Breakout Session - Splunk für IT Operations

1. Copyright © 2016 Splunk Inc.
SPLUNK FOR
IT-OPERATIONS
Udo Götzen
CISSP, Senior Sales Engineer

2. CIO Obstacle: Escalating IT Complexity
SERVERS STORAGE NETWORKING
VIRTUALIZATION
INFRASTRUCTURE
APPLICATIONS
PACKAGED
APPLICATIONS
CUSTOM
APPLICATIONS
Identity
VPN
IP Phone
HR
Email
Finance
App Svr
DB
Web Svr SaaS/PaaS
IaaS

3. CIO Obstacle: Escalating IT Complexity
SERVERS STORAGE NETWORKING
VITUALIZATION
INFRASTRUCTURE
APPLICATIONS
PACKAGED
APPLICATIONS
CUSTOM
APPLICATIONS
Identity
VPN
IP Phone
HR
Email
Finance
App Svr
DB
Web Svr SaaS/PaaS
IaaS
Complex, silo-based
technologies
Disconnected and outdated point
solutions
Over 70% of time spent on
maintaining, not innovating

4. Before Splunk
Data
Gathering
DB
App
NW
Storage
Now
What?
….
War Room
Outage
Occurs
Human latency measured in hours or days

5. From Days to Minutes With Splunk
“First
Responder”
2012-12-05 07:04:44 Id=Rd910EAJ City=New York Email.jdoe@gmail.com
product_id=product_i BD-
66.57.19.112 ..[05/Dec/2012 07:05:22:152]”GET /card.do?action=addtocart
&itemid=K9
[1208/12 02:39:03:209 UTC] 000000c6 ConnectionEve A J2CA00561:
ConnectionExeception:[IBM][CLI Driver] SQL1224N
Report and
analyze
Custom
dashboards
Monitor
and alert
Ad hoc
search
2012-12-05 07:04:44 Id=Rd910EAJ
City=New York Email.jdoe@gmail.com
product_id=product_i BD-
66.57.19.112 ..[05/Dec/2012
07:05:22:152]”GET
/card.do?action=addtocart
&itemid=K9
[1208/12 02:39:03:209 UTC]
000000c6 ConnectionEve A
J2CA00561:
ConnectionExeception:[IBM][CLI
Driver] SQL1224N
Outage
Occurs

6. “Splunk reduced our
escalations by 90% and our
problem resolution time by
67%.
“Escalations reduced by 90% and MTTR dropped by 67%”
Splunk at Service Desk: Vodafone
Paulo Carvalho
Director Operations
The old way: Disparate IT silos impact Customer Service
• Manually intensive, error-prone processes result in constant escalations and long delays
• Expensive, home-grown tools for log collection and analysis don’t provide the complete picture
• Disconnected systems create trouble in meeting security and compliance mandates
The new way: Provide comprehensive visibility and control
✓ A single Tier 1 support person can now perform iterative searches across all their IT data to
investigate, identify, and fix the problem – escalations reduced by 90 percent
✓ Splunk consolidates logs from disparate systems into a single view, providing visibility across end-
to-end service delivery from one place - time to problem resolution dropped by 67%
✓ Role-based secure access to logs via Splunk ensures SOX compliance
✓ Monitor IT data and find issues before they become visible to customers

7. Splunk : The Better Approach For IT
7
Customer
Facing Data
Outside the
Datacenter
Applications
Web logs
Log4J, JMS, JMX
.NET events
Code and scripts
Networking
Configurations
syslog
SNMP
netflow
Databases
Configurations
Audit/query
logs
Tables
Schemas
Virtualization
& Cloud
Hypervisor
Guest OS, Apps
Cloud
Linux/Unix
Configurations
syslog
File system
ps, iostat, top
Windows
Registry
Event logs
File system
sysinternals
Logfiles Configs Messages Traps
Alerts
Metrics Scripts TicketsChanges
Click-stream data
Shopping cart data
Online transaction data
Manufacturing,
logistics…
CDRs & IPDRs
Power consumption
RFID data
GPS data
Powerful, end-to-end, real-time platform for Machine Data

8. Splunk : The Better Approach For IT
8
Customer
Facing Data
Outside the
Datacenter
Applications
Web logs
Log4J, JMS, JMX
.NET events
Code and scripts
Networking
Configurations
syslog
SNMP
netflow
Databases
Configurations
Audit/query
logs
Tables
Schemas
Virtualization
& Cloud
Hypervisor
Guest OS, Apps
Cloud
Linux/Unix
Configuration
s
syslog
File system
ps, iostat, top
Windows
Registry
Event logs
File system
sysinternals
Logfiles Configs Messages Traps
Alerts
Metrics Scripts TicketsChanges
Click-stream data
Shopping cart data
Online transaction data
Manufacturing,
logistics…
CDRs & IPDRs
Power consumption
RFID data
GPS data
Powerful, end-to-end, real-time platform for Machine Data
No upfront schema
No custom connectors
No RDBMS
•Any amount, any location, any source.

9. Copyright © 2016 Splunk Inc.
SPLUNK APPS
ACCELEERATE INSIGHT

10. Copyright © 2015 Splunk Inc.
Apps Provide Deep Insights By Role
Find and resolve problems fast in individual technology areas
Exchange Admin
Service Health
Performance
Message tracking
VMware/Win/
Linux Admin
Infrastructure Health
Performance
Anomalies/Outliers
Storage Admin
Infrastructure Health
Performance
Anomalies/Outliers
10

11. Reduce Costs: Consolidate tools, eliminate silos, find root cause faster!
Exchange
Admin
Linux/Win
Admin
Network Admin
Applications
Admin
Line of
Business User
Application
Support
VMware/Linux/
Win Admin
Security
Admin
Storage Admin IT
Management

12. Copyright © 2015 Splunk Inc.
Splunk : Platform For IT Operational Intelligence
12
Plug-Ins, Templates and Apps Accelerate Value From Machine Data
No rigid schemas– Add in data from any other source.
API
SDKs UI
Server, Storage,
Network
Server
Virtualization
Operating
Systems
Custom
Applications
Business
Applications
Cloud Services
App Performance
Monitoring
Ticketing/ and Other
Web Intelligence
Mobile
Applications
Stream

13. Copyright © 2015 Splunk Inc.
Splunk For Operating Systems
Proactive Monitoring
Operational Analytics
End-to-End Visibility
Get instant insight into infrastructure health
OS Metrics for Performance, Capacity & Resource
Allocation Analyses
Scale And Correlate Across All Tiers Of Your Technology
Stack
13

14. Copyright © 2015 Splunk Inc.
Splunk For Virtualization & Storage
Proactive Monitoring
Operational Analytics
End-to-End Visibility
Real-time actionable insights into problem spots and
health issues
Real-time & historical insights into performance,
security, capacity, forecasting and change tracking
Scalable Big Data solution for holistic visibility across all
technology tiers
14

15. Copyright © 2015 Splunk Inc.
Add-on for AWS
Splunk App for AWS
Explore Analyze Dashboard Alert
CloudTrail
EC2
EMR
VPC ELBCloudfront
Lambda
ConfigCloudWatch
Other
Services
S3
Kinesis IoT
Splunk Insights for AWS Machine Data
(api audit trail) (logs and metrics) (change mgmt)
Why Splunk for AWS?
Security Intelligence (Cloudtrail, Config Cloudwatch, VPC)
Operational Intelligence (Cloudwatch, Config, ELB, Cloudfront)
DevOps Intelligence (Cloudwatch, Lambda)
Big Data Insights (Kinesis, EMR, IoT, S3)

16. Copyright © 2015 Splunk Inc.
Live Demo Splunk for AWS
16

17. Copyright © 2016 Splunk Inc.
IT-SI
IT-SERVICE INTELLIGENCE

18. Data-driven service insights
for root-cause isolation and improved service operations
INTRODUCING

19. Copyright © 2015 Splunk Inc.
Splunk IT Service Intelligence
Deploy flexible and scalable solution in days, not months
Any IT data (metrics and events) from anywhere
Quick to install, immediate value and on-the-fly customization
Flexible deployment options (on-premises, Cloud and hybrid)
Scale and robustness of the Splunk platform

20. Copyright © 2015 Splunk Inc.
Splunk IT Service Intelligence
Transform IT monitoring with data-driven analytics
Dynamically adapting KPIs for dynamic thresholds
Machine learning to baseline normal operations
Detection of anomalous behavior to drive meaningful actions
Correlation searches to create meaningful “alerts” off KPIs

21. Copyright © 2015 Splunk Inc.
Splunk IT Service Intelligence
Redefine the role of IT (as a strategic business partner) with service awareness
Data-driven insights – ask any question, any time
Flexible and powerful framework to map data into services
Easy definition of KPIs to easily measure what matters most
Drill downs for in-depth investigation and resolution

22. What is a Service?
DNS
Requests
Responses
Technical Services
Customer
Transactions
Requests
Responses
Business Services
Auth
Requests
Responses
Web
Requests
Responses
Support Desk
Requests
Responses

23. What is a Service?
Packet Network
Hypervisor and Hosts
RBMDBs
Storage Tier
API Services
Web ServicesCustomer Transactions
Mobile
API/Middleware
Partner Portal
DNS

24. What is a KPI?
DNS
Requests
Responses
KPI: Number of requests
KPI: Error rate
KPI: Average response time
KPI: Servicer CPU load
KPI: Server network I/F errors
Customer
Transactions
Requests
Responses
KPI: Number of transactions
KPI: Error rate
KPI: Average response time
KPI: Count of Incident Tickets
KPI: Synthetic Transx Health

25. Copyright © 2015 Splunk Inc. 25
Achieve Service Visibility Faster
Service Analyzer
High-level view of services and composite health scores
Glass Tables
Personalized visualizations of your services
Deep Dives
Organized view of performance indicators across silos
Multi KPI Alerts
Correlation rules to generate notable events
Notable Events
Easy-to-understand report on results of correlation searches
Anomaly Detection and Adaptive Thresholds
Machine learning to baseline normal operations and
identify anomalous behavior

26. Copyright © 2015 Splunk Inc.
Live Demo IT-SI
26

27. 27

28. Thank You

29. Adaptive Thresholding