Splunk Hands-On Workshop

1. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
The Hitchhiker's Guide to
Service Intelligence
Dan Byrd | Splunk ITOA Specialist
June 14, 2017 | Minneapolis

2. © 2017 SPLUNK INC.
Setup Before You Can Play
1. Download this presentation slide deck: https://splunk.box.com/v/FixThisUrl
2. If you have not done so already, Sign up for the FREE Splunk ITSI Online Sandbox:
• http://splunk.com/itsi
• Select "Free Online Sandbox"
3. Please test access to your sandbox;
• Chrome, Firefox, Safari
are recommended;
• IE is NOT recommended
4. After logging in, select
"IT Service Intelligence" from the
list of apps at the left
WiFi
Splunk17
"2017SPLUNK"

3. © 2017 SPLUNK INC.
▶ Introductions and Set Up
▶ Splundamentals – IT Troubleshooting with Splunk
▶ What is Service Intelligence and ITSI?
▶ Let's Play! (Setting up ITSI)
▶ Service Intelligence Design Practices
▶ Let's Play! (Troubleshooting & Advanced Exercises)
▶ What's Next?
▶ Happy Hour!
Agenda

4. © 2017 SPLUNK INC.
During the course of this presentation, we may make forward-looking statements regarding future events or
the expected performance of the company. We caution you that such statements reflect our current
expectations and estimates based on factors currently known to us and that actual events or results could
differ materially. For important factors that may cause actual results to differ from those contained in our
forward-looking statements, please review our filings with the SEC.
The forward-looking statements made in this presentation are being made as of the time and date of its live
presentation. If reviewed after its live presentation, this presentation may not contain current or accurate
information. We do not assume any obligation to update any forward-looking statements we may make. In
addition, any information about our roadmap outlines our general product direction and is subject to change
at any time without notice. It is for informational purposes only and shall not be incorporated into any contract
or other commitment. Splunk undertakes no obligation either to develop the features or functionality
described or to include any such feature or functionality in a future release.
Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in
the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved.
Forward-Looking Statements

5. © 2017 SPLUNK INC.
Key Takeaways
Build on what you are already doing with Splunk
Service Intelligence design and configuration practices
What is possible with Splunk IT Service Intelligence
5

6. © 2017 SPLUNK INC.
Splundamentals –
IT Troubleshooting with Splunk
6

7. © 2017 SPLUNK INC.
Rethinking and Improving How IT Operates
Traditional
IT
Data-Driven
IT
• Structured data
• Brittle tools and integrations
• Obsession with “faults” and
“traps”
• Focus on components parts
• Search oriented
• Structured and unstructured data
• Robust data integrations
• Real-time insights from big data
• Focus on the whole service
• Machine learning-driven analytics
7

8. © 2017 SPLUNK INC.
What Is Service Intelligence?
Enabling a business-aware IT
Measuring and reporting on indicators that matter
Unlocking operational efficiencies
Collaborating across silos to improve service operations
Data-driven decision making
Solving problems and anticipating pitfalls with
sophisticated analytics and powerful insights
8

9. © 2017 SPLUNK INC.
What Is Service Intelligence?
Enabling a business-aware IT
Measuring and reporting on indicators that matter
Unlocking operational efficiencies
Collaborating across silos to improve service operations
Data-driven decision making
Solving problems and anticipating pitfalls with
sophisticated analytics and powerful insights
9

10. © 2017 SPLUNK INC.
What Is Service Intelligence?
Enabling a business-aware IT
Measuring and reporting on indicators that matter
Unlocking operational efficiencies
Collaborating across silos to improve service operations
Data-driven decision making
Solving problems and anticipating pitfalls with
sophisticated analytics and powerful insights
10

11. © 2017 SPLUNK INC.
Machine learning-powered analytics for real-time service
insights, simplified operations and root-cause isolation

12. © 2017 SPLUNK INC.
The possibilities for Business…
Emergency Room Services
12

13. © 2017 SPLUNK INC.
13

14. © 2017 SPLUNK INC.
The possibilities for Operations…
14

15. © 2017 SPLUNK INC.
The possibilities for Executive Leadership…
15

16. © 2017 SPLUNK INC.
ITSI Key Concepts
16

17. © 2017 SPLUNK INC.
What is a Service?
17
Service
Requests
Responses
In ITSI, a Service is a logical group of technology components that a
user deems need to be monitored together.
It can often be generalized as a “black box” which we send requests,
and expect responses
17

18. © 2017 SPLUNK INC.
What is a Service?
18
Services can be lower level (technical) …
DNS
Requests
Responses
Technical Services
Auth
Requests
Responses
Web
Requests
Responses
18

19. © 2017 SPLUNK INC.
What is a Service?
19
DNS
Requests
Responses
Technical Services
Order Entry
Volume
Revenue
Business Services
Auth
Requests
Responses
Web
Requests
Responses
Customer
Care
Requests
SLA Compliance
Services can also be higher level (business) …
19

20. © 2017 SPLUNK INC.
What is a Service?
20
Packet Network
Hypervisor and Hosts
RBMDBs
Storage Tier
API Services
Web Services
Customer Transactions
Mobile
API/Middleware
Business Function
DNS
Services can encompass multiple tiers of the IT
domain. Services may also depend upon other
services
20

21. © 2017 SPLUNK INC.
What is a KPI?
21
DNS
KPI: Request volume
KPI: Error rate
KPI: Average response time
KPI: Server CPU load
KPI: Configuration changes
Customer
Transactions
KPI: Transaction volume
KPI: Error rate
KPI: Average response time
KPI: Max response time
KPI: Count of Change records
KPIs and Health scores constitute the means by
which Services are monitored.
Business
Function
KPI: Business volume
KPI: Error rate
KPI: Revenue rate
KPI: Conversion rate
KPI: Count of Incident tickets
21

22. © 2017 SPLUNK INC.
Key Performance Indicators (KPIs)
A Key Performance Indicator (KPI) is powered by a Splunk search in
ITSI that monitors a specific attribute like CPU utilization, Response
Time, Number of Errors and so on. KPIs are contained within Services
to measure their health.
22

23. © 2017 SPLUNK INC.
Service Health Scores
A Health score is a score form 0-100 (0 being critical and 100 being
normal) that measures the health of a Service. It is calculated based
on all KPIs importance and its status (e.g. green, orange, red), once
every minute.
23

24. © 2017 SPLUNK INC.
ITSI Demo
24

25. © 2017 SPLUNK INC.
Let’s Play!
Setting up ITSI
25

26. © 2017 SPLUNK INC.
Service Visibility in ITSI
CLICK
“Glass Tables”
26

27. © 2017 SPLUNK INC.
Service Visibility in ITSI
CLICK (open in new tab)
“Buttercup Games
Business Process (IN
PROGRESS)”
27

28. © 2017 SPLUNK INC.
Service Visibility in ITSI
CLICK (open in new tab)
4 - Digital Transaction Flow
28

29. © 2017 SPLUNK INC.
Goal 1: Business Process Visibility
29

30. © 2017 SPLUNK INC.
Goal 2: Online Store Process Flow
30

31. © 2017 SPLUNK INC.
New Requirements!
● Create a new KPI for the DB Service:
● Network Utilization
● Modify the Executive Glass Table
in order to show off the services
you slave over
“WE only have about
15min
TO DO WHAT ???!!???”
Think about how long
this would take you
today?
31

32. © 2017 SPLUNK INC.
Configuration of DB Service
Click Configure >
Click Services
32

33. © 2017 SPLUNK INC.
Let’s Talk Entities
● Select Database Service
● Entities are the relevant things which
support this service (usually hosts)
● Select the right entries with filters, ANDs,
ORs
● Original Entity list can come from CMDB,
spreadsheet, Splunk search, others
33

34. © 2017 SPLUNK INC.
A KPI in 5 minutes? Absolutely!
Click New – Generic KPI
KPI Source: Data Model
● Host Operating System
● Performance - Network
● # bytes
● Next
Title it “Network Usage”,
then Next
34

35. © 2017 SPLUNK INC.
KPIs Continued….
Splunk Builds Searches for you –
Oh Yeah, that’s happening J
Select
● Split by Entity: Yes
● Filter to Entities: Yes
● Entity Lookup Field: host
● Entity Alias Filtering: host
● Click Next
35

36. © 2017 SPLUNK INC.
Almost There…
Select
● KPI Search Schedule: Every Minute
● Entity Calculation: Average
● Service/Agg Calculation: Average
● Calculation Window: Last Minute
● Click Next
● Unit: Bps
● Enable backfill: (check)
● Click Next
36

37. © 2017 SPLUNK INC.
Final Steps …
Set your thresholds:
● Aggregate (All)
● Per Entity
● Click “Add Threshold” TWICE
● Make the Neapolitan ice cream colors
Yellow, Green, Yellow
● Drag the sliders around in order to get
the current data graph entirely inside
the Green (normal) band
● Click Finish
● Other options are also available,
including adaptive thresholds and
anomaly detection
37

38. © 2017 SPLUNK INC.
Adaptive Thresholds
What if your KPI data looks like this?
38

39. © 2017 SPLUNK INC.
Adaptive Thresholds
Static thresholds will not work…
39

40. © 2017 SPLUNK INC.
Adaptive Thresholds
Adaptive Thresholding works beautifully with cyclical (and other dynamic) data
40

41. © 2017 SPLUNK INC.
Anomaly Detection
● Machine Learning
● “Trending” detects deviations for
aggregate KPI based on
historical trends
● “Entity Cohesion” detects entities
which deviate from “pack”
behavior
41

42. © 2017 SPLUNK INC.
Let’s Fix that Glass Table
42

43. © 2017 SPLUNK INC.
Clone the Glass Table
Return to Saved Glass Tables page
(click on Glass Tables in the upper menu bar)
CLICK Edit for
“Buttercup Games Business Process (IN PROCESS)”
• Select Clone
• Title: Add your username
to the front
• Permissions: Shared in App
• Click Clone Page
• Click on your new Glass Table
from the list, to view it (hint: it
might be on page 2)
43

44. © 2017 SPLUNK INC.
Edit & Have Fun!
Click on Edit in the upper right corner of your Glass
Table
Use the “Services” panel on the left to select Individual
KPIs, or Aggregate Service Health Scores
• Choose 2 KPIs from Buttercup Store that would be
useful in the “Order Processing” section
• Drag the selected widgets onto the canvas,
positioning near the shopping cart
• What’s the difference between the
and tools at the top left?
44

45. © 2017 SPLUNK INC.
More Fun with the Glass Table Editor…
Use the Configurations panel on the right to edit
a selected widget
• Can change the visualization type, drilldown
behavior, and other settings
• You should hit Save frequently
• Revert All Changes can be helpful,
occasionally
45

46. © 2017 SPLUNK INC.
Finishing up …
• Add a ServiceHealthScore widget for
Buttercup Store in the left corner
• Choose a Viz Type with a sparkline
graph, then resize to make it look pretty
• Modify the Custom Drilldown action
to go to the saved glass table,
4 – Digital Transaction Flow
• Bonus Points: Make the label bigger,
more readable
• Click Save
• View when done
46

47. © 2017 SPLUNK INC.
Service Intelligence
Design Practices
47
47

48. © 2017 SPLUNK INC.
Bring Subject
Experts Together
Design Before
Configuring
Best Practices for Service Intelligence
Start With a
Problem Worth
Solving
48

49. © 2017 SPLUNK INC.
Best Practices for Service Modeling
Start with a
problem worth
solving
1
Claims Processing
Database?
Online Store
Authentication?
DNS?
49

50. © 2017 SPLUNK INC.
Best Practices for Service Modeling
Bring subject
experts together
2
Service Owners
Architects
Ops
Dev
Admins
50

51. © 2017 SPLUNK INC.
Best Practices for Service Modeling
Design before
configuring
3
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- # of calls
- # of errors
- Memory %
- # of queries
- Avg response time
- Disk usage
- # of API calls
- Heartbeat failures
- Network usage
51

52. © 2017 SPLUNK INC.
Service Intelligence Design in ITSI
1. Identify a high-value business service
(Buttercup Games Online Store)
2. Lay out the supporting services
(Web, Middleware, Database)
3. Determine relevant KPIs for each service
(Database:, errors, SQL hits, …)
4. Create a Splunk search for each KPI
(index=DB (warn* OR error*) | stats count)
52

53. © 2017 SPLUNK INC.
Here's What the Process Looks Like
on a Whiteboard
53

54. © 2017 SPLUNK INC.
What are some important services?
54

55. © 2017 SPLUNK INC.
What are some important services?
DNS
55

56. © 2017 SPLUNK INC.
What are some important services?
DNS
Online Store
56

57. © 2017 SPLUNK INC.
What are some important services?
DNS
Online Store
ERP
57

58. © 2017 SPLUNK INC.
Do They Impact Revenue, Customers, etc?
DNS
Online Store
ERP
58

59. © 2017 SPLUNK INC.
Do They Impact Revenue, Customers, etc?
DNS
Online Store
ERP
59

60. © 2017 SPLUNK INC.
Do We Have Supporting Data?
Online Store
ERP
60

61. © 2017 SPLUNK INC.
Do We Have Supporting Data?
Online Store
ERP
61

62. © 2017 SPLUNK INC.
We've Got Our Service!
Online Store
62

63. © 2017 SPLUNK INC.
Any problems or recent outages?
Online Store
63

64. © 2017 SPLUNK INC.
Any problems or recent outages?
Online Store - Increase in cust care calls
- Failed transactions
64

65. © 2017 SPLUNK INC.
What is the Impact of These Outages?
Online Store - Increase in cust care calls
- Failed transactions
65

66. © 2017 SPLUNK INC.
What is the Impact of These Outages?
Online Store - Increase in cust care calls
- Failed transactions
$46K/week in lost revenue
66

67. © 2017 SPLUNK INC.
What are the supporting services for the online
store?
Online Store
67
- Increase in cust care calls
- Failed transactions
$46K/week in lost revenue

68. © 2017 SPLUNK INC.
What are the supporting services for the online
store?
Online Store
Web Tier
68
- Increase in cust care calls
- Failed transactions
$46K/week in lost revenue

69. © 2017 SPLUNK INC.
What are the supporting services for the online
store?
Online Store
Web Tier
Middleware
69
- Increase in cust care calls
- Failed transactions
$46K/week in lost revenue

70. © 2017 SPLUNK INC.
What are the supporting services for the online
store?
Online Store
Web Tier
Middleware
Database
70
- Increase in cust care calls
- Failed transactions
$46K/week in lost revenue

71. © 2017 SPLUNK INC.
- Increase in cust care calls
- Failed transactions
$46K/week in lost revenue
What are the supporting services for the online
store?
Online Store
Web Tier
Middleware
Database
Mobile Tier
71

72. © 2017 SPLUNK INC.
What are the supporting services for the online
store?
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
72

73. © 2017 SPLUNK INC.
What are some business-level KPIs for the online
store?
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
73

74. © 2017 SPLUNK INC.
What are some business-level KPIs for the online
store?
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- Cust Sentiment
74

75. © 2017 SPLUNK INC.
What are some KPIs for the Web Tier?
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- Cust Sentiment
75

76. © 2017 SPLUNK INC.
What are some KPIs for the Web Tier?
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- Cust Sentiment- HTTP hits
- # of errors
- Avg response time
- CPU %
76

77. © 2017 SPLUNK INC.
And KPIs for the Others?
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- Cust Sentiment- HTTP hits
- # of errors
- Avg response time
- CPU %
77

78. © 2017 SPLUNK INC.
And KPIs for the Others?
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- Cust Sentiment- HTTP hits
- # of errors
- Avg response time
- CPU %
- # of calls
- GC times
- # of errors
- Memory %
- # of queries
- Avg response time
- Disk usage
- # of API calls
- Heartbeat failures
- Queue length
- Network usage
78

79. © 2017 SPLUNK INC.
Looking Good! Do we have Splunk data for these
KPIs?
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- Cust Sentiment- HTTP hits
- # of errors
- Avg response time
- CPU %
- # of calls
- GC times
- # of errors
- Memory %
- # of queries
- Avg response time
- Disk usage
- # of API calls
- Heartbeat failures
- Queue length
- Network usage
79

80. © 2017 SPLUNK INC.
Looking Good! Do we have Splunk data for these
KPIs?
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- Cust Sentiment- HTTP hits
- # of errors
- Avg response time
- CPU %
- # of calls
- GC times
- # of errors
- Memory %
- # of queries
- Avg response time
- Disk usage
- # of API calls
- Heartbeat failures
- Queue length
- Network usage
80

81. © 2017 SPLUNK INC.
Got Everything We Need?
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- HTTP hits
- # of errors
- Avg response time
- CPU %
- # of calls
- # of errors
- Memory %
- # of queries
- Avg response time
- Disk usage
- # of API calls
- Heartbeat failures
- Network usage
81

82. © 2017 SPLUNK INC.
1. Problem Worth Solving?
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- HTTP hits
- # of errors
- Avg response time
- CPU %
- # of calls
- # of errors
- Memory %
- # of queries
- Avg response time
- Disk usage
- # of API calls
- Heartbeat failures
- Network usage
82

83. © 2017 SPLUNK INC.
1. Problem Worth Solving?
CHECK!
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- HTTP hits
- # of errors
- Avg response time
- CPU %
- # of calls
- # of errors
- Memory %
- # of queries
- Avg response time
- Disk usage
- # of API calls
- Heartbeat failures
- Network usage
83

84. © 2017 SPLUNK INC.
2. Supporting Services & Dependencies?
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- HTTP hits
- # of errors
- Avg response time
- CPU %
- # of calls
- # of errors
- Memory %
- # of queries
- Avg response time
- Disk usage
- # of API calls
- Heartbeat failures
- Network usage
84

85. © 2017 SPLUNK INC.
2. Supporting Services & Dependencies? CHECK!
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- HTTP hits
- # of errors
- Avg response time
- CPU %
- # of calls
- # of errors
- Memory %
- # of queries
- Avg response time
- Disk usage
- # of API calls
- Heartbeat failures
- Network usage
85

86. © 2017 SPLUNK INC.
3. KPIs?
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- HTTP hits
- # of errors
- Avg response time
- CPU %
- # of calls
- # of errors
- Memory %
- # of queries
- Avg response time
- Disk usage
- # of API calls
- Heartbeat failures
- Network usage
86

87. © 2017 SPLUNK INC.
3. KPIs? That we can actually build?
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- HTTP hits
- # of errors
- Avg response time
- CPU %
- # of calls
- # of errors
- Memory %
- # of queries
- Avg response time
- Disk usage
- # of API calls
- Heartbeat failures
- Network usage
87

88. © 2017 SPLUNK INC.
3. KPIs? That we can actually build?
CHECK!
Online Store
Web Tier
Middleware
Database
Mobile Tier
External Calls
- Revenue per min
- # of checkouts
- # of Cust Care Calls
- HTTP hits
- # of errors
- Avg response time
- CPU %
- # of calls
- # of errors
- Memory %
- # of queries
- Avg response time
- Disk usage
- # of API calls
- Heartbeat failures
- Network usage
88

89. © 2017 SPLUNK INC.
Bring Subject
Experts Together
Design Before
Configuring
Best Practices for Service Intelligence
Start With a
Problem Worth
Solving
89

90. © 2017 SPLUNK INC.
Let’s Play!
A Troubleshooting Exercise
90

91. © 2017 SPLUNK INC.
A Troubleshooting Exercise
Let’s use ITSI to troubleshoot an outage
● Start at your Glass Table, “<UserName> Buttercup Business Process”
● Customer Care reports that unhappy customers are complaining of
failures and long delays when trying to purchase
● The calls began coming in at about 22 minutes past the last hour.
● In the upper right corner of the Glass Table, change the time picker
from Now to XX:22:00.0, where XX is the previous hour.
For example, if it is currently 14:05, set the time picker to
13:22:00.0, then Apply
This is how we can “time travel” back to see conditions at a particular outage– oh yeah!
91

92. © 2017 SPLUNK INC.
A Troubleshooting Exercise, cont’d
The Online Store seems to be
degraded, just as Customer Care
reported. Click on the widget in the
upper left corner to drill down further
92

93. © 2017 SPLUNK INC.
A Troubleshooting Exercise, cont’d.
● The Online Store Glass Table shows a
much more detailed view, including the
impacted customer-facing KPIs at the far
left (Revenue, etc)
● Based on this view of all the relevant
services, where do you think the root
cause lies?
● Which service should we troubleshoot
first?
● Click on Health widget for that service, to
drill down to a Deep Dive
93

94. © 2017 SPLUNK INC.
Deep Dive
● Deep Dive shows multiple KPIs and Health Scores in parallel “swim lanes”.
● The Health Score for this Service is the top swim lane. Can you see when it begins to degrade from 100%?
● Mousing over this point in time, can you spot the KPI with the leading fault indication, i.e., what failed first?
● To improve readability, make sure the
Primary Time Range (upper right corner)
is set to
Date & Time Range > Between XX:00:00.0
and XX:30:00.0
94

95. © 2017 SPLUNK INC.
Multi-KPI Alerts and Notable Events
● Click on Notable Events Review
● Multiple KPIs and Healthscores can
be combined in sophisticated ways
to create Multi-KPI alerts
● When a Multi-KPI alert fires, one of
the outcomes is the creation of a
Notable Event
● Notable Events allow NOC
personnel and others to triage and
coordinate event management
efforts
95

96. © 2017 SPLUNK INC.
Service Analyzer
● Click on Service Analyzer > Default Service Analyzer
● Back where we started!
● This view shows a “no-frills” list of
services (top) and hottest KPIs
(bottom)
● Provides access into Service Details
● It is useful for NOCs and others who
need a high-level situational view
96

97. © 2017 SPLUNK INC.
Let’s Play!
Advanced Exercises
97

98. © 2017 SPLUNK INC.
Summary
● High-value services can be decomposed and modeled in ITSI, using
machine data from the relevant systems
● Services and KPIs can be created in minutes, with sophisticated
thresholding techniques to distinguish “normal” from “not normal”
● Glass Tables allow service health and KPI metrics to be displayed in a way
that makes sense to specific groups, such as Executive Leadership,
Business Service Owners, the NOC, DevOps & Others
● Deep Dives allow KPIs to be compared side-by-side across any time
range, accelerating root cause analysis and significantly reducing MTTR
● Multi-KPI Alerts and Notable Events reduce alert noise, producing
actionable events and a means to manage them
● … and it’s fast & fun to build!
98

99. © 2017 SPLUNK INC.
What our
ITSI Customers are doing
99

100. © 2017 SPLUNK INC.
Splunk’s Solution: A lens could be multiple processes…
All the scores are time based KPI’s
or nested sub processes that are
searching in real time for some
relevant condition of interest.
These are Heath Scores – a high level aggregation of the health of the underlying processes.
All the scores are color coded to convey if
they are “normal” or “abnormal” based on
your criteria OR Splunk’s Packaged
Machine Learning, enabled with an
ON/OFF switch.
This shows how
‘Glass Tables’ can
visualize key
performance
indicators and health
scores that combine
data from diverse
sources.
This example is an
abbreviated ‘Book to
Bill’, or sometimes
called ‘Order to Cash’
business process.
100

101. © 2017 SPLUNK INC.
Call Center Service
Service Health Transactions
ACD Analysis – Core Splunk
Call Wait History
Inbound Analysis
Social Media
Online Msg
Social Media
Mail SupportVOIP Service
Inbound Calls
101

102. © 2017 SPLUNK INC.
Online Transactions
Services
Internal Transfer Service
External Wire Service
Money Exchange Service
Money Transfer Services
Service Health Corporate
Reconciliation Service
Fed Exchange Service
Core Splunk Searches
Transaction History
System Investigation
Heat Map Analysis
102

103. © 2017 SPLUNK INC.
Sign Up Now – We’re here to help!
Harness the creativity and domain knowledge of your organization to
unlock the value of data and solve an important Business Service
problem through a joint service intelligence workshop with key
stakeholders
Define methods for:
› Proactive service monitoring
› Reduced risk and failures
› Faster issue resolution
› Increased business performance
What is it?
› 1 Day Onsite Workshop
› Tightly linked with value
› Collaborative approach
› Build your own Glass Table
103

104. © 2017 SPLUNK INC.
Our Workshop In Action
104

105. © 2017 SPLUNK INC.
Bring Subject
Experts Together
Design Before
Configuring
Call To Action
Start With a
Problem Worth
Solving
105

106. © 2017 SPLUNK INC.
▶ 6000+ IT and Business Professionals
▶ 200+ Sessions
▶ 80+ Customer Speakers
PLUS Splunk University
▶ Three days: Sept 23-25, 2017
▶ Get Splunk Certified for FREE!
▶ Get CPE credits for CISSP, CAP, SSCP
SEPT 25-28, 2017
Walter E. Washington Convention Center
Washington, D.C.
.conf2017
The 8th Annual Splunk Conference
conf.splunk.com

107. © 2017 SPLUNK INC.
Reference Stuff
● ITSI Sandbox Guide: (An app on your ITSI instance)
● ITSI Documentation:
http://docs.splunk.com/Documentation/ITSI
107

108. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Thank You