Presentation slides from Splunk Discovery held in Köln on January 17th 2020.

1. © 2 0 1 9 S P L U N K I N C .
Die Zukunft von ITOA -
von Monitoring zu Observability
Ralf Walkenhorst, IT Operations Analytics Specialist | EMEA
Jan. 17th 2020

2. During the course of this presentation, we may make forward‐looking statements regarding future
events or plans of the company. We caution you that such statements reflect our current
expectations and estimates based on factors currently known to us and that actual events or results
may differ materially. The forward-looking statements made in the this presentation are being made
as of the time and date of its live presentation. If reviewed after its live presentation, it may not
contain current or accurate information. We do not assume any obligation to update
any forward‐looking statements made herein.
In addition, any information about our roadmap outlines our general product direction and is subject
to change at any time without notice. It is for informational purposes only, and shall not be
incorporated into any contract or other commitment. Splunk undertakes no obligation either to
develop the features or functionalities described or to include any such feature or functionality in a
future release.
Splunk, Splunk>, Turn Data Into Doing, The Engine for Machine Data, Splunk Cloud, Splunk Light and
SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other
countries. All other brand names, product names, or trademarks belong to their respective owners.
© 2019 Splunk Inc. All rights reserved.
Forward-
Looking
Statements
© 2 0 1 9 S P L U N K I N C .

3. © 2019 SPLUNK INC.© 2019 SPLUNK INC.
Actual
CEO topics

4. © 2 0 1 9 S P L U N K I N C .
The share of CEOs in
Western Europe planning
‘operational efficiencies’
to drive revenue growth
Source: PwC 22nd Annual Global CEO Survey
Organizations are turning inward.
80%

5. © 2 0 1 9 S P L U N K I N C .
recognize that they simply don’t have
the capability to use the data they have
to make optimized decisions
54%
Lack of analytical
talent
51%
Data siloing
50%
Poor data reliability
Source: PwC 22nd Annual Global CEO Survey
CEOs

6. © 2 0 1 9 S P L U N K I N C .
CEOs agree that AI
will have a larger
impact than the
Internet
Source: PwC 22nd Annual Global CEO Survey
63%

7. © 2 0 1 9 S P L U N K I N C .
Drive new revenue
Launch new
products
Improve Business
process
Meet SLAs
Reduce app Time to
Market
Secure my
organization
Move to predictive /
proactive IT
Get full-stack
Observability
Service Manager
Product Owner
CISO
DevOps
Process Engineer
Operations Manager
NOC
COO
Operational
efficiencies
Improve analytical
skills
Break data silos
Improve data
reliability
Leverage AI
CEO IT
*Splunk Inc., “State of Dark Data Report” , May 2019
of organizations report that the majority of
their data is still dark*
60%
Unanalyzed | Unowned | Uncaptured | Untapped

8. © 2 0 1 9 S P L U N K I N C .
Dark Data
relies on IT
INFRASTRUCTURE
Complex
Opaque
Unstable
DEV / APPS
CLOUD
OFFICE
BACKUP/DR
REMOTE
SECURITY
STORAGE
NETWORK
SERVERS
FACILITY
Service?

9. © 2 0 1 9 S P L U N K I N C .
Dark Data
relies also on
CODE

10. © 2 0 1 9 S P L U N K I N C .
25%
2017
34%
2019
suffered an outage or period of “server
service degradation” over the past 12
months.
80%Could have been prevented
Leading causes:
Human errors, power outages,
network, configuration issues
INFRA+CODE=COMPLEXITY
Java
Jenkins
Containers
Mainframe
Network
library
IAAS
SCADA
OS
Payment
APIs
Proxy
AD

11. © 2 0 1 9 S P L U N K I N C .
CISO
DevSysAdmin
MKT
??
?
? ?
Storage
Admin
DBA
GREEN
OUTSIDE
RED
INSIDE
SILOED
TEAMS
SILOED
TOOLS+ =
WATERMELON
EFFECT
CONSEQUENCE:
THE WAR ROOM WATERMELON EFFECT

12. © 2 0 1 9 S P L U N K I N C .
What does modern monitoring
look like today?

13. © 2 0 1 9 S P L U N K I N C .
Generations of ITOps & Monitoring
Wave 1: See the systems
Wave 2: See the transactions
Investigate Monitor Analyze Act
Splunk Guides Customers
on a Complete Data Journey
Faster time to business outcomes
engagement
reliability
optimizationWave 3: See the users
Wave 4: See the value

14. © 2 0 1 9 S P L U N K I N C .
The aperture of the space continues to widen
The new questions to ask are expansive

15. © 2 0 1 9 S P L U N K I N C .
Layer 8
The people and value that
exist above the IT stack
Firewall
Logs
New Apps
Mail
Server Logs
Database
Logs
Network
Logs
New
Technology
Claims and
Call Center
Data
Business
Apps Data
New Data
Streams
Patient
Record
Systems
© 2 0 1 9 S P L U N K I N C .
IT only exists to enable & support
the service that creates value
for the organization.

16. © 2 0 1 9 S P L U N K I N C .
Biz
App
Infrastructure
Web
Mobile SyntheticsAPM
API App Logs
Cloud
Middleware Hardware
OS (Win/Linux)DB
Network Storage
Syslogs VM
Realtime Cause & Effect
Correlating business outcomes from all ‘altitudes’
Exec MBO’s Revenue CSat
Omnichannel Funnel
Call Center Customer Retention
Business Efficiency
NPS

17. © 2 0 1 9 S P L U N K I N C .
Biz
App
Infrastructure
Cloud
Middleware Hardware
OS (Win/Linux)DB
Network Storage
Web
Mobile SyntheticsAPM
API App Logs
Exec MBO’s Revenue CSat
Funnel
Call Center Customer Retention
Business Efficiency
Syslogs VM
Realtime Cause, Effect, & Prediction
Joining Data from all ‘Altitudes’
NPS
Omnichannel

18. © 2 0 1 9 S P L U N K I N C .
Biz
App
Infrastructure
Realtime Cause, Effect, & Prediction
Joining Data from all ‘Altitudes’
Reliability
Optimization
Engagement

19. © 2 0 1 9 S P L U N K I N C .
Insights &
Actionability
Visibility &
Context
Accountability &
Correlation
Where do
organizations struggle?

20. © 2 0 1 9 S P L U N K I N C .
Why is it Happening?
Where is it Happening?
Metrics
Observability
Key ingredients for an
actionable operating
model
What’s Happening?
Events / Logs
Tracing

21. © 2 0 1 9 S P L U N K I N C .
Metrics
Observability
Key ingredients for an
actionable operating
model
What’s Happening?
Structured, time series
Graphable
Activity measurement
Predictive
Examples:
• Order Count
• Throughput
• Latency
• Error Count
• CPU
• Disk
• Memory

22. © 2 0 1 9 S P L U N K I N C .
Events / Logs
Observability
Key ingredients for an
actionable operating
model
Unstructured
Explanatory
Immutable record of activity
Why is it Happening?
Examples:
• Syslogs
• App logs
• Event logs
• STDOUT
• STDERR

23. © 2 0 1 9 S P L U N K I N C .
Tracing
Observability
Key ingredients for an
actionable operating
model
What’s Happening?Where is it Happening?
Contextual
Correlating
Transactional
”Stitching”
Examples:
• Time-based correlation
• APM
• OpenTelemetry
• Jaeger
• Zipkin

24. © 2 0 1 9 S P L U N K I N C .

25. © 2 0 1 9 S P L U N K I N C .
IT Struggles to Identify, Investigate, and
Resolve Critical Issues
Host/OS Network Database Cloud Servers Desktop VM
Infrastructure
Application
Services
Business
Services
Online Supply Chain Digital
KPIs App Health and
Performance
KPIs
Health of
Environment
KPIs Revenue Brand
Reputation
Customer
Satisfaction

26. © 2 0 1 9 S P L U N K I N C .
Customer
Satisfaction
Brand
Reputation
Performance
Variation
Service
Degradation
Revenue
Impacts
Host/OS Network Database Cloud Servers Desktop VM
Infrastructure
Application
Services
Business
Services
Online Supply Chain Digital
These Critical Issues Cost the Business and
Hurt Customer Experience

27. © 2 0 1 9 S P L U N K I N C .
All Altitudes, One Screen
Business
Metrics
Infrastructure
Metrics
Application
Metrics
Policy
Metrics

28. © 2 0 1 9 S P L U N K I N C .
Measure Blast Radius

29. © 2 0 1 9 S P L U N K I N C .

30. © 2 0 1 9 S P L U N K I N C .
When is the
best time to
perform heavy
maintenance
on a jet
engine?
Analytics

31. © 2 0 1 9 S P L U N K I N C .
Splunk
analytics help
you identify
anomalies
before they
turn into
problems.

32. © 2 0 1 9 S P L U N K I N C .
Breadth of Machine Learning Capabilities
Make IT Effective, Proactive and Predictive
Dynamic Thresholding
Thresholds adapt in real time
Trend and alert on anomalous
behavior
Prevent service degradation
Event Clustering
Detect and highlight the
events that matter
Prioritize events that need
action taken
Anomaly Detection
Alerts triggered automatically
by anomalous activity
Incident responders can see
across all silos to find a
quicker MTTR
Prediction
Predict outages and anomalies
before they occur
Act on these predictions so
your services are not affected

33. © 2 0 1 9 S P L U N K I N C .
Example: Prediction

34. © 2 0 1 9 S P L U N K I N C .
Example: Event Clustering

35. © 2 0 1 9 S P L U N K I N C .

36. © 2 0 1 9 S P L U N K I N C .

37. © 2 0 1 9 S P L U N K I N C .

38. © 2 0 1 9 S P L U N K I N C .
Example: Adaptive Thresholding

39. © 2 0 1 9 S P L U N K I N C .
Example: Anomaly Detection

40. © 2 0 1 9 S P L U N K I N C .
PREDICTIVE
PROACTIVE
EFFECTIVE
Benefits of Predictive IT
Alignment of Splunk Value
Improve Customer
Satisfaction
Protect Brand
Reputation
Preserve Line
of Revenue
Reduce Alert Noise by
90+%
Predict Imminent Outages
30-45 Minutes in Advance
70-90% Reduction in Incident
Investigation Time
30-45% Reduction in Outages
Machine Learning

41. © 2 0 1 9 S P L U N K I N C .
ITSI Demo

42. Thank You
© 2 0 1 9 S P L U N K I N C .

43. © 2019 SPLUNK INC.
Agenda
Splunk Discovery
Köln
17. Januar 2020
09:00–10:30 Keynote und Demo – Die Data-to-Everything Plattform
10:30–11:00 Pause
Tech Track (Jupiter I+II) Business Track (Saturn I+II)
11:00–11:45
Mit der Splunk Plattform Daten in
Mehrwert umwandeln
ROI in Datenprojekten (in English)
11:45–12:30
Abenteuer bei Monitoring und
Troubleshooting
Kunden Use Cases
12:30–13:30 Mittagessen
13:30–14:15 Security Analytics Methoden Die Zukunft von Security Operations
14:15–15:00
Splunk Incident Response,
Orchestrierung und Automation
Die Zukunft von ITOA – von Monitoring zu
Observability
15:00–15:30 Pause
15:30–16:15 Kunden Use Case: TÜV Trust IT
16:15–17:00 Networking Drinks