SplunkLive! Zürich 2016 - Splunk Enterprise 6.4
•
0 likes•422 views
Breakout Session - Splunk Enterprise 6.4 - Data Onboarding
Recommended
Recommended
More Related Content
What's hot
What's hot (19)
Similar to SplunkLive! Zürich 2016 - Splunk Enterprise 6.4
Similar to SplunkLive! Zürich 2016 - Splunk Enterprise 6.4 (20)
More from Splunk
More from Splunk (20)
Recently uploaded
Recently uploaded (20)
SplunkLive! Zürich 2016 - Splunk Enterprise 6.4
- 13. Event Sampling • Powerful search option provides unbiased sample results • Useful to quickly determine dataset characteristics • Speeds large-scale data investigation and discovery 13 Optimizes query performance for big data analysis
- 14. Predict Command Enhancements • Time-series forecasting • New algorithms: • Support bivariate time series with covariance • Predict multiple series independently • Predict missing values within series • 80-100X performance improvement 14 Forecast Trends and Predict Missing Values
- 16. Splunk Enterprise: Storage TCO Reduction 16 Lean Storage for Historical Data • Removes certain search performance optimizations (TSIDX) to reduce data footprint 40-80% • Optimizes the cost vs performance of historical data analysis • Retains large datasets cost-effectively for regulatory compliance, security investigations and business ops 40 - 80% TCO reduction for historical data storage New storage option with granular controls
- 17. Historical Data Storage ColdColdCold Cold Cold Cold Cold Cold Cold Historical data retained online, possibly using lower-cost storage Hot Warm Warm Warm Real-time and recent data, typically using high-speed storage 17
- 18. ColdColdCold Storage Optimization Hot Warm Driving down data retention costs Warm Cold Cold Cold Cold Cold Cold Warm New Data Storage Controls • 40-80% reduction in data footprint • No functionality loss • Limited performance tradeoff for typical use cases How does it work? Certain Splunk performance optimization data (TSIDX) is removed – yielding a smaller footprint. 18
- 19. ColdColdCold Savings Example Hot Warm Driving down data retention costs Warm Cold Cold Cold Cold Cold Cold Warm Savings Over 1 Year $1.6 M* Savings over 5 Years $4.3 M* Raw Ingest: 10TB / Day Hot/Warm Retention: 2 Months Cold Retention: 10 Months * Assumes $1.25/GB Cold Storage Purchase Cost, 10% Maintenance Cost, 10% Annual Data Growth, 3 Year HW Refresh, No clustering 19
- 21. Management & Platform Enhancements Management – Distributed Management Console ê New monitoring views for scheduler, Event Collector, system I/O performance – Delegated Admin Roles HTTP Event Collector – Unrestricted data for payloads – Data indexing acknowledgement SAML Identity Provider Support – Okta, Azure AD, ADFS SAML Support ü OKTA ü Azure AD ü ADFS ü PingFederate HTTP Event Collector 21
- 23. Cloud Services Monitoring 23 New and enhanced apps to monitor critical cloud services • URL response times • Caching layer analysis • Network performance • Error log tracking • User profiling • Request/response perf. Analyze the operations and security of your AWS services • AWS ELB • AWS CloudFront • New security features • CloudTrail, Config • CloudWatch, S3 • VPC Flow Logs, Billing AWS Monitor the performance, availability, and security of your Akamai service Monitor ServiceNow incident, change, and event processes • Support for latest “Geneva” release Akamai ServiceNow
- 24. Splunk Enterprise & Splunk Cloud 6.4 New Cloud Services Monitoring New Visualizations & Enhanced Analytics 24 Platform Security and Management Unlimited new ways to visualize your data New mission-critical features Expanded cloud operations intelligence Storage TCO Reduction Reduces historical data storage TCO by 40%+ • New/enhanced monitoring capabilities for AWS, Akamai and ServiceNow • New pre-built visualizations • Open community library • Data sampling & prediction • Expanded management capabilities • New user security options • Splunk Enterprise reduces HW storage cost up to 80% for online historical data Get more from big data and pay less in storage costs
- 25. Appendix
- 26. Additional 6.4 Features 26 Feature Short Description Ultra-drilldown and Highlighting When performing ultra-drilldown field=value or tag filtering, the UI highlights the appropriate tags or field=value pairs within event expansions and event details where applicable. New ultra-drilldown actions also added for tags. UI control for Global Default Time Range Administrators can now define a default time range value for all search pages by using a UI control in Splunk Web. Instant Feedback All formatting options in visualizations are reflected automatically in the visualizations. This gives users much more confidence that their choices are matching their intentions. Dashboard XML Editor Enhanced XML edit experience that includes better screen optimization, inline validation, as well as live preview before saving. Indexer Cluster Enhancements Option to force roll specific hot buckets. Ability to quarantine a bad search peer. Search Head Cluster Enhancements User/Role/Password Replication. Alert Logging Ability to create a custom log event that is sent back to the Splunk platform for indexing, searching, and reporting. Forwarder support for Linux For Power Forwarder supported on Linux for Power on the Little Endian architecture.
- 27. Splunk Enterprise & Splunk Cloud 6.3 Advanced Analysis & Visualization Breakthrough Performance & Scale High Volume Event Collection 27 Enterprise-Scale Platform Supports DevOps and IoT data analysis at scale Simplifies analysis of large datasets Delivers Enterprise platform requirements Doubles performance and lowers TCO • 2X Search & Indexing Speed • 20-50% Increased Capacity • 20%+ Reduced TCO • Anomaly Detection • Geospatial Mapping • Single-Value Display • HTTP Event Collector • Developer API & SDKs • 3rd Party Integrations • Expanded Management • Custom Alert Actions • Data Integrity Control Meeting the needs of the most demanding organizations