Copyright	 ©	2016	Splunk	Inc.
Todd	Klein	
Software	Manager
2
About	Pason
• Mission: “To	provide	technologies,	information,	and	services	that	improve	
the	effectiveness,	efficiency,	and	safety	of	drilling	operations.”
• Over	30	years	of	experience	 transforming	drilling	data	into	information	
that	helps	customers	make	smarter	drilling	decisions
• Industry-leading	rental	service	provider	of	oilfield	instrumentation	and	
data	technologies	for	land-based	drilling	and	service	rigs
• Best-in-class	 service:	locally	based	field	technicians	who	live	and	work	
close	to	major	oil/gas	basins	and	24/7	technical	support
• Headquartered	 in	Calgary,	Alberta,	Canada	with	global	presence	
throughout	North	America,	South	America,	Australia,	Middle	East,	and	
North	Africa
3
About	Me
• Rigsite	Software	Manager	(in	R&D	group)
• Joined	Pason	in	2001
• Using	Splunk	for	over	four	years
• Managing	10-person	team	focused	on	2	areas
• Rigsite	Tier	3	Software	Support
• Responsible	for	handling	the	most	difficult	rig	site	software	problems
• Develop	software	tools	for	rig	site	support	and	analytics
• Workstation	Project
• Responsible	for	desktop	computers	running	Pason	software	at	the	rig	site
• Manage	desktop	image	and	application	software	for	easy	setup
• Favorite	Splunk	T-shirt	“Log,	I	am	your	father”
4
Before	Splunk:	Tedious,	Manual	Data	Analysis
• We	used	to	rely	on	monitoring	software	deployed	to	the	
rig	which	sent	us	data	through	email
• We	were	overloaded	with	hundreds	of	emails	every	day	
that	required	analysis
• It	was	difficult	to	determine	which	rigs	were	having	issues
• Data	analysis	was	tedious
• Painful	process	manually	going	through	the	emails and	logging	
into	the	rigs	for	further	investigation
• Took	too	much	time	to	evaluate	the	entire	fleet	of	rigs
“It	was	very	painful	
trying	to	analyze	
data	coming	from	
hundreds	of	emails	a	
day,	trying	to	figure	
out	which	rigs	were	
having	problems.”
5
Choosing	Splunk
• Splunk was	used	in	other	parts	of	the	company
• We	needed	a	solution	to	deliver	understandable	
results	quickly
• Splunk was	an	obvious	choice
• We	were	able	to	use	it	right	away	because	it	was	already	in-house
• Splunk	simplified	the	data	delivery	and	analysis	process	
• Splunk helped	us	uncover	false	positives
• No	need	to	look	at	any	other	vendors
• Splunk was	already	working	for	us	in	other	areas	of	the	business
• We	expanded	its	capabilities	as	we	went	along
“Splunk gave	us	
everything	we	
needed.	Instead	of	
manually	going	
through	emails,	we	
were	able	to	easily	
see	the	data	&	
analyze	it	very	
quickly.”
6
Splunk Benefits
• Enables	proactive	fleet	monitoring
• We	see	potential	issues	before	the	customer	is	impacted
• Alerts	notify	us	right	away	when	there	is	an	issue
• Provides	a	high	level	of	visibility	with	dashboards
• Business	metrics,	rig	counts,	product	adoption
• Significantly	reduces	our	troubleshooting	time	and	
improves	results
• We	can	tell	if	issues	are	confined	to	one	rig	or	more
• Enhances	our	software	deployments
• We	can	easily	identify	the	status	of	our	software	trials
“Our	‘A-ha’	moment	
was	when	we	realized	
Splunk	would	
immediately	let	us	
know	when	there	
was	a	potential	
problem	on	a	rig	&	
we	could	quickly	
investigate.”
7
Splunk at	Pason
• 2.2	GHz,	16-core	server,	128	GB	RAM
– Manages	all	incoming	data
• 20-40	daily	users:
– IT
– R&D
– Support	Services
– Operational	Groups
• Architecture:
– 1	indexer
– 3	forwarders
3 Universal	Forwarders
1	Indexer
1	Search	Head	+	1	Deployment	Server
8
Logs	&	Third-Party	Apps	at	Pason
• Web	server	logs
• Database	&	database	server	logs
• Operational	data
• Customer	call	data
• Product	&	application	data
• Rig	site	logs
Splunk Use	Cases
Customer	Support	/	
Metrics
Visibility	/	Analytics
Monitoring/Alerts/
Troubleshooting
10
Splunk for	Monitoring	/	Troubleshooting
• Proactively	monitor	& troubleshoot	our	rigs
• We’ve	improved	our	troubleshooting	process	&	times
• We	can	determine	if	issues	are	occurring	on	one	rig	or	many
• We’ve	set	up	alerts	so	we	are	aware	of	any	concerns	
before	our	customers	are	impacted
• We	started	using	dashboards	for	monitoring
• Added	alerts	for	notification	and	immediate	investigation
• We	are	able	to	quickly	distinguish	real	issues	from	
false	positives
“Splunk immediately	
simplified	things	
immensely	for	us	and	
we	were	able	to	
uncover	which	rigs	
had	problems	and	
which	were	false	
positives.”
11
Splunk	for	Monitoring	/	Troubleshooting
12
Splunk	for	Live	Customer	Support
• Track	customer	call	center	metrics
• Leverage	dashboards	for	rig	status	when	
customers	phone	in
• Internal	dashboards	that	provide	software	and	
equipment	status	from	devices	at	the	rig	site
• Leveraging	log	data	from	rig	sites	which	goes	into	
Splunk	and	is	used	by	the	support	team
“Splunk dashboards	
give	our	customer	
support	team	live	
data	on	rig	status	
when	they	take	
customer	calls.”
13
Splunk	for	Live	Customer	Support
14
Splunk for	Visibility	/	Analytics
• Support	Services	and	Call	Center	dashboards
• Quick,	primary	view	on	the	status	of	the	rig
• Analytics	– call	response	times,	types	of	calls	received
• Business	and	Operational	dashboards
• Rig	counts,	product	counts,	installed	equipment
• Product	adoption,	fleet-wide	trends	over	time
• Proactive	fleet	monitoring	dashboard
• Notifies	the	team	of	any	issues	we	need	to	investigate
• Deploying	new	software
• Splunk	helps	us	analyze	the	trial	&	resolve	issues
“Our	dashboards	
provide	vital	
information	to	multiple	
teams	about	the	status	
of	our	fleet	of	rigs,	
installed	equipment,	
product	counts	and	
more.”
15
Splunk	for	Visibility	/	Analytics
16
Splunk Words	to	the	Wise….
• It’s	more	than	just	how	much	data	you	can	take	in	
(a	lot),	it’s	what	you	can	do	with	that	data
• You	can	uncover	problems	or	issues	you	never	even	
thought	about
• You	can	access	metrics	that	give	you	product	and	server	
status	– huge	value
• Just	start	gathering	your	data
• Correlate	the	data	to	other	data	sets
• Allows	discovery	of	new	things	you	would	not	
otherwise	have	known
17
Splunking Ahead….
• Integrating	more	systems	and	getting	more	data	
into	Splunk	to:
• Expand	operational	data	correlation
• Increase	proactive	monitoring	with	information	from	the	rigs
• Strive	for	100%	uptime
• Standardize	Splunk	development
• Broaden	base	of	users	authoring	searches	and	dashboards
• Enable	effective,	reusable,	and	maintainable	dashboards
• Development	guidelines	for	dashboards,	searches,	&	macros
• Allow	for	easier	readability	and	understanding
• Simplify	/	unify	saved	searches	and	macro	naming	conventions
• Reusable	code!
18
Splunk	Successes
• Versatility	– Expand	as	we	go
• High	level	data	feeding	into	Splunk	as	well	as	data	from	numerous	applications	
and	products	within	the	company
• Automation	- Saving	us	time	and	people	power
• The	right	information	is	visible	right	away	and	we	can	quickly	analyze	it
• Eliminated	false	positives	and	simplified	our	data	analysis	process		
• Empowers	us	to	be	proactive
• We	know	about	and	fix	problems	before	the	customer	is	impacted
18
Thank	You

Pason Customer Presentation

Editor's Notes

  • #2 Thank-you <name> and Splunk for asking me to present. I’m happy to be here and show you how we use Splunk at Pason. I’ll talk a bit about what we did before Splunk and then how Splunk has helped us remove the barriers and make progress. First let me tell you about Pason.
  • #4 Tier 3 – explain a bit and how it fits into Support Services (Tier 1 and 2)
  • #6 Expanded capabilities – what data is going into Splunk and how we use Splunk
  • #8 Started within a team in R&D and then expanded into IT and more groups in R&D A huge benefit of Splunk for our company is having dashboards which are used by the Support Services and the Operational Groups in the company
  • #11 False positives – Splunk gives us the ability to analyze on the fleet or sets of rigs. Example - CPU usage on the server at the rig appeared to be higher then expected on a small number of rigs. Wasn’t impacting the customer but didn’t appear accurate - By analyzing the data on the fleet and devices installed, was determined this was expected by what devices are running
  • #12 EDR Tier 3 Fleet Monitoring dashboard gives us the ability to proactively monitor the fleet Allows immediate focus on rigs needing further investigation One of the panels is highlighting the load on the server, immediate investigate to determine the cause WiMesh Analysis dashboard gives us the ability to easily highlight potential issues on the wireless network at the rig Potential issue if the Signal To Noise ratio drops or the ping latency spikes
  • #14 Dashboard used by our Tier 1 Support Services group. Provides quick overview of the rig for when a customer calls into Support Services Contractor and Operator for the well, rig location, list of previous calls, devices installed and what software versions running Dashboards also provides a historical view on the key devices and wireless connections on the rig
  • #15 Visibility we gain from Splunk helps other teams at Pason; we’ve created dashboards for: The support services & customer call center teams
  • #16 Left dashboard – Allows us to easily see the CPU usage metrics on the fleet based on the type of server and how many devices installed Right dashboard – Allows quick overview for the Operational Groups to see where the rigs are located and what software version and server type is installed Versatile Server Platform
  • #19 Splunk has been very versatile for us, and we have been able to expand it as we go. We now have high level data feeding into it as well as data from numerous applications and products within the company, both on the server site and the rig site. Splunk has done a great job at automating what was a manual process, and giving us much better results, much faster – saving us time and people power. When alerts used to come through email, it was extremely time consuming to search through the emails for the information we needed. With Splunk, the right information is visible right away and we can quickly analyze it. We used to get a lot of false positives. Splunk has helped eliminate those and simplify our data analysis process so we can easily distinguish between a false positive and a real issue. One of the best improvements for us is that we can now be proactive with issues. With Splunk, we know about and fix our problems before they impact the customer.