
A KPI can be filtered by entities and viewed
on a per-entity basis or as an aggregate.
The KPI Web Requests might use web servers as entities;
User Logins could use accounts.
Splunk ITSI can import entities from CMDBs & other sources.

14. Service Health Scores
14
A health score is ranked from 0-100 (0 = critical and 100 = normal) that helps
determine the health of a service.
It is calculated based on importance and status (e.g., green, orange, red) of all
KPIs, once every minute.

15. Splunk ITSI Demo

16. Personalized Visualizations of Your Services
• Visualize contextual inter-relationships
across service delivery components
• Illustrate business and service activity using
indicators aligned with strategic goals
• Drive decisions by monitoring service
health against performance indicators
• Create sophisticated dashboards in minutes
16

17. Organized View of Performance Indicators
17
• Organize and correlate KPIs to speed up
investigations and diagnosis
• Compare performance over time and in real
time to understand trends and identify
systemic issues
• Enable broad and deep investigation with
contextual drill-downs

18. Real-Time View of Service and KPI Health Scores
• Get early warning of emerging incidents
with a heat map of service health and
KPI scores, metrics, sparklines and alerts
• Drill down into service and entity details
for in-depth triage
18

19. Insights Into the Origin of Service Disruptions
19
Profile an entity to troubleshoot outages
and service degradations
Identify contributing services and entities
of the worst performing KPIs

20. Correlation Rules Generate Meaningful Events
20
Run predefined correlation searches against learned indicators to generate
notable events based on status and composite scores

21. Sophisticated Event Analytics
21
• Reduce event clutter and false positives
with multivariate anomaly detection
• Automatically conceal duplicate events to
focus on relevant events
• Easily sift through vast amounts of events
by filtering, tagging and sorting
• Enrich and add context to events to make it
informative and actionable

22. Integrate With Existing Incident Workflows
22
Automatically initiate defined incident
and remediation responses
Integrate with ServiceNow to create
tickets and accelerate triage

23. Deep Service-Oriented Insights Into
Technology Domains
● Extend out-of-the-box functionality by
easily integrating with open source
and 3rd-party technologies and tools
23
• Fast-track data collection without
costly add-ons, customizations and
manual configurations
• Gain deep service-oriented insights
with built-in dashboards
• Simplify creation and deployment of
third-party and custom modules

24. Learn What’s Normal and Abnormal
24
Baseline normal operations and alert on
anomalous conditions
Identify abnormal trends and patterns in
KPI data

25. Baseline Trends to Adapt Thresholds
25
Use statistics to dynamically adapt KPI
thresholds by time
Maintain and preserve learned thresholds
to monitor KPI and service behavior

26. Reduce the Administrative Hurdle
26
Enable mass changes to thresholds and searches with templates, reducing the
number of searches and improving performance
Set services and entities into “maintenance” to suppress alerts and accurately
reflect health scores
Create highly available Splunk ITSI environments, revert configurations to
previous versions and ensure continuous delivery
Manage permissions and authorize access to various views within Splunk ITSI
FAST SEARCH
PERFORMANCE
MAINTENANCE
WINDOWS
BACKUP AND
RESTORE
ROLE-BASED
ACCESS CONTROLS

27. What Makes Splunk ITSI Different
27
Search-Based KPIs
• Easy to write, manage and change
both services and KPIs
• Reflects business and technology
priorities
• Benefit: Rapidly generate and
change KPIs to align service health
with business
• Fiserv – 1000s in just weeks
Full Fidelity ServiceHealth
• Adaptable and flexible
definitions of service health
• One solution to go seamlessly
from service reports to root
cause, including raw data
• Remains adaptable and yet still
maintains complete historical
context
Universal Data Platform
• Data driven: All IT data including
events, metrics and logs
• Schema on-the-Fly
• Ask any question of the
data
• Fast time-to-value
• Data fidelity

28. Case Studies

29. Real-Time Car Auctions Delivered
With Intelligence
29
Reduced time-to-
investigate and
resolution with
real-time insights
Reduced incidents
across global
auctions by 90%
Improved end-user
experience and
service reliability
“With Splunk ITSI, we have proactive infrastructure monitoring to ensure a consistent level of customer
service for interested buyers to bid on cars.”
– Ken Gavranovic, VP Technology Application Development & Operations,
Cox Automotive
Scaling the
implementation with
Splunk Cloud

30. Splunk IT Service Intelligence at
30
Replaced home-
grown tools
Provided real-time
service insights to LOBs
Reduced time-to-
resolution

31. Improved Satellite Operations With
Real-Time Infrastructure Visibility
31
“Using Splunk ITSI has helped us to
understand our IT network in a way
we weren’t able to previously. This
has directly led to improvements in
areas such as troubleshooting and
security awareness.”
– Daniel Nye,
CTO, Surrey Satellite
Improved service accessibility, reliability and security
Enhanced ability to troubleshoot persistent service problems
Gained end-to-end visibility into overall IT performance

32. Modernizing Enterprise Monitoring at
the International World Development Bank
● Enhanced service reliability and incident
response
● Ease and flexibility in creating business
level dashboards ad hoc and on-the-fly
● Integrations with BMC Remedy to simplify
incident response and action
● Tracing business transactions end to end
32

33. Supporting, Monitoring and
Securing Services 24/7
33
REDUCE TIME-TO-
RESOLUTION
Consolidated services view
across entire IT infrastructure
IDENTIFY ANOMALOUS
ACTIVITY AND ENSURE
GOVERNANCE
Adaptive thresholds and alerts
improve security posture
PROACTIVELY IMPROVE
CUSTOMER EXPERIENCE
Comprehensive analytics to
reduce service disruption

34. 34
Unified insights: data
integrations from other tools
11,000 to 100s
Reduced incident
tickets
Alerting on service
KPI’s instead of
server performance
Usage baselines to
identify anomalies
Splunk IT Service Intelligence at

35. 35
Server-based to
services-based
monitoring
Top-down and
deep-dive service
insights
200+ services and
1,500+ KPIs
monitored
Flexible creation and
modification of
services and KPIs
Alerting on service
KPIs instead of
server performance
Real-time, holistic
and proactive
“client” view
Splunk IT Service Intelligence at

36. Splunk IT Service Intelligence
Data-driven service monitoring and analytics
36
SPLUNK IT SERVICE INTELLIGENCE
Time-Series Index
Platform for Machine Data
Dynamic
Service Models
Schema-on-Read Data Model Common
Information Model
At-a-Glance
Problem Analysis
Early Warning
on Deviations
Event Analytics
Simplified Incident
Workflows

37. Strategic,
business-centric
view of IT
Accelerated value
for IT
Data-centric
approach to
service mapping
Splunk IT Service Intelligence

38. How Do You Get Splunk ITSI?
38
ONLINE SANDBOX TRIAL
7 days of access to a free, personal
environment in the cloud, with
prepopulated data
Engage in a proof-of-concept to
index your data and experience
Splunk ITSI

39. Splunk-Sponsored Guided Workshop
39
Define methods for:
• Proactive service monitoring
• Reduced risk and failures
• Faster issue resolution
• Increased business
performance
What is it?
• 1-day on-site workshop
• Tightly linked with value
• Collaborative approach
• Build your own Splunk ITSI
Glass Table

40. Thank You

41. Backup

42. Augment Conventional Monitoring
Splunk IT Service Intelligence
APM NPM
Operations &
Infra Mgmt.
Domain Tools
Deliver Insights Based on Integrated Data, Not Integrated Products

43. 43
Splunk IT Service Intelligence
Get data
Define services,
entities and KPIs
Monitor and
troubleshoot
Analyze and
detect
Data-Defined, Data-Driven Service Insights

44. Pricing

45. Splunk Enterprise
or Splunk Cloud
Splunk ITSI
Splunk ITSI
45

46. Volume Discounts Built In
46
Daily Peak Indexing
Volume (GB)
Splunk IT Service
Intelligence
$/GB Built-in Volume
Discount
1 $5,000 $5000
2 $7,500 $3750 25%
5 $12,500 $2500 50%
10 $18,000 $1800 64%
20 $27,000 $1350 73%
50 $47,500 $950 81%
100 $60,000 $600 88%
200 $90,000 $450 91%
500 $162,500 $325 93.5%
1000 $300,000 $300 94%