How to Design, Build and Map IT and Business Services in Splunk
•
1 like•799 views
Your IT department supports critical business functions, processes and products. You're most effective when your technology initiatives are closely aligned and measured with specific business objectives. This session covers best practices and techniques for designing and building an effective service model, using the domain knowledge of your experts and capturing and reporting on key metrics that everyone can understand. We will design a sample service model and map them to performance indicators to track operational and business objectives. We will also show you how to make Splunk service-ware with Splunk IT Service Intelligence (ITSI).
Recommended
More Related Content
What's hot
What's hot (20)
Similar to How to Design, Build and Map IT and Business Services in Splunk
Similar to How to Design, Build and Map IT and Business Services in Splunk (20)
More from Splunk
More from Splunk (20)
Recently uploaded
Recently uploaded (20)
How to Design, Build and Map IT and Business Services in Splunk
- 1. How To Design, Build And Map IT And Business Services In Splunk Priya Balakrishnan Dr. of Marketing, Splunk IT Operations
- 2. Takeaways How To Derive ‘Service Intelligence’ for Your Organization Methodology for Getting Started with Service Intelligence Introduction to
- 3. Service Intelligence Enabling a business aware IT Measuring and reporting on indicators that matter Unlocking operational efficiencies Collaborating across silos to improve service operations Data-based decision making Solving problems and anticipating pitfalls with sophisticated analytics and powerful insights
- 5. Connecting Business and Technology
- 6. The Problem Scenario Manufacturer of toys and games Supply chain tracks movement of goods from manufacturing process to the consumer New online store has issues that impact customer experience and revenue ButtercupGames
- 7. The Business Problem for Buttercup Games Supply Chain Streamline operations Measure efficiency ERP Systems Business Impact $48,000/wk in revenue loss War rooms 32 hrs/wk ?? ? Failed Interactions Online Store Customer satisfaction
- 8. Bring Subject Experts Together Design Before Configuring Best Practices For Service Intelligence Start with a Problem Worth Solving
- 9. Start With A Problem Worth Solving Review your organization’s critical services Identify a service that has impactful and measurable challenges
- 10. Uncovering the Problem Worth Solving • What are the top business services in your enterprise? • How do you measure the customer experience with these services? • What is the customer experience with these services? • How often do customers experience issues with the service? • When issues arise, who gets involved in resolving them? • How do teams work together to resolve issues? • What’s the average time to issue resolution? • What’s the impact when customers have a bad experience with your services? Critical Services Issue Frequency Impact
- 11. The Business Problem for Buttercup Games Supply Chain Streamline operations Measure efficiency ERP Systems Business Impact $48,000/wk in revenue loss War rooms 32 hrs/wk ?? ? Failed Interactions Online Store Customer satisfaction IS THIS A PROBLEM WORTH SOLVING?
- 12. Bring Subject Experts Together Identify stakeholders and support personnel for the selected service Create awareness and invite their collaboration to solve the business challenge
- 13. Your Service IntelligenceCollaborators 20 Service Owners • Business functions • Performance indicators • Common business issues • Frequency of issues • Business impact of issues Operations and Support • Common issues • Performance indicators • Resolution processes • Tools used for resolving issues • Frequency of issues • IT impact of issues Enterprise Architecture • Business processes • Key inputs and outputs • Technology architecture • Data architecture • Common issues Administrators • Current tools and usage, and adoption levels • Splunk expertise • Environment expertise • Personal pain
- 14. Service Decomposition Infrastructure Layer Application Layer Business Layer Service Layer Order Entry Manufacturing Shipping Fulfillment Supply Chain Online Store EDI Web Tier Middleware
- 15. Design Before Configuring Identify pains, performance indicators and measurement goals for the service Identify components and data needed to drive service insights Consolidate the mappings into an enterprise process/IT services map
- 16. Putting It All Together Infrastructure Layer Application Layer Business Layer Service Layer Order Entry Manufacturing Shipping Fulfillment Supply Chain Online Store EDI Web Tier Middleware • Total Orders • Total Revenue • ServiceHealth • Unit Count • Unit Failures • Service Level • Delivery Time • Online Orders • Online Revenue • Response Time • ServiceHealth • Incidents/Changes • Customer Satisfaction • HTTP Hits • CPU Load • Memory Used • Disk Used • IO Latency • CPU Load • Memory Used • Disk Used • IO Latency • ServiceHealth • ServiceHealth
- 17. Why Old Ways Disappoint InfrastructureLayer Power/Cooling/Facilities Server–Networking–Storage ServiceLayer BusinessService ApplicationLayer Middleware–ApplicationServer-Database CustomApps BusinessLayer MailTransport-OrderProcessing E-Commerce-Financials Disparatetools,dataandsilosfailto deliverserviceinsights
- 18. Powered by Splunk Search Infrastructure Layer Application Layer Business Layer Service Layer Order Entry Manufacturing Shipping Fulfillment Supply Chain Online Store EDI Web Tier Middleware • Total Orders • Total Revenue • ServiceHealth • Unit Count • Unit Failures • Service Level • Delivery Time • Online Orders • Online Revenue • Response Time • ServiceHealth • Incidents/Changes • Customer Satisfaction • HTTP Hits • CPU Load • Memory Used • Disk Used • IO Latency • CPU Load • Memory Used • Disk Used • IO Latency • ServiceHealth • ServiceHealth
- 19. Typical Data Sources Infrastructure Layer Application Layer Business Layer Service Layer Order Entry Manufacturing Shipping Fulfillment Supply Chain Online Store EDI Web Tier Middleware • Application Logs • Corporate Databases • Service Management • Application Logs • Webserver Logs • Database Logs • Wire data • Performance Counters • Access Logs • Network Logs
- 20. IT Service Intelligence for Buttercup Games
- 21. 28 Splunk IT Service Intelligence Data-driven service monitoring and analytics 28 SPLUNK IT SERVICE INTELLIGENCE Time-Series Index Platform for Machine Data Dynamic Service Models Schema-on-Read Data Model Common Information Model At-a-Glance Problem Analysis Early Warning on Deviations Event Analytics Simplified Incident Workflows
- 22. Splunk ITSI Demo
- 23. 30 Data Driven Service Intelligence 3
- 24. Splunk IT Service Intelligence Machine Learning-Powered, Analytics-Driven IT Operations Simplify service operations Prioritize incidents with context Redefine the role of IT Combine events & metrics across silos with ease, flexibility & scale in days Unify siloed monitoring Leverage machine learning to detect anomalies & highlight events that matter Deliver business & service context to prioritize incident investigation & action Support decisions & communicate results with powerful service-level insights
- 25. What Can You Do Next?
- 26. Sign Up Today - We’re Here To Help! Harness the creativity and domain knowledge of your organization to unlock the value of data and solve an important service problem through a joint service intelligence workshop with key stakeholders Define methods for: • Proactive service monitoring • Reduced risk and failures • Faster issue resolution • Increased business performance What is it? • 1 Day Onsite Workshop • Tightly linked with value • Collaborative approach • Build your own Splunk ITSI prototype
- 27. Get Started ONLINE SANDBOX TRIAL 7 days of access to a free, personal environment in the Cloud, with pre- populated data Engage in a proof-of-concept to index your data and experience the power of Splunk ITSI https://splunk.box.com/ITSI-Sandbox-Guidebook Contact your Splunk representative
- 28. Thank You
Editor's Notes
- Good afternoon folks. Thank you very much for joining us today. <intro to self> Questions to group SL Attendance Attendee titles Splunk expertise Use case
- Who’s been doing Splunk for more than 1 yr Pony or 2 fro those who’ve been here for long Understand the audience: No Ponies: Identify the people who map to LOB,s PMs, service owners – so we can align with them
- At the end of this session, there are 3 key things I’d like you to walk away with. First, there’s been a lot of talk from Splunk on Service Intelligence. So, I’d like to define that and of what we mean by that and why it matters. Once we have that baseline, we can then, go into how to derive service Intelligence. How do you identify the right measurements, and map those success metrics to data sets that will contribute to these measurements. Lastly, I’d like you to introduce you to a new offering from Splunk that has made tremendous headway and one that our customers are lvoing love called Splunk IT Service Intelligence (ITSI). And how you can use ITSI to map these measurements to deliver real-time service insights.
- At Splunk, our mission is to make machine data accessible, usable and valuable to everyone. And this overarching mission is what drives our company and product priorities.
- Unlike traditional structured data or multi-dimensional data– for example data stored in a traditional relational database for batch reporting – machine data is non-standard, highly diverse, dynamic and high volume. You will notice that machine data events are also typically time-stamped – it is time-series data. Take the example of purchasing a product on your tablet or smartphone: the purchase transaction fails, you call the call center and then tweet about your experience. All these events are captured - as they occur - in the machine data generated by the different systems supporting these different interactions. Each of the underlying systems can generate millions of machine data events daily. Here we see small excerpts from just some of them.
- If you can correlate and visualize related events across these disparate sources, you can build a picture of activity, behavior and experience. And what if you can do all of this in real-time? You can respond more quickly to events that matter. For example, if an organizations captured the customers twitter ID in their customer profile this correlation would be possible. Where that didn’t exist, they could at least group by demographic with the tweets. You can extrapolate this example to a wide range of use cases – security and fraud, transaction monitoring and analysis, web analytics, IT operations and so on.
- Splunk products are being used for data volumes ranging from gigabytes to hundreds of terabytes per day. Splunk software and cloud services reliably collects and indexes machine data, from a single source to tens of thousands of sources. All in real time. Once data is in Splunk Enterprise, you can search, analyze, report on and share insights form your data. The Splunk Enterprise platform is optimized for real-time, low-latency and interactivity, making it easy to explore, analyze and visualize your data. This is described as Operational Intelligence. The insights gained from machine data support a number of use cases and can drive value across your organization. [In North America] Splunk Cloud is available in North America and offers Splunk Enterprise as a cloud-based service – essentially empowering you with Operational Intelligence without any operational effort.
- Splunk products are being used for data volumes ranging from gigabytes to hundreds of terabytes per day. Splunk software and cloud services reliably collects and indexes machine data, from a single source to tens of thousands of sources. All in real time. Once data is in Splunk Enterprise, you can search, analyze, report on and share insights form your data. The Splunk Enterprise platform is optimized for real-time, low-latency and interactivity, making it easy to explore, analyze and visualize your data. This is described as Operational Intelligence. The insights gained from machine data support a number of use cases and can drive value across your organization. [In North America] Splunk Cloud is available in North America and offers Splunk Enterprise as a cloud-based service – essentially empowering you with Operational Intelligence without any operational effort.
- So, let’s jump right into what Service Intelligence is. If you look at most enterprises today, IT is just not supporting the business, but is being defined by the software and services supported by IT. For example, if you’re depositing a check using your bank’s mobile app, or if you’re streaming a video online, or if you’re purchasing something online – it’s all software and systems, supported by IT. IT has moved to the forefront of the business, responsible for the health of not just its operations, but also the business. However, if you look at how IT operates in large enterprises, they continue to struggle to stay relevant, because they’re kind of stuck in a rock and a hard place. On one side they are being bombarded by the business to improve availability, performance and user experience but at the same time, they are trapped by legacy tools and operational silos that are not ideal to solve modern day problems. So, what you really need is be intelligent about the services IT delivers and understand how exactly these services relate to business goals and objectives Be intelligent when an issue arises. Understand it more holistically – and by that I mean, not just have an end-to-end picture of services and it’s underlying component parts, but also understand how to break down the problem methodically. Prioritize issues, collaborate across silos with a single, yet customized view of the services and sub-services, and organize and correlate issues to be able to triage the problem and resolve it quickly And lastly, just be intelligent – you have data, an abundance of it. You just need to enable yourselves with intelligently using that data to solve emerging problems with analytics-driven insights – so much like how we hold holds across operations when a problem occurs over a call, how do we enable the machine to do the high-volume drudge work and enable you to exercise the right judgment and high-volume reasoning. Sounds like a lot of work and something that’s been promised for decades – yes? How many of you went down this path in some sort and then gave up coz it was insanely hard to get there? Well, I agree with you that this sounds daunting. I come from that world myself. I worked for Mercury Interactive in early 2000’s when we had embarked on this road, and then we got acquired and while many of the enterprise vendors touted to do this, they couldn’t. I can go into many reasons on why it didn’t work – like normalized databases, CMDBs, tools not built for dynamic environments, but I’m not here to tell you why that didn’t work. I’m here to tell you that this is now very achievable. There is a method to this madness – trust me and it’s very achievable. Here are some examples of what our customers are doing.
- If you look at this customer, Converging Data, they have a very customized visualization of their service – in just a single view, they are able to get overarching insights into their healthcare delivery scorecard, what the tertiary services like pathology, facilities, patient transportation and so on looks like, what their specialized services in maternity, NICU, Icu are looking like and so on. This was achieved with Converging Data in 1 single day.
- Here’s another example This customer is a health care insurance service provider too, but one of their most critical services was claims process – providing the ability for their doctors and insurance agencies to submit claims, so that doctors can get paid for the services they have provided to their customers. Here, you can quickly see how many claims are being supported, what the health of their supporting infrastructure is looking like and the health of this infrastructure, and service and you can also see a mapping of what this means to the business, in terms of how many claims they are processing in real-time and what the monetary impact is. This is what our customers are doing with it - they are able to look at the data not just from an IT perspective, but also from business volumes. The technology is there, you just need to leverage it. Just yesterday, I was doing an interview for a customer their VP and AVP of infrastructure services – they’re presenting for us Gartner Datacenter and they mentioned that these kinds of visualizations are so powerful, coz often times the business wants to see the overall picture of the environment without too many technical details and these kinds of dashboards are powerful, intuitive and easy to understand while still maintaining to drill down logically into the component parts for deeper insights.
- So, how do you go about solving this problem. Let’s take buttercup games, because of course, buttercup is the Splunk mascot. Buttercup Games manufactures stuffed toys and games. Let’s figure out how to uncover the services important to the company and where there are problems worth solving. As a manufacturing company, the supply chain is extremely important. It’s a system that allows us to track the flow of good. Additionally, they have embarked on a new digital experience for their users with a new online store and want to make sure that their customers and the business are both not impacted.
- Let’s break that down further. First, we spoke about supply chain. The various aspects of supply chain would include order entry, manufacturing, shipping, fulfillment and you need a way to track and streamline these operations to minimize disruptions Second, the supporting pieces to this supply chain would include ERP systems and processes that ensure the business process functions without any hitches, so how do you measure it’s efficiency Next, we have the online store – without which the customers are unable to place orders. There is a direct impact to the top-line and therefore customer experience is of supreme importance Operationally, how do you ensure that things are going well? When customer care says that orders are failing and customers are complaining, how do you avoid spending 32 hours / week troubleshooting and triaging the issues in a war room? And lastly, what does this mean in terms of revenue impac – are you able to identify it and quantify it and plant a number on impact to revenue? So, we started with – we know that buttercup games is an toy store manufacturer, needs insights into supply chain, and lastly, insights into their online store (operationally and business impact).
- Now, how do you break this highlevel problem into something that’s understandable by all parties, to derive service intelligence, like we defined. A recap of what is Service Intelligence – 1 – ability to measure IT services to business impact 2 – ability to unlock operational efficiencies and 3 – drive data based decisions First, start with a problem worth solving. This seems obvious, but unfortunately, does not always happen. We often get so busy doing our day to day job that we don’t or are unable to take the time to step back and look at what matters Second, now that you have identified a problem that needs resolution, bring the right team together to solve the problem. Like xxxx Lastly, design what you want to say. 80% of the problem is figuring out what you want and why you want it. Once you have that laid out then, getting it done is the easier part. Let me elaborate on each of these a bit more.
- The most effective approach to building a model usually starts with identifying a business opportunity and determining how the model can improve performance and outcomes. Solving a business problem is thinking beyond the symptom or finding and fixing “issues.” What are the top business services in your enterprise? How do you measure the customer experience with these services? Are customers happy with their experience?
- It’s about understanding how the delivered services impact operations and the business. This can be accomplished by creating a comprehensive list of services, noting how they match to the priorities of the business and corresponding SLAs, and determining which services have the biggest business impact. Is it impactful, valuable measurable Drive decision making with quantifiable measurements How do you drive decisions to meet business needs Identify What are the top business services in your enterprise? How do you measure the customer experience with these services? Are customers happy with their experience?
- Let’s go back to buttercup games. Supply chain – business critical problem Measruing the business process and efficiency of the business process – check, business critical Online store – business critical – so a check there How many hours are we spending supporting this app, if we spend about 32 hrs/wk in war rooms? – 32 x 52 = 1664 hrs How does this impact the business if downtime costs the company 48,000 per week - ~$2.5M So, now, you’ve essentially identify the service, the business process and the applications that enable the service. What it means in terms of business impact and how to measure critical indicators that matter to the business How big is the business impact in terms of ours and in terms of revenue loss Pnoy: How many hours are we spending supporting this app - (32 x 52) Pony: How big is the business problem? (48,000 X 52)
- But you can’t do that in a silo. In order to understand what matters to the business and accurately map the service flow end-to-end, you need both the business and technical stakeholders. You want to collaborate on this instead of trying to figure this out in a silo. A collborative approach ensures optimized outcomes, alignment in prioritizing services, and the ability to record key measurements to construct an accurate service map. How often do customers experience issues with the service? When issues arise, who gets involved in resolving them? How do teams work together to resolve issues? Evaluate the performance of a process or a service – the measurements can be based upon the effectiveness (business value derived) or efficiency (how quickly the service is delivered) Identify pains, performance indicators and measurement goals for the service Develop an end-to-end map of the services
- Some of the folks you want to consider are: Service owners: These are the folks that speak business. They have an overall understanding of the service but do not necessarily know or care about the underlying supporting tiers. What they bring to the table is insight into the indicators that need to be measured that are meaningful to the business Operations and support folks are the more hands-on folks. They are the first line of defense for the company. They have a completely different view to the same service than what service owners do, as they have diffeernt KPIs they are measured against. This could include MTTR, FCR, Frequency of issues and just the inner workings of the systems and infrastructure. Enterprise architects are really important in the disussion coz they truly understand ow things really work. In one organization we had visited recently, we had an argument between the architects and support teams, each claiming the inner workings of the service and in some ways they were both right. The architects are the ones that design the system but the operations folks are the ones that help support it on an ongoing basis. So, both are very critical in this discussion And lastly you have the administrators – who use the tools. For instance, you will include your Splunk experts – these are the guys that can tell you whether or not you have the right data to correctly map and measure what you need. What tools are in place and what kind of infomritaon can you actually get into the system for accurately measruing the critical KPIs identified by these stakeholders Titles for monitoring tools manager Put people pictures next to them (map to Marc Olesen, Ravi Anandawalla, John Butler) Enteprise architects are really important coz they understand how things REALLY work. Once architects and support team got into an argument and
- The last step in the process is to design. Organizations often articulate priorities using business terminology, such as “improved customer service” or “reduced time-to-market.” To make sense of this, IT stakeholders must break down the organization’s value chain into its constituent technologies—what are the applications, services, hosts and devices that make up the value chain. IT operators must be able to create KPIs that turn data into meaningful information that the business can understand. This can be accomplished by sourcing the precise data and defining interactive service topology maps, to provide an overall perspective on the health of your critical services and supporting infrastructure. What components do we need to include in the service; db, middleware What data is needed to drive the metrics Meet with business leaders, and their teams, to review the consolidated mapping and modify as necessary
- So, why did the old ways fail – I’ll go over this very quickly. When datacenters were originally built, they were built in silos and tools supporting insights into the datacenter was also built to support these silos. However, let’s look at a traditional service stack – it can be broken down into 4 layers - the infrastructure layer, application layer, business layer and then finally the service layer. And now you had various tools supporting each of these layers. The way single- source-of-truth” service management solutions attempted to manage service health was by ‘poorly’ integrating these various tools with connectors and products with fixed, relational stores that required herculean yet fragile custom interconnects, and they failed. Filtering and normalizing data to fit these predefined constructs often left IT with shallow business- and IT-service-centric views. These views lacked depth in their understanding of root cause, service levels and business impact. And with today’s IT environments being dynamic and no longer contained within the walls of the enterprise, this problem was further exaggerated and became more intense.
- This isn’t hard at all. With these 10 data sources, you can do the full design
- With Splunk ITSI, customers get the higher level benefits based on the underlying platform. So, from deep-in-the-weeds solving IT operational use cases with Splunk enterprise, we’re up-leveling the use cases and making IT more relevant to the business. The can visualize meaningful and contextual data and inter-relationships with dynamic service models, organize and correlate performance indicators for at-a-glance problem analysis, get proactive with early warnings on anomalies, deviations and pre-configured correlated alerts, and simplify workflows.
- Bring up live system