Do you have complex or obscure data you want to leverage in Splunk? Do your users, without the necessary domain knowledge, struggle to work with this data? Perhaps a data model can help bridge the knowledge gap. This webinar will use valuable (but complex…and even scary) mainframe metrics as a working example of how to get Splunk users up and running fast by leveraging the power of a data model. But, these principles are not just for mainframe. They can equally apply to other data types and scenarios. Not all users are well-versed in complex data structures and fields, but some are…so combine subject matter expert (SME) knowledge with this great Splunk facility to make everyone’s life simpler. Deliver real results in a very short time with little overhead or burden on users. View this webinar on-demand to learn: • The purpose of a data model • How mainframe data models work in Splunk • How to implement a mainframe data model in your organization

1. Ian Hartley
Product Management Director
Using a Data Model to Bridge the
Mainframe-Splunk Knowledge Gap
Working with [scary?] complex mainframe
data…or any other data

2. Housekeeping
Webcast Audio
• Today’s webcast audio is streamed through your
computer speakers.
• If you need technical assistance with the web interface
or audio,
please reach out to us using the chat window.
Questions Welcome
• Submit your questions at any time during the
presentation
using the chat window.
• We will answer them during our Q&A session following
the presentation.
Recording and slides
• This webcast is being recorded. You will receive an
email following the webcast with a link to download
both the recording and the slides.
Ian Hartley
Syncsort

3. Smalltalk
Go(lang)
MLTK
IT Service
Intelligence
Enterprise
Security
jQuery
Splunk >, Enterprise Security, IT Service Intelligence are registered trademarks of Splunk Inc. in the USA and other countries
®
®
Been there…done that…got the T-shirts!

4. Challenging Complex Data?
Less Technical Users?
A data model can help…

5. Typical Organization
Syncsort works with large organizations, departments, knowledge silos
…users don’t necessarily understand the data…

6. Typical Scenario
Splunk and Specialized “Knowledge Silos”

7. Typical Scenario
Splunk and Mainframe or IBM i “Knowledge Silos”

8. Typical Scenario
How to Bridge the “Knowledge Gap”?
{ }..?..

9. Typical Scenario
Data Model Creates a “Knowledge Bridge”
CICS and Db2 are registered trademarks of IBM Inc. in the USA and other countries
Data
Model
Mainframe
Batch
CICS
Db2
®
®

10. Data Model 101
Applies data hierarchy
• Datasets
• Parent/child inheritance
“Friendly” field names
• JobName not SMF30JBN
Baked-in SME knowledge
• Classification (source, selection)
• Calculations
• Formatting
• Normalized (IP or IPAddr or Ipaddress) = Ipaddress
Groups data into datasets
“Intelligent Lens” for Indexed Data
®
Mainframe
Batch
CICS
Group
JobName
JobNumber
AbendCode
Transaction

11. “Intelligent Lens” for Indexed Data
Pivot Editor
• Click-build reports/dashboards
• No SPL required
Extra commands
• datamodel
• pivot
Acceleration (optional)
• Super fast searches
No license impact
Used at search-time not index-time
Potential faster ROI
Data Model 101
| datamodel
| pivot
Commands
Pivot
Editor Acceleration
Indexed data
Data Model

12. • There can be a LOT of log data
• Some fields are obvious, most not user-friendly
• Raw data searches can be challenging
• Which data sources and fields to use?
• Incomprehensible field names
• Repetitions
• Bit fields
etc.
We’ve stayed 99% true to the original log format…
Mainframe Log Data
index=mfsmf MFSOURCETYPE=SMF072 SMF72STY=3 SYSNAME=*
| rename R723CIMP_0001 as "Goal Importance"
| chart sum(R723CSRV_0001) by "Goal Importance"

13. Switching the Light ON…
Mainframe [Dark?] Data
A Data Model opens up the dark
world of mainframe and other
complex log data to more users

14. Lights on!

15. Lights on!
Eval using a macro (reusable calculation)
Simple Eval

16. Lights on!
• Mainframe Data Model … 42 datasets … 550+ fields
• Batch (Jobs, Started tasks)
• CICS
• Db2 (Buffer Pool Activity, CPU, Locking, SQL Calls, System Storage Use)
• Resources (RMF III , System State, Workload Activity)
• Security (ACF2™, RACF , Top Secret )
• Syslog
• TSO
• + ‘Intelligence’ (calculations: CPU time, transaction responses, buffer I/O calcs, etc.)
• Splunk Event types (to categorize data)
• Splunk Macros (to locate data)
• Summary Index searches (make ‘complex’ Db2 and RMF III data available to model)
• Sample dashboard (example use of datamodel & pivot commands)
CICS, Db2, RACF, RMF are registered trademarks of IBM Inc. in the USA and other countries. ACF2 and Top Secret are registered trademarks of Broadcom Inc. in the USA and other countries.

17. Lights on!
Using a data model, search is a lot clearer with obvious sources and fields
index=mfsmf MFSOURCETYPE=SMF072 SMF72STY=3 SYSNAME=*
| rename R723CIMP_0001 as "Goal Importance"
| chart sum(R723CSRV_0001) by "Goal Importance"
Without data model
| pivot Mainframe WorkloadActivity
sum(TotalMSU) as "Sum of Total MSU"
SPLITROW GoalImportance as "Goal Importance"
With data model

19. Demo
19

20. Data Model Summary
Benefits
• Opens metrics to a broader audience
• Presents user-friendly, categorized structure
• Can include ‘SME intelligence’ for faster ROI
• Can reduce misuse and miscalculation
• Enables faster searching (via optional acceleration)
No Need To
• Learn specific data sources and fields
• Waste time deciphering cryptic field names
• Duplicate research/recreate essential calculations
• Depend on others to get results
Bridges the Knowledge Gap

21. Thank you