Splunk for IT Operations and IT Service Intelligence

Copyright©2015,SplunkInc.

SplunkforITOpera>onsandITServiceIntelligence14.April2016Moscow

PhilippDriegerSalesEngineerDACH&EEEMEACentralSMEIoT&ML


Agenda

•  SplunkOverview•  SplunkforITOpera>ons•  ExtendandAcceleratewithApps•  SplunkITServiceIntelligence(ITSI)•  SplunkforBusinessAnaly>cs


SplunkOverview

Copyright©2015,SplunkInc.Copyright©2015SplunkInc.

BigDataComesfromMachinesVolume | Velocity | Variety | Variability

GPS,RFID,

Hypervisor,WebServers,

Email,MessagingClickstreams,Mobile,

Telephony,IVR,Databases,Sensors,TelemaEcs,Storage,

Servers,SecurityDevices,Desktops4


TurnMachineDataintoOpera>onalIntelligenceINDEXANYMACHINEDATA:ANYSOURCE,TYPE,VOLUME

OnlineServices Web

Services

ServersSecurity GPS

Loca>on

StorageDesktops

Networks

PackagedApplica>ons

CustomApplica>onsMessaging

TelecomsOnline

ShoppingCart

WebClickstreams

Databases

EnergyMeters

CallDetailRecords

SmartphonesandDevices

RFID

On-Premises

PrivateCloud

PublicCloud

GAINREAL-TIMEVISIBILITY

ApplicaEonDelivery

SecurityandCompliance

InfrastructureMonitoring

BusinessAnalyEcs

InternetofThings

5


SplunkforITOpera>ons


CIOObstacle:Escala>ngITComplexity

SERVERS STORAGE NETWORKING

VIRTUALIZATION

INFRASTRUCTUREAPPLICATIONS

PACKAGEDAPPLICATIONS

CUSTOMAPPLICATIONS

Iden>ty

VPN

IPPhone

HR

Email

Finance

AppSvr

DB

WebSvr SaaS/PaaS

IaaS


CIOObstacle:Escala>ngITComplexity

SERVERS STORAGE NETWORKING

VITUALIZATION

INFRASTRUCTUREAPPLICATIONS

PACKAGEDAPPLICATIONS

CUSTOMAPPLICATIONS

Iden>ty

VPN

IPPhone

HR

Email

Finance

AppSvr

DB

WebSvr SaaS/PaaS

IaaS

Complex,silo-basedtechnologies

Disconnectedandoutdatedpointsolu>ons

Over70%of>mespentonmaintaining,notinnova>ng


Before Splunk

Data Gathering

DBApp NW

Storage

Now What?

….War Room

Outage Occurs

Human latency measured in hours or days

Не удается отобразить рисунок. Возможно, рисунок поврежден или недостаточно памяти для его открытия. Перезагрузите компьютер, а затем снова откройте файл. Если вместо рисунка все еще отображается красный крестик, попробуйте удалить рисунок и вставить его заново.


From Days to Minutes With Splunk

“First Responder”

2012-12-05 07:04:44 Id=Rd910EAJ City=New York [email protected] product_id=product_i BD-

66.57.19.112 ..[05/Dec/2012 07:05:22:152]”GET /card.do?action=addtocart &itemid=K9

[1208/12 02:39:03:209 UTC] 000000c6 ConnectionEve A J2CA00561: ConnectionExeception:[IBM][CLI Driver] SQL1224N

Report and analyze

Custom dashboards

Monitor and alert

Ad hoc search

2012-12-05 07:04:44 Id=Rd910EAJ City=New York [email protected]

product_id=product_i BD-

66.57.19.112 ..[05/Dec/2012 07:05:22:152]”GET /card.do?

action=addtocart &itemid=K9

[1208/12 02:39:03:209 UTC] 000000c6 ConnectionEve A

J2CA00561: ConnectionExeception:

[IBM][CLI Driver] SQL1224N

Outage Occurs


“Splunkreducedourescala>onsby90%andourproblemresolu>on>meby67%.

“EscalaEonsreducedby90%andMTTRdroppedby67%”

SplunkatServiceDesk:Vodafone

PauloCarvalhoDirectorOpera>ons

Theoldway:DisparateITsilosimpactCustomerService• Manuallyintensive,error-proneprocessesresultinconstantescala>onsandlongdelays

•  Expensive,home-growntoolsforlogcollec>onandanalysisdon’tprovidethecompletepicture•  Disconnectedsystemscreatetroubleinmee>ngsecurityandcompliancemandates

Thenewway:Providecomprehensivevisibilityandcontrol✓  AsingleTier1supportpersoncannowperformitera>vesearchesacrossalltheirITdatato

inves>gate,iden>fy,andfixtheproblem–escala>onsreducedby90percent

✓  Splunkconsolidateslogsfromdisparatesystemsintoasingleview,providingvisibilityacrossend-to-endservicedeliveryfromoneplace->metoproblemresolu>ondroppedby67%

✓  Role-basedsecureaccesstologsviaSplunkensuresSOXcompliance

✓  MonitorITdataandfindissuesbeforetheybecomevisibletocustomers


Splunk:TheBeherApproachForIT

12

CustomerFacingData

OutsidetheDatacenter

ApplicaEons  Weblogs  Log4J,JMS,JMX  .NETevents  Codeandscripts

Networking  Configura>ons  syslog  SNMP  nejlow

Databases  Configura>ons  Audit/querylogs  Tables  Schemas

VirtualizaEon&Cloud  Hypervisor  GuestOS,Apps  Cloud

Linux/Unix  Configura>ons  syslog  Filesystemps,iostat,top

Windows  Registry  Eventlogs  Filesystemsysinternals

Logfiles Configs Messages TrapsAlerts

Metrics Scripts TicketsChanges

  Click-streamdata  Shoppingcartdata  Onlinetransac>ondata

  Manufacturing,logis>cs…  CDRs&IPDRs  Powerconsump>on  RFIDdata  GPSdata

Powerful,end-to-end,real->meplajormforMachineData


Splunk:TheBeherApproachForIT

13

CustomerFacingData

OutsidetheDatacenter

ApplicaEons  Weblogs  Log4J,JMS,JMX  .NETevents  Codeandscripts

Networking  Configura>ons  syslog  SNMP  nejlow

Databases  Configura>ons  Audit/querylogs  Tables  Schemas

VirtualizaEon&Cloud  Hypervisor  GuestOS,Apps  Cloud

Linux/Unix  Configura>ons  syslog  Filesystem  ps,iostat,top

Windows  Registry  Eventlogs  Filesystemsysinternals

Logfiles Configs Messages TrapsAlerts

Metrics Scripts TicketsChanges

  Click-streamdata  Shoppingcartdata  Onlinetransac>ondata

  Manufacturing,logis>cs…  CDRs&IPDRs  Powerconsump>on  RFIDdata  GPSdata

Powerful,end-to-end,real->meplajormforMachineData

NoupfrontschemaNocustomconnectorsNoRDBMS

• Anyamount,anyloca>on,anysource.


ExtendandAcceleratewithApps


AppsProvideDeepInsightsByRole

15

Findandresolveproblemsfastinindividualtechnologyareas

ExchangeAdmin

ServiceHealthPerformance

Messagetracking

VMware/Win/LinuxAdmin

InfrastructureHealthPerformance

Anomalies/Outliers

StorageAdmin

InfrastructureHealthPerformance

Anomalies/Outliers


ReduceCosts:Consolidatetools,eliminatesilos,findrootcausefaster!

ExchangeAdmin

Linux/WinAdminNetworkAdmin Applica>ons

AdminLineofBusiness

User

Applica>onSupport

VMware/Linux/WinAdmin

SecurityAdmin StorageAdmin ITManagement


Splunk:PlajormForITOpera>onalIntelligence

17

Plug-Ins,TemplatesandAppsAccelerateValueFromMachineData

Norigidschemas–Addindatafromanyothersource.

APISDKs UI

Server, Storage, Network

Server Virtualization

Operating Systems

Custom Applications

Business Applications

Cloud Services

App Performance Monitoring Ticketing/ and Other

WebIntelligence

Mobile Applications

Stream


SplunkForOpera>ngSystems

Proactive Monitoring

Operational Analytics

End-to-End Visibility

Getinstantinsightintoinfrastructurehealth

OSMetricsforPerformance,Capacity&ResourceAllocaAonAnalyses

ScaleAndCorrelateAcrossAllTiersOfYourTechnologyStack

18


SplunkForVirtualiza>on&Storage

Proactive Monitoring

Operational Analytics

End-to-End Visibility

Real-AmeacAonableinsightsintoproblemspotsandhealthissues

Real-Ame&historicalinsightsintoperformance,security,capacity,forecasAngandchangetracking

ScalableBigDatasoluAonforholisAcvisibilityacrossalltechnologyAers

19


SplunkforITServiceIntelligence


INTRODUCING

Data-drivenserviceinsightsforroot-causeisola>onandimprovedserviceopera>ons


CurrentChallenges

22

Can’taccessthedatathatmahers

Mul>pleproductslackdeepintegra>on

Complexandcustomizedtoolsrequiresignificantexper>seand>me

ITorganizaAonsconAnuetostrugglewithaligningoperaAonswithbusiness

FRAGMENTEDINSIGHTS

SLOW&REACTIVE

INEFFICIENT&UNSCALABLE


SplunkITServiceIntelligence

23

DataDriven•  AllITData-events,metrics,andlogs

Service-awareness•  Providesac>onableinsightsintohighvisibilityservices•  Personalcontextualvisualiza>ons•  Mi>gateproblemsbeforetheyimpactcustomers.

PowerfulPlajorm•  Fastcorrela>onacrossservices&KPIs•  DeploysQuickly•  Scalable,flexibleandfast>me-to-value•  ScalableUniversalPlajorm(anypointin>me)


WhatMakesSplunkITSIDifferent!

24

Search-BasedKPIsEasytowrite,manageandchangebothservicesandKPIs

Reflectsbusinessandtechnologypriori>es

Benefit:Rapidlygenerate&changeKPIstoalignservicehealthwithbusiness

Fiserv–1000sinjustweeks

FullFidelityServiceHealth

Adaptableandflexibledefini>onsofservicehealth

Onesolu>ontogoseamlesslyfromservicereportstorootcause,includingrawdata

Remainsadaptableandyets>llmaintainscompletehistoricalcontext

UniversalDataPlajormDatadriven:AllITdataincludingevents,metricsandlogs

Schemaon-the-FlyAskanyques>onofthedata

FastEmetovalue

Datafidelity


SplunkITServiceIntelligenceData-drivenservicemonitoringandanaly>cs

25

SPLUNKITSERVICEINTELLIGENCE

Time-SeriesIndex

PlajormforMachineData

DynamicServiceModels

Schema-on-Read DataModel CommonInformaEonModel

At-a-GlanceProblemAnalysis

EarlyWarningonDevia>ons

SimplifiedIncidentWorkflows


ITSICoreConcepts


ITServiceIntelligence–CoreConcepts

Service RequestsResponses

Web

TechnicalServices Services

RequestsResponses

MobileAPI/Middleware

RequestsResponses

DNS

SupportDeskRequestsResponses

CustomerTransacEons

RequestsResponses

BusinessServices


PacketNetwork

HypervisorandHosts

RDBMSs

StorageTier

APIServices

WebServices InITSI,aServiceisalogicalgroupoftechnology

componentsthatauserdeemsneedtobemonitored

together.



Web

TechnicalServices Services

CustomerTransacEons

Web

CustomerTransacEons

RequestsResponses

BusinessServices

MobileAPI/

Middlew

are

SupportDesk

DNS




Web

TechnicalServices

PacketNetwork

HypervisorandHosts

RDBMSs

StorageTier

APIServices

WebServices

Web

KPI:NumberofrequestsKPI:ErrorrateKPI:Averageresponse>meKPI:ServicerCPUloadKPI:ServernetworkI/Ferrors

KPIs

KPIsandHealthscorescons>tutethemeansbywhichServicesare

monitored.

HealthScore



30

AHealthScoreisascoreform0-100(0beingcri>caland100beingnormal)thathelpsdeterminethehealthofaService.ItiscalculatedbasedonallKPIsimportanceanditsstatus(e.g.green,orange,red),onceeveryminute.

AKeyPerformanceIndicator(KPI)isaSplunksavedsearchcreatedwithintheITSIUIthathelpsmonitora

specificfieldlikeCPU,Memory,NumberofErrorsandsoon.KPIsarecontainedwithinServices.

ServiceAnalyzer–Autogeneratedfilterableand>ledviewofServicehealthscoresandKPIs



31

AGlassTableisacustomizablefreeformdrawingdashboardstoviewHealthscoresand

KPIsofchoicewithvisualtoolstocreatecontextwithlivewidgets

GoDeepertoaDeepDiveView



32

DeepDives–Swimlaneanalysisdashboardtoshowallthoseindicatorsover>mefor

inves>ga>ons



33

MulEKPIAlerts–Visualtooltocreatecorrela>onsearchesbasedonKPIs


NotableEvents

34

NotableEventsaregeneratedbycorrela>onsearchesthatindicateservicedegrada>on.TheyarelikeNotableEventsinESbuthaveaslightlydifferent

fieldsetTheCorrela>onsearchesaregeneratedeitherthroughthecorrela>onsearchUIorMul>KPIAlertUI.


SplunkforBusinessAnaly>cs


RealTimeClevelGlasstable…


..drillsdowntoindividualBPAStakeholdertglasstable….

37

Copyright©2015,SplunkInc.Copyright©2015SplunkInc. 38

..drillsdowntotheindividualpa>entjourney


Adap>veThresholding





Thanks–Q&A

Splunk for IT Operations and IT Service Intelligence

Data & Analytics