How to Design, Build and Map IT and Business Services in Splunk

HowToDesign,BuildAndMapITAndBusinessServicesInSplunk

JonLeBaugh,ITOpera?onsAnaly?csArchitect

SetupQues?ons

HowmanyofyouareusingSplunktosolveITusecases?Security?BusinessAnaly?cs?

WhatisyourlevelofexperiencewithSplunk?None–s?lltryingtofigureitoutBeginner–downloaded,maybetooksomeofthetutorials,geLngthehangofitIntermediate–beginningtobuilddashboardsAdvanced—usingSplunkregularly,buildingapps,spreadingthewordtootherteamsSplunkNinja–couldn’tlivewithoutit!

HowmanyofyouareaQendingSplunkLiveforthefirst?me?2yearsinarow,3yearsinarow?

Whatisyourjobprofile?CXO/VP/DirectorITArchitect/Opera?onsDeveloper/EngineerSecurityBusinessAnalyst/DataScien?stOther

Setup Questions

YearsofSplunkLiveAQendance?YearsUsageofSplunkEnterprise/Cloud?Usecases–IT/Security/BusinessAnaly?cs?AQendancerole–Manager/Exec/Architecct/ServiceOwner/Engineering/Administra?on?

Takeaways

HowToDerive‘ServiceIntelligence’

MethodologyforGeLngStartedwithServiceIntelligence

Introduc?onto

Theartofthepossible…

Connec?ngBusinessandTechnology

TheProblemScenario

Manufactureroftoysandgames

Supplychaintracksmovementofgoodsfrommanufacturingprocesstotheconsumer

Onlinestorefordirectbuyersandresellerstopurchasegoods

BuQercupGames

TheBusinessProblemforBuQercupGames

SupplyChain

Streamlineopera?ons

Measureefficiency

ERPSystems

BusinessImpact

$48,000/wkinrevenueloss

Warrooms32hrs/wk

???

FailedInterac9ons

OnlineStore

Customersa?sfac?on

TheBusinessProblemforBuQercupGames

SupplyChain

Streamlineopera?ons

Measureefficiency

ERPSystems

BusinessImpact

$48,000/wkinrevenueloss

Warrooms32hrs/wk

???

FailedInterac9ons

OnlineStore

Customersa?sfac?on

ISTHISAPROBLEMWORTHSOLVING?

WhyOldWaysDisappoint

InfrastructureLayerPower/Cooling/Facili?esServer–Networking–Storage

ServiceLayer BusinessService

Applica?onLayerMiddleware–Applica?onServer-DatabaseCustomApps

BusinessLayerMailTransport-OrderProcessingE-Commerce-Financials

Disparatetools,dataandsilosfailtodeliverserviceinsights

11

HowITSIcomplementscoreSplunk•  ThinkofcoreSplunkascollec?ng

dataateachhorizontallayer•  ITSIisa‘ver9calslice’thatonly

focusesonthecomponentsinthelayerthatrolluptoagivenapp

•  ASP–Applica?onServiceProvider(many,eachapporservice)

•  ISP–InfrastructureServiceProvider(usuallyonlyafew–thedatacentersorcloudprovider) PhysicalServer(Dell,HP,CISCObladesorservers)

GuestOS(Windows/Linux/*Nix)

Database(Oracle,SQLServer,MySQL)

Hypervisor(ESX,HyperV,Citrix)

WebServer(Apache,TomCat)

AppServer(WebLogic,JbossEAP,WebSphere)

11

Applica?ons,business/missionservices

SAN/NASStorage(EMC,AppNet)

Network

FullStackCustomApp

RESTbasedservice

ASPISP

Cloud

BringSubjectExpertsTogether

DesignBeforeConfiguring

BestPrac?cesForServiceModeling

StartwithaProblemworth

solving

StartWithAProblemWorthSolving

Reviewyourorganiza?on’scri?calservices

Iden?fyaservicethathasimpaclulandmeasurablechallenges

UncoveringtheProblemWorthSolving

•  Whatarethetopbusinessservicesinyourenterprise?

•  Howdoyoumeasurethecustomerexperiencewiththeseservices?

•  Whatisthecustomerexperiencewiththeseservices?

•  Howomendocustomersexperienceissueswiththeservice?

•  Whenissuesarise,whogetsinvolvedinresolvingthem?

•  Howdoteamsworktogethertoresolveissues?

•  What’stheaverage?metoissueresolu?on?

•  What’stheimpactwhencustomershaveabadexperiencewithyourservices?

Cri?calServices IssueFrequency Impact

BringSubjectExpertsTogether

Iden?fystakeholdersandsupportpersonnelfortheselectedservice

Createawarenessandinvitetheircollabora?ontosolvethebusinesschallenge

YourServiceIntelligenceCollaborators

16

ServiceOwners

• Businessfunc?ons

•  Performanceindicators

• Commonbusinessissues

•  Frequencyofissues

• Businessimpactofissues

Opera?onsandSupport

• Commonissues•  Performanceindicators

• Resolu?onprocesses

•  Toolsusedforresolvingissues

•  Frequencyofissues

•  ITimpactofissues

EnterpriseArchitecture

• Businessprocesses

•  Keyinputsandoutputs

•  Technologyarchitecture

• Dataarchitecture

• Commonissues

Administrators

• Currenttoolsandusage,andadop?onlevels

•  Splunkexper?se•  Environmentexper?se

•  Personalpain

DesignBeforeConfiguring

Iden?fypains,performanceindicatorsandmeasurementgoalsfortheservice

Iden?fycomponentsanddataneededtodriveserviceinsights

Consolidatethemappingsintoanenterpriseprocess/ITservicesmap

TerminologyMaQers

Logicalgroupingofopera?ons

OnlinebankingAuthen?ca?onVirtualiza?on

EXAMPLES

SERVICES

Setofac?onsperformedwith

specificbusinessgoals

SellproductsFulfillorder

Processpayroll

EXAMPLES

BUSINESSPROCESSES

Componentrequiredtodeliveraservice

HostsUsers

OSProcesses

EXAMPLES

ENTITIES

Metricsusedtoevaluatesuccess

ServicehealthOrderrevenue

Latency

EXAMPLES

KEYPERFORMANCEINDICATORS

ServiceDecomposi?on

Infrastructure Layer

Application Layer

Business Layer

Service Layer

OrderEntry Manufacturing Shipping Fulfillment

SupplyChain

OnlineStore EDI

WebTier Middleware

PuLngitalltogether

Infrastructure Layer

Application Layer

Business Layer

Service Layer

OrderEntry Manufacturing Shipping Fulfillment

SupplyChain

OnlineStore EDI

WebTier Middleware

• TotalOrders• TotalRevenue• ServiceHealth

• UnitCount• UnitFailures

• ServiceLevel • DeliveryTime

• OnlineOrders• OnlineRevenue

• ServiceHealth

• SuccessfulRequests• Errors(503)

• CPULoad• MemoryUsed• DiskUsed•  IOLatency

• CPULoad• MemoryUsed• DiskUsed•  IOLatency

• ResponseTime• Errors

• DBQueryCount• ResponseTime

Deconstruc?ngAService

???

SupplyChain OnlineStoreERPSystems FailedInterac?ons

Streamlineopera?ons

Measureefficiency

BusinessImpact

Warrooms32hrs/wk

$48,000/wkinrevenueloss

Customersa?sfac?on

PuLngItAllTogetherServiceLayer SupplyChain

InfrastructureLayerServer©Server

Applica?onLayer OnlineStore EDI

WebTier Middleware Database

BusinessLayerOrderEntry ShippingManufacturing Fulfillment

ServiceHealth

UnitCountUnitFailures

ServiceLevel DeliveryTime

OnlineOrdersOnlineRevenue

ServiceHealth

CPULoadMemoryUsedDiskUsedIOLatency

CPULoadMemoryUsedDiskUsedIOLatency

ServiceHealth ServiceHealth

TotalOrdersTotalRevenueServiceHealth

COLLECTDATAFROMANYWHERE

SEARCHANDANALYZE

EVERYTHING

DELIVERREAL-TIMEOPERATIONALINTELLIGENCETOITANDTHEBUSINESS

THEPOWEROF

DefiningServiceIntelligence

EnablingabusinessawareITMeasuringandrepor.ngonindicatorsthatma3er

Unlockingopera9onalefficienciesCollabora.ngacrosssilostoimproveserviceopera.ons

Data-baseddecisionmakingSolvingproblemsandan.cipa.ngpi9allswithsophis.catedanaly.csandpowerfulinsights

WHATIF…

Youcouldputcri?calserviceintelligencedirectlyintothehandsofthepeoplethatneedit,withthedatayoualreadyhaveinSplunk?

WhatWeHearFromOurCustomers

“MyCIOisdemandingwelookatITfromaBusinessServiceperspec?ve.”

“Splunkisgreatforbreak/fix,butIneedtoshowwe’remee?ngSLAs.”

“Ineedeveryonetobeabletoseethesamethingatthesame?me.”

“IjustwanttothrowdataatSplunkandhaveitfindproblemsforme.”

“Showmewhatmydatacandoforme!”

Data-drivenserviceinsightsforrootcauseisola?onandimprovedserviceopera?ons

INTRODUCING

SplunkITServiceIntelligence

SPLUNKITSERVICEINTELLIGENCE

Time-SeriesIndex

PlalormforMachineData

DynamicServiceModels

Schema-on-Read DataModel CommonInforma9onModel

At-a-GlanceProblemAnalysis

EarlyWarningonDevia?ons

SimplifiedIncidentWorkflows

ITServiceIntelligenceforBuQercupGames

SplunkITServiceIntelligence

WhatCanYouDoNext?

GetStartedONLINESANDBOX TRIAL

7daysofaccesstoafree,personalenvironmentintheCloud,withpre-

populateddata

Engageinaproof-of-concepttoindexyourdataandexperience

thepowerofSplunkITSIh"ps://splunk.box.com/ITSI-Sandbox-Guidebook ContactyourSplunkrepresenta?ve

GetYourHandsDirtyJuly14th,TexasExecu?veCenter

SignUpHere-We’reHereToHelp!Harnessthecrea?vityanddomainknowledgeofyourorganiza?ontounlockthevalueofdataandsolveanimportantserviceproblemthroughajoint

serviceintelligenceworkshopwithkeystakeholders

Definemethodsfor:•  Proac?veservicemonitoring

•  Reducedriskandfailures•  Fasterissueresolu?on•  Increasedbusinessperformance

Whatisit?•  1DayOnsiteWorkshop

•  Tightlylinkedwithvalue•  Collabora?veapproach•  BuildyourownSplunkITSIGlassTable……

Copyright©2016SplunkInc.

SEPT26-29,2016WALTDISNEYWORLD,ORLANDOSWANANDDOLPHINRESORTS

•  5000+IT&BusinessProfessionals•  3daysoftechnicalcontent•  165+sessions•  80+CustomerSpeakers•  35+AppsinSplunkAppsShowcase•  75+TechnologyPartners•  1:1networking:AskTheExpertsandSecurityExperts,BirdsofaFeatherandChalkTalks

•  NEWhands-onlabs!•  Expandedshowfloor,DashboardsControlRoom&Clinic,andMORE!

The7thAnnualSplunkWorldwideUsers’Conference

PLUSSplunkUniversity•  Threedays:Sept24-26,2016•  GetSplunkCer?fiedforFREE!•  GetCPEcreditsforCISSP,CAP,SSCP•  SavethousandsonSplunkeduca?on!

ThankYou