Simplify service operations and improve reliability of events with machine learning and analytics Your data centre creates a lot of events — from low-level disk warnings to critical network issues and even service-level failures. With so many events and false positives, how do you know which events are important and which ones to ‘throw away’? Your current rules-based tools don’t work they are inflexible, cannot handle event volumes from today’s transient infrastructures and do not provide actionable alerts that help you fix the important problems first. Join this webinar to learn how Splunk IT Service Intelligence employs the power of machine learning to provide actionable human scale alerts with service context in an integrated solution, enabling IT teams to focus on fixing what’s broken quickly and easily. Learn how you can rapidly apply machine learning to: - Catch anomalous behavior to detect events before they become critical incidents - Avoid having to create manual rules and set adapt thresholds dynamically - Automatically correlate data to generate highly qualified information, so you can take fast action - Prioritize and speed up investigation on the most important incidents with service context

1. © 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2017 SPLUNK INC.
@splunk
Rage with the machine,
not against it.
Event Management with Machine Learning

2. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
During the course of this presentation, we may make forward-looking statements regarding future events or
the expected performance of the company. We caution you that such statements reflect our current
expectations and estimates based on factors currently known to us and that actual events or results could
differ materially. For important factors that may cause actual results to differ from those contained in our
forward-looking statements, please review our filings with the SEC.
The forward-looking statements made in this presentation are being made as of the time and date of its live
presentation. If reviewed after its live presentation, this presentation may not contain current or accurate
information. We do not assume any obligation to update any forward looking statements we may make. In
addition, any information about our roadmap outlines our general product direction and is subject to change
at any time without notice. It is for informational purposes only and shall not be incorporated into any contract
or other commitment. Splunk undertakes no obligation either to develop the features or functionality
described or to include any such feature or functionality in a future release.
Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in
the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved.
Forward-Looking Statements

3. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Who We Are
Marc Serieys
Event Analytics SME,
EMEA
@ITOA_Insights
Guillaume Aymé
Product Marketing IT
Operations
@lemastergui

4. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Ask questions
throughout in the
Q&A window

5. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Four things you will learn today
Why ML is critical for today’s
modern IT
Why Google Photos has inspired us
to manage IT events better
How Splunk can help you with a
negative MTTD
How Splunk is helping the World
Bank solve world poverty
1
2
3
4

6. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
We’re living in a digital revolution

7. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Companies
must meet
high
customer
expectations
to survive
I don’t want to
deal with delays
I expect you to know
who I am when I call
I expect to be able to track
my baggage in real-time
I expect the
lowest price
I expect you to respond
quickly to my issues
I expect you to help me
make my connection
I expect a perfect
safety record

8. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Winners and losers: no one
is too big to fail

9. © 2017 SPLUNK INC.© 2017 SPLUNK INC.

10. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
• Aligning with the business
• Improving customer experience
• Accelerating time to value
• Develop new digital services
This requires IT to focus on

11. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
But really, how much time do
we spend doing this?
Searching lots of data in silos
Creating static rules
Monitoring
Troubleshooting
Root Cause Analysis
Capacity Planning
War Rooms
Forecasting
….

12. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
This data comes from machines
GPS,
RFID,
Hypervisor,
Web Servers,
Email, Messaging,
Clickstreams, Mobile,
Telephony, IVR, Databases,
Sensors, Telematics, Storage,
Servers, Security Devices, Desktops

13. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
The total amount of data is expected to
double every 2 years.
*180,000,000,000,000,000,000,000 bytes
SOURCE: IDC
180 zettabytes* by 2025

14. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
The speed at which you act on
that data is your advantage

15. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Tasks in IT are
beyond human
scale

16. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Gartner are terming this AIOps

17. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Event
Management

18. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
What should the thresholds be of this CPU?
Are these peaks good or bad?
Do these peaks even mean anything?

19. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
How do you manage your events & alerts today?
• Increasing number
to manage
• Different formats and
fields
• Difficult to parse
• Required to
aggregate
• Very little context

20. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Ticket
(Incident)
opened
Event
Management Process
Incident Management
Process
Failure
Starts
Low heap
space on
JVM
High latency
of purchase
transaction
JVM not
responding
5 Failed
purchase
transactions in
last 5 minutes
Typical Process
Human latency
MTTD
High volume
of traffic in
last 5
minutes
Reassigned
Reassigned
Reassigned
Ticket
Closed
Poor incident management

21. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Ticket
(Incident)
opened
Failure
Starts
Low heap
space on
JVM
High latency
of purchase
transaction
JVM not
responding
5 Failed
purchase
transactions in
last 5 minutes
Typical Process
Human latency (too much
noise)
MTTD
Alert Storm
High volume
of traffic in
last 5
minutes
Twitter
Storm
Reassigned
Reassigned
Reassigned
Reassigned
Ticket
Closed
Ticket
Closed
(Duplicate)
Ticket
(Incident)
opened
Event
Management Process
Incident Management
Process
Poor incident management

22. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Common problems with managing events
Event overload | Silos of “monitoring” | Loss of data fidelity | Manual events interpretation
Custom integrations | Rules management overhead | Context and impact blindness
Bloated
Products
and
Features
Complex
Integrations
Alerts
Storm
Cumbersome
Rules
Management
Duplicate Incidents | Repeat Incidents

23. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Poll
23
What’s your biggest challenge with the alerts you receive from your
different monitoring solutions
Alerts? They go straight into my spam
Too many false positives & alert storms
No idea what services are impacted
I spend too much time configuring rules

24. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Building a modern IT
Traditional IT
▶ Structured data
▶ Brittle tools and integrations
▶ Obsession with “faults” and “traps”
▶ Focus on components parts
▶ Search oriented
Data Driven IT
0101101
0010101
▶ All data relevant
▶ Business aware
▶ Real-time
▶ Focus on the whole service
▶ Machine learning-driven analytics

25. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
The need for Service Intelligence
Enabling a business-aware IT
Measuring and reporting on indicators that matter
Unlocking operational efficiencies
Collaborating across silos to improve service operations
Data-based decision making
Solving problems and anticipating pitfalls with sophisticated
analytics and powerful insights

26. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Having access to the data has never been so easy
Network
InfrastructureLayer
Packet, Payload, Traffic,
Utilization, Perf
Storage
Utilization, Capacity,
Performance
Server
Performance, Usage,
Dependency
ApplicationLayer
User Experience
Usage, Response Time,
Failed Interactions
Byte Code Instrumentation
Usage, Experience,
Performance, Quality
Business Performance
Corporate Data, Intake,
Output, Throughput
Splunk Approach:
▶ Single repository for ALL data
▶ No parsing of data
▶ Data in original raw format
▶ Simplified architecture
▶ Search & Investigate
▶ Alerting
▶ Visualisation
▶ Analytics and Machine
Learning
MACHINE
DATA

27. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Energy Banking Manufacturing Gaming
Technology Retail Media Telecom
European companies using their machine data for IT
operations
Hospitality
Travel

28. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Splunk IT Service Intelligence
Machine Learning-Powered, Analytics-Driven IT Operations
Prioritize incidents
with context
Deliver business &
service context to
prioritize incident
investigation & action
Redefine the
role of IT
Support decisions &
communicate results
with powerful
service-level insights
Simplify service
operations
Leverage machine learning
to detect anomalies &
highlight events that matter
Unify siloed
monitoring
Combine events & metrics
across silos with ease,
flexibility & scale in days

29. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Machine Learning Made Mainstream
Adaptive Thresholds Anomaly Detection Event Correlation
Manage and maintain KPI thresholds by dynamically adapting to changing operational patterns
Catch issues that thresholds can’t—baseline normal operations and alert on anomalous conditions
Reduce event clutter, false positives and rules maintenance by auto-grouping related events

30. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
How do we sort your images?

31. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Do I need to be a
data scientist for
this?
Do I need to
understand what
algorithms are being
used?

32. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Consider the alerts you receive every day

33. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Intelligently grouped
through machine
learning.
No programming or
configuration
involved

34. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Results of poll

35. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Splunk ITSI in Action
(Demo)

36. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Splunk ITSI for Event Analytics
Simplify Your Operations With Artificial Intelligence and Service Context
Find and fix the most
important issues
Transform IT operations with
machine learning
Get a full view of your IT
environment
Service Context Artificial Intelligence Scalable Platform
Contextualize and prioritize
your events and alerts
So that you spend more time
on what’s important
Scales to petabytes of data
per day on prem or cloud
1001001
0100010
0101001
1001101
0110010111000110
1101011101010110
0010011101011000

37. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Reduction of world
poverty

38. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Before:
• Outages detected by executives
• No view on business impact
• Lack of end to end view
• Constant war rooms and middle-of-the-
night escalations
Goal:
“Provide modern capabilities to detect issues
and minimise impact to WBG staff”
Now:
• End to end view of all critical services
• Financial index style dashboards for CIO
• Enterprise monitoring team has become
an analytics team

39. Thanks to the integrated machine learning
in Splunk ITSI, we now have a reduced
number of events to process and the
streamlined event analytics framework
allows us to process events eight minutes
more quickly
Laurent Amouroux,
Technical Director
Econocom Infrastructure Management Services
15% increased
SLA Performance
60% reduction
In number of events
10x reduction
in number of system
performance events through
machine learning

40. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
What to do next?

41. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Try it for yourself - free Sandbox
http://splunk.com/itsi

42. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
#Splunk4Rookies
In major cities in Europe | Afterworks | 2.5 hours | Free | 100% hands-on | Beer & pizza
#Splunk4Ninjas ITSI

43. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Speak to an expert
Harness the creativity and domain knowledge of your organization to
unlock the value of data and solve an important business
service problem through a joint service intelligence workshop
with key stakeholders
Define methods for:
• Increased business performance
• Improved customer satisfaction
• Continuous improvement
• Proactive service monitoring
What is it?
• Collaborative workshop
• Tightly linked with business
value
• Build a functioning example

44. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Poll
Would you be interested in either a discussion with a specialist or
a Rookies/Ninjas session?
Yes No

45. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Please respond to our survey

46. © 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2017 SPLUNK INC.
Q&A
@splunk
@lemastergui
@ITOA_Insights

47. © 2017 SPLUNK INC.
Q&A