Building Business Service Intelligence with ITSI
•
1 like•563 views
This document provides instructions for setting up Splunk IT Service Intelligence (ITSI) before using it. It instructs the user to: 1. Download a presentation slide deck from a Splunk Box URL. 2. Sign up for a free Splunk ITSI Online Sandbox if not already done. 3. Test access to the sandbox, recommending Chrome, Firefox or Safari and noting that Internet Explorer is not recommended. 4. After logging in, select IT Service Intelligence from the list of apps on the left side.
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Building Business Service Intelligence with ITSI
Similar to Building Business Service Intelligence with ITSI (20)
More from Splunk
More from Splunk (20)
Recently uploaded
Recently uploaded (20)
Building Business Service Intelligence with ITSI
- 1. Setup Before You Can Play 1. Download this presentation slide deck: https://splunk.box.com 2. If you have not done so already, Sign up for the FREE Splunk ITSI Online Sandbox: • http://splunk.com/itsi • Select "Free Online Sandbox" 3. Please test access to your sandbox; • Chrome, Firefox, Safari are recommended; • IE is NOT recommended 4. After logging in, select IT Service Intelligence from the list of apps at the left 1 WiFi Splunk splunk2017
- 3. Agenda 3 u Introductions and Set Up u Splundamentals – IT Troubleshooting with Splunk u What is IT Service Intelligence? u Service Intelligence Design Practices u Let's Play! u What's Next? u Happy Hour!
- 4. 4 Safe Harbor Statement During the course of this presentation, we may make forward looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release.
- 7. Challenging Traditional Methods Network Infrastructure Layer Storage Server 74% -36% Application Layer Synthetic APM Byte Code Instrumentation Adaptive Thresholding Service Model definition & Correlation Engine Business Layer Aggregation/Correlation/Visualization Service Layer Challenges • Too many disparate components • Difficult to define Service Model • Labor intensive • Most implementations fail • Very important source is missing! (machine data)
- 8. Data-Defined & Driven Service Insights Infrastructure LayerApplication Layer Splunk> is the missing link • Data Fidelity • Single Repository for ALL data • Easier to Manage Services • Reduced Integrations • Reduced Point Solutions • Collaborative Approach • Quick time to value Data Fabric Platform Service Intelligence Network Packet, Payload, Traffic, Utilization, Perf Synthetic APM Availability, Capacity, User Experience Byte Code Instrumentation Usage, Experience, Performance, Quality Adaptive Thresholding Apps, Services, Systems74% -36% Server Performance, Usage, Dependency Storage Utilization, Capacity, Performance MACHINE DATA
- 9. Splunk Approach to Machine Data 9 Structured RDBMS SQL Schema on Write Traditional ETL Search Schema on Read Splunk Universal Indexing Volume Velocity Variety Unstructured • Define Static schema • ETL into Schema • Enrich at write • New data = new columns • New questions = new columns • “Data at rest” (delayed info) • Labor Intensive & time consuming Ideal for Reporting • “Schema-on-the-Fly” • Data in native format • Enrich at read • New data = no changes needed • New questions = no changes needed • “Data in motion” (Real time) • Fast time to value Ideal for Investigation
- 13. IT Service Intelligence Value Stack § Time Series Index § Schema on Read § Data Model § Visualizes entire stack § View the entire Ecosystem § 3 clicks to get the answer versus 10 Service Model § Adaptive Threshold § Behavior Anomaly § Correlates Data into KnowledgeML § Accelerators § Trend aggregation § Multi KPI Alerts ITSI
- 30. Service Intelligence Design – Buttercup Games Infrastructure Layer Application Layer Business Layer Service Layer Order Entry Manufacturing Shipping Fulfillment Supply Chain Online Store EDI Web Tier Middleware • Total Orders • Total Revenue • Unit Count • Unit Failures • Service Level • Delivery Time • Online Orders • Online Revenue • Response Time • ServiceHealth • Incidents/Changes • Customer Satisfaction • HTTP Hits • Error Rate • CPU Load • Memory Used • Disk Used • IO Latency • CPU Load • Memory Used • Disk Used • IO Latency • Response Time • Error Rate • Response Time • Storage Free
- 31. Service Intelligence Design in ITSI 1. High-value business services • Buttercup Games Online Store and Supply Chain 2. Major business functions • Order Entry, Manufacturing, Shipping Fulfillment 3. Supporting services • Web, Middleware, Database 4. Relevant KPIs for each service • Database:, errors, SQL hits, …) 5. Splunk search for each KPI • (index=DB (warn* OR error*) | stats count) 31
- 32. Typical Data Sources Infrastructure Layer Application Layer Business Layer Service Layer Order Entry Manufacturing Shipping Fulfillment Supply Chain Online Store EDI Web Tier Middleware • Application Logs • Corporate Databases • Service Management • Application Logs • Webserver Logs • DB Perf Counters • Wire data • Perf Counters • Access Logs • Network Logs
- 39. New Requirements! 39 ● Create a new KPI for the DB Service: ● Network Utilization ● Modify the Executive Glass Table in order to show off the services you slave over “WE only have about 15min TO DO WHAT ???!!???” Think about how long this would take you today?
- 41. Let’s Talk Entities 41 ● Select Database Service ● Entities are the relevant things which support this service (usually hosts) ● Select the right entries with filters, ANDs, ORs ● Original Entity list can come from CMDB, spreadsheet, Splunk search, others
- 42. A KPI in 5 minutes? Absolutely! 42 Click New – Generic KPI Select Data Model ● Host Operating System ● Network ● # bytes ● Next Call it “Network Utilization”, with your username up front
- 43. KPIs Continued…. 43 Splunk Builds Searches for you – Oh Yeah, that’s happening J ● Select Yes for Split by & Filter options ● Select host for Entity Lookup & Alias options ● Click Next
- 44. Almost There… 44 Select ● KPI Search Schedule: Every Minute ● Entity Calculation: Average ● Service/Agg Calculation: Average ● Calculation Window: Last Minute ● Click Next ● Unit: Bps ● Click Next
- 45. Final Steps … 45 Set your thresholds: ● Aggregate (All) ● Per Entity ● Click “Add Threshold” TWICE ● Make the Neapolitan ice cream colors Yellow, Green, Yellow ● Drag the sliders around in order to get the current data graph entirely inside the Green (normal) band ● Click Finish ● Other options are also available, including adaptive thresholds and anomaly detection
- 49. Anomaly Detection 49 ● Machine Learning ● “Trending” detects deviations for aggregate KPI based on historical trends ● “Entity Cohesion” detects entities which deviate from “pack” behaviour
- 51. Clone the Glass Table 51 Return to Saved Glass Tables page (click on Glass Tables in the upper menu bar) CLICK Edit for “Buttercup Games Business Process (IN PROGRESS)” • Select Clone • Title: Add your username to the front • Permissions: Shared in App • Click Clone Page • Click on your new Glass Table from the list, to view it
- 52. Edit & Have Fun! 52 Click on Edit in the upper right corner of your Glass Table Use the “Services” panel on the left to select Individual KPIs, or Aggregate Service Health Scores • Choose 2 KPIs from Online Store that would be useful in the “Order Process” section • Drag the selected widgets onto the canvas, positioning in the gray oval • What’s the difference between the and tools at the top left?
- 53. More Fun with the Glass Table Editor… 53 Use the Configurations panel on the right to edit a selected widget • Can change the visualization type, drilldown behavior, and other settings • You should hit Save frequently • Revert All Changes can be helpful, occasionally
- 54. Finishing up … 54 • Add a ServiceHealthScore widget for Online Store under Buttercup • Choose a Viz Type with a sparkline graph, then resize to make it look pretty • Modify the Custom Drilldown action to go to the saved glass table, Buttercup Games Online Store • Bonus Points: Make the label bigger, more readable • Click Save • View when done
- 56. A Troubleshooting Exercise 56 Let’s use ITSI to troubleshoot an outage ● Start at your Glass Table, “<UserName> Buttercup Business Process” ● Customer Care reports that unhappy customers are complaining of failures and long delays when trying to purchase ● The calls began coming in at around the top of the last hour. ● In the upper right corner of the Glass Table, change the time picker from Now to XX:00:00.0, where XX is the previous hour. For example, if it is currently 14:05, set the time picker to 13:00:00.0, then Apply ● This is how we can “time travel” back to see conditions at a particular outage– oh yeah!
- 58. A Troubleshooting Exercise, cont’d. 58 ● The Online Store Glass Table shows a much more detailed view, including the impacted customer-facing KPIs at the far left (Revenue, etc) ● Based on this view of all the relevant services, where do you think the root cause lies? ● Which service should we troubleshoot first? ● Click on Health widget for that service, to drill down to a Deep Dive
- 59. Deep Dive 59 ● Deep Dive shows multiple KPIs and Health Scores in parallel “swim lanes”. ● The Health Score for this Service is the top swim lane. Can you see when it begins to degrade from 100%? ● Mousing over this point in time, can you spot the KPI with the leading fault indication, i.e., what failed first? ● To improve readability, make sure the Primary Time Range (upper right corner) is set to Relative> Earliest: 2 Hours Ago
- 60. Multi-KPI Alerts and Notable Events 60 ● Click on Notable Events Review ● Multiple KPIs and Healthscores can be combined in sophisticated ways to create Multi-KPI alerts ● When a Multi-KPI alert fires, one of the outcomes is the creation of a Notable Event ● Notable Events allow NOC personnel and others to triage and coordinate event management efforts
- 61. Service Analyzer 61 ● Click on Service Analyzer > Default Service Analyzer ● Back where we started! ● This view shows a “no-frills” list of services (top) and hottest KPIs (bottom) ● Provides access into Service Details ● It is useful for NOCs and others who need a high-level situational view
- 63. Summary 63 ● High-value services can be decomposed and modeled in ITSI, using machine data from the relevant systems ● Services and KPIs can be created in minutes, with sophisticated thresholding techniques to distinguish “normal” from “not normal” ● Glass Tables allow service health and KPI metrics to be displayed in a way that makes sense to specific groups, such as Executive Leadership, Business Service Owners, the NOC, DevOps & Others ● Deep Dives allow KPIs to be compared side-by-side across any time range, accelerating root cause analysis and significantly reducing MTTR ● Multi-KPI Alerts and Notable Events reduce alert noise, producing actionable events and a means to manage them ● … and it’s fast+fun to build!
- 65. Splunk IT Service Intelligence Machine Learning-Powered, Analytics-Driven IT Operations Simplify service operations Prioritize incidents with context Redefine the role of IT Combine events & metrics across silos with ease, flexibility & scale in days Unify siloed monitoring Leverage machine learning to detect anomalies & highlight events that matter Deliver business & service context to prioritize incident investigation & action Support decisions & communicate results with powerful service-level insights
- 67. Call Center Service Service Health Transactions ACD Analysis – Core Splunk Call Wait History Inbound Analysis Social Media Online Msg Social Media Mail SupportVOIP Service Inbound Calls
- 68. Online Transactions Internal Transfer Service External Wire Service Money Exchange Service Money Transfer Services Service Health Corporate Reconciliation Service Fed Exchange Service Core Splunk Searches Transaction History System Investigation Heat Map Analysis
- 70. The Vision - Business Operations Center • Splunk ITSI has the fundamentals to deliver on the promise of real time business visualizations • Modeled after your Security, Network, and IT Operations Centers • Monitoring and diagnosis of important ecommerce and brick and mortar operations • Enhanced with process insight from end-to-end, alerts, machine learning and real-time response NOC SOC BOC
- 71. Sign Up Now – We’re here to help! Harness the creativity and domain knowledge of your organization to unlock the value of data and solve an important Business Service problem through a joint service intelligence workshop with key stakeholders Define methods for: › Proactive service monitoring › Reduced risk and failures › Faster issue resolution › Increased business performance What is it? › 1 Day Onsite Workshop › Tightly linked with value › Collaborative approach › Build your own Glass Table
- 74. Reference Stuff 74 ● ITSI Sandbox Guide: (An app on your ITSI instance) ● ITSI Documentation: http://docs.splunk.com/Documentation/ITSI