115
© 2017 SPLUNK INC. © 2017 SPLUNK INC. SEPTEMBER 13, 2017 | FINANCIAL SERVICES | CHICAGO

Splunk Forum Financial Services Chicago 9/13/17

  • Upload
    splunk

  • View
    173

  • Download
    1

Embed Size (px)

Citation preview

© 2017 SPLUNK INC.© 2017 SPLUNK INC.

SEPTEMBER 13, 2017 | FINANCIAL SERVICES | CHICAGO

© 2017 SPLUNK INC.

During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC.

The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release.

Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved.

Forward-Looking Statements

© 2017 SPLUNK INC.

Welcome Andrew Stein | Data Scientist & Business Analytics Practice, Splunk

SEPTEMBER 13, 2017 | FINANCIAL SERVICES

© 2017 SPLUNK INC.

Take the Survey on Pony Poll

ponypoll.com/finforumchi

© 2017 SPLUNK INC.

Program AgendaSplunk Forum Financial Services Chicago | September 13, 2017

12:45 – 1:00 WelcomeAndrew Stein, Splunk

1:00 – 1:30 Financial Services Industry Keynote Julie Conroy, Research Director, Aite Group

1:30 – 2:15

Panel Discussion Moderated by: Robert Wagner, Security Strategist, Splunk Julie Conroy, Research Director, Aite GroupEd Giles, SVP, Security Technology/Enterprise Enablement, The Northern TrustSubir Grewal, CFA, Head of Splunk Practice, Risk FocusMike Stankus, Director, Management and Systems Monitoring, CME GroupBob Beard, Director of Systems Engineering, CME Group

2:15 – 2:30 Break in Cloud Gate Foyer

2:30 – 3:00 Session 1: Splunk for Innovation in Financial Services, Brian Hoover, Splunk

3:00 – 3:30 Session 2: Splunk for Electronic Trading Operations Monitoring, Subir Grewal, Risk Focus

3:30 – 4:00 Session 3: Machine Learning and Predictive Analytics for Financial Services, Andrew Stein, Splunk

4:00 – 4:30 Closing Remarks

FinancialServices– CommonGoals

6

Helpingcustomersrealizetheirambitionsandsucceedfinancially.

GrowtheBusiness

Strikerevenuegrowthbycapitalizingonopportunitiesacrossalllinesofbusinessandgeographies.

StreamlineProcesses

Reducecomplexityandinefficiencies,releasingcapitaltobereinvestedinotherareasofthebusiness.

RewardShareholders

Generateattractiveandsustainablereturnforshareholders.

AttractTopTalent

Beaworkplacethatattractstoptalentandwhichcollaborationachievesresults.

CustomerDriven

Makethefinanciallivesbetterforcustomers,listeningtowhattheywantanddeliveringthesolutionstheyneed.

Source:AnnualreportsforleadingbankssuchasHSBC,BankofAmerica,SantanderBank…

© 2017 SPLUNK INC.

Overall FSI Digital Transformation2017 Top Industry Drivers*

Fintech Disruption Digital Technologies

Cloud Services Cyber Security

Advanced Analytics/ML Business Process & IT Modernization

End-to-End Operational Visibility

(* Source: Deloitte Report, 2017)

© 2017 SPLUNK INC.

Big Data is central to

these priorities

and drivers*

(* Source: Cap Gemini Consulting, 2016)

GPS,RFID,

Hypervisor,Web Servers,

Email, MessagingClickstreams, Mobile,

Telephony, IVR, Databases,Applications, Telematics, Storage,

Servers, Security Devices, Desktops,Wire Data, Social Data, Middleware

BigDataComesfromMachines

Machine data is the fastest growing, most complex, most valuable area of big data

Volume | Velocity | Variety | Variability

© 2017 SPLUNK INC.

Diversity & Silos of Machine Data Creates a Challenge

© 2017 SPLUNK INC.

FSI Processes & Services Use Data From Diverse Systems

TradeCapture

TradeExecution Validation Trade

BookingTrade

ClearingTrade

Settlement

Sample Trade Processing Flow

Hardware NetworkingFront & BackApplications

Message Queues

(SWIFT/FIX)

Enterprise Service

Bus

Devices

Diverse IT Systems Support Trade Processing

© 2017 SPLUNK INC.

Getting Visibility Across These Systems Is Challenging

Search & Identify

Monitor Systems/Process

Gain Operational Visibility

Get Business Insights

• What caused the delay in processing or settlement?• Where are the transaction confirmation details?• Does the user have access to the right data?• How many transactions were processed?• Can we prevent the problem from happening?• How is the customer experience? Did we meet SLAs?

Hardware NetworkingFront & BackApplications

Message Queues

(SWIFT/FIX)

Enterprise Service

Bus

Devices

Diverse IT Systems Support Trade Processing

© 2017 SPLUNK INC.

Gain Insights Across Financial Services Machine Data

COLLECT,CORRELATE,

ANALYZESecurityMessaging (SWIFT/FIX)

Payment Formats

(ACH/Wire)

Risk and Compliance

AppsOnline

Banking

Core Banking Engines

Trading Systems

Infrastructure

Payment Services

Hubs

Cyber Security

System Modernization, Monitoring, & Infrastructure

Cost Reduction

Regulation & Compliance

Real-Time Payments

Advanced Analytics

Digital Technologies & Omnichannel

Emerging Technologies (e.g. Blockchain)

Middleware

© 2017 SPLUNK INC.© 2017 SPLUNK INC.

SEPTEMBER 13, 2017 | FINANCIAL SERVICES

© 2017 SPLUNK INC.

Financial Services Industry Keynote

SEPTEMBER 13, 2017 | CHICAGO

Julie Conroy | Research Director, Aite Group

© 2017 SPLUNK INC.

Cybercrime on the rise: How to beat the bad guys

September | 2017

© 2017 SPLUNK INC.

© 2017 SPLUNK INC.

Source: Informationisbeautiful.net

© 2017 SPLUNK INC.

© 2017 SPLUNK INC.

As counterfeit declines, CNP fraud, account takeover and application fraud are rising around

the globe

$3.2 $3.3 $4.0 $4.4$5.5 $5.9

$1.4 $1.6$1.9

$2.2

$2.5$2.8

$0.6 $0.7$0.8

$0.8

$0.9$1.0

2015 2016 e2017 e2018 e2019 e2020

U.S. ATO, CNP, and Application Fraud Growth, 2015 to e2020 (In US$ Billions)

ATO fraud

Applicationfraud

CNP fraud

© 2017 SPLUNK INC.

The changing notion of identity: From face-to-face, to personally identifiable information to digital identity

© 2017 SPLUNK INC.

Machine learning and AI: Buzz words realizing their potential

© 2017 SPLUNK INC.

Machine learning turns the data lake into actionable intelligence

© 2017 SPLUNK INC.

ArtificialIntelligence

Cognitivecomputingandautomation

Naturallanguageprocessing

Cloudcomputing

BigdataDistributednetworking

Lowdatacosts

Concurrent/parallel/distributedcomputing

Marketing

KnowYour

Customer Tradingtechnology

Robo-advisors

Tradesurveillance

Fraudprevention

Technologyroots

Financialservicesusecases

Anti-moneylaundering

Cyber-security

© 2017 SPLUNK INC.

Fraudsters

© 2017 SPLUNK INC.

Legacy approaches don’t work in the face of rapidly evolving fraud and cybercrime

© 2017 SPLUNK INC.

The evolution of risk analytics

1990s Late2000s2012topresent

1980s

Static,inflexiblerules-basedsystems

Dawnofneuralnetworkmodels

Emergenceofbig-data-drivenanalytics

User-friendlyML

Combinationoflow-techringsandopportunisticfraudsters

Increasingorganizationamongfraudrings,Europeheavilytargetedduetobatchauthorization

processes

Frauddrivenbysophisticatedrings,fueledbyskimminganddatabreaches

Internationalorganizedcybercrimeringsrapidlyevolvetactics—FIsandmerchantshard-pressedtokeepup

Fraudanalytics

Criminaltactics

© 2017 SPLUNK INC.

Advances in analytics coupled with ready availability of data is driving significant leaps in

performance

$40,000

$295

$0.56

$0.02

1980 1996 2006 2016

Hard Drive Cost Per Gigabyte, 1980 to 2016

© 2017 SPLUNK INC.

Financial institution challenges

▶Siloed data and processes

▶ IT resource constraints▶Bureaucratic overhead▶ Inconsistent UX

© 2017 SPLUNK INC.

Effective security is a competitive issue

© 2017 SPLUNK INC.

Solution: Increased data visibility

▶ Use Splunk to collapse the data silos

▶ Differing business rules and analytics for different use cases

▶ Enables rapid identification and response

© 2017 SPLUNK INC.

Thank you.

Julie Conroy| Research [email protected]

Aite Group is a global research and advisory firmdelivering comprehensive, actionable advice onbusiness, technology, and regulatory issues and theirimpact on the financial services industry. With expertisein banking, payments, insurance, wealth management,and the capital markets, we guide financial institutions,technology providers, and consulting firms worldwide.We partner with our clients, revealing their blind spotsand delivering insights to make their businesses smarterand stronger.

Visit us on the Web and connect with us on Twitterand LinkedIn.

© 2017 SPLUNK INC.

Panel Discussion – How Splunk Addresses Critical FSI Industry Drivers

Julie Conroy, Research Director, Aite GroupSubir Grewal, CFA, Head of Splunk Practice, Risk FocusEd Giles, SVP, Security Technology/Enterprise Enablement, The Northern TrustMike Stankus, Director, Management and Systems Monitoring, CME GroupBob Beard, Director of Systems Engineering, CME GroupRobert Wagner, Security Strategist, Splunk

SEPTEMBER 13, 2017 | CHICAGO

© 2017 SPLUNK INC.

Panel Discussion – How Splunk Addresses Critical FSI Industry Drivers

Julie Conroy, Research Director, Aite GroupSubir Grewal, CFA, Head of Splunk Practice, Risk FocusEd Giles, SVP, Security Technology/Enterprise Enablement, The Northern TrustMike Stankus, Director, Management and Systems Monitoring, CME GroupBob Beard, Director of Systems Engineering, CME GroupRobert Wagner, Security Strategist, Splunk

SEPTEMBER 13, 2017 | CHICAGO

© 2017 SPLUNK INC.

Panel Discussion – How Splunk Addresses Critical FSI Industry Drivers

Julie Conroy, Research Director, Aite GroupSubir Grewal, CFA, Head of Splunk Practice, Risk FocusEd Giles, SVP, Security Technology/Enterprise Enablement, The Northern TrustMike Stankus, Director, Management and Systems Monitoring, CME GroupBob Beard, Director of Systems Engineering, CME GroupRobert Wagner, Security Strategist, Splunk

SEPTEMBER 13, 2017 | CHICAGO

© 2017 SPLUNK INC.

Panel Discussion – How Splunk Addresses Critical FSI Industry Drivers

Julie Conroy, Research Director, Aite GroupSubir Grewal, CFA, Head of Splunk Practice, Risk FocusEd Giles, SVP, Security Technology/Enterprise Enablement, The Northern TrustMike Stankus, Director, Management and Systems Monitoring, CME GroupBob Beard, Director of Systems Engineering, CME GroupRobert Wagner, Security Strategist, Splunk

SEPTEMBER 13, 2017 | CHICAGO

© 2017 SPLUNK INC.© 2017 SPLUNK INC.

THANK YOU15 MINUTE BREAK

© 2017 SPLUNK INC.© 2017 SPLUNK INC.

SEPTEMBER 13, 2017 | FINANCIAL SERVICES | CHICAGO

© 2017 SPLUNK INC.

During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC.

The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release.

Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved.

Forward-Looking Statements

© 2017 SPLUNK INC.

Splunk for Innovation in Financial ServicesBrian Hoover | Staff Analytics and IoT Practitioner

SEPTEMBER 13, 2017 | FINANCIAL SERVICES

© 2017 SPLUNK INC.© 2017 SPLUNK INC.

INNOVATION IS HARD

© 2017 SPLUNK INC.

Innovation Requires ChangeChange Is Hard

ShockDenialAnger

Time

Perf

orm

ance

Too much change too fast can result in a constant state of lost productivity and dissatisfaction:

A single “change” typically goes through an adoption lifecycle:

Kubler-Ross Change Curve..

© 2017 SPLUNK INC.

Our Tools Have To Enable ChangeNot Stand In The Way!

More Time Spent On Setup

AnalyzeExtract/Transform/LoadModelClassic

More Time Spent On Iterative Analysis!

Now

AnalyticsInnovation:TimeSeries

44

Classic

Getallthedatainonelocation(data-at-rest)

New

Getallthedataatthesametime(data-in-motion)

AnalyticsInnovation:NonDisruptive

45

ClassicDataonlypulledperiodicallytoavoiddisrupting

operationalsystems

NewDataingestedasitiscreated,from“digital

exhaust”MachineData

OperationalMachineDataPlatform

Nearreal-timeoperations

AnalyticsInnovation:StructureonDemand

46

ClassicCuratedStructure- Model,Index,Aggregatein

advanceforfastvisualization

NewIndexeverythingatingestion,letthequery/search

invokestructure

TechnicalRequirement:CorrelationOnDemand

47

ClassicJoinsdefinedinadvanceusingauniqueidentifier

orforeignkey

NewCorrelateon-demandusingtimeandanytextor

numericstring

AnalyticsInnovation:Anomaly“Self-Aware”

48

Classic

DiscoveryviaVisualization

New

Exceptionsautomaticallyregisteredandalerted

AnalyticsInnovation:OperationalMachineLearning

49

Classic

Machinelearningis“glued”on

New

Machinelearningandalertingareintegrated

AnalyticsInnovation:AgileChanges

50

Classic

Newdataandnewquestionsrequireanewdatamodel

NewNewdataandnewquestionscanbeincorporated

atanytime

© 2017 SPLUNK INC.© 2017 SPLUNK INC.

EXAMPLES

© 2017 SPLUNK INC.

Analytics Innovation

$12.7 BILLION Across

836 DEALS2016

Venture Capital

FSI Industry Examples

© 2017 SPLUNK INC.

Payments: Business Process Monitoring

This example recognizes the value of monitoring the entire stack from technology to business process with a single platform.

Horizontal IntegrationVertical Integration

© 2017 SPLUNK INC.

Payments: Business Process MonitoringSchematic

Only Key Process Entry and Exit Points Are Being Monitored (For Now)

© 2017 SPLUNK INC.

Payments: Business Process Monitoring

The resulting glass tables capture key payment process points.

Any gateway can be clicked to drill down into the underlying process health and measures.

Top Level View Of Payment KPI

Drill Down Into The Health Of Underlying Systems

© 2017 SPLUNK INC.

Regtech: Detect Anomalies For Non-Compliance

A Global Swiss investment bank prototyped a solution to address MiFID II’s Regulatory Technical Standards (RTS) in days instead of weeks. It correlates clock data from application servers with trade execution data.

https://www.splunk.com/blog/2017/08/01/mifid-ii-the-clock-is-ticking-for-financial-services.html

Clock Drift

Trade Count

Fill Before Order

Global Swiss Investment Bank

© 2017 SPLUNK INC.

Insuretech : Monitoring Business Activities Generated By Partners With Disparate Systems

Real time monitoring of the business impact and SLA compliance of partner business transactions generated by disparate systems. Developed in a matter of days.

European Insurer

Aggregate Of All Partner

Purchase

Quote

Failed Purchase

© 2017 SPLUNK INC.

Tradetech : FX Trade Monitoring

Transaction monitoring of FIX data for anomalies and unusual customer behavior in real time.

A Large UK Financial Institution

ML To Highlight Anomalies

© 2017 SPLUNK INC.

Marketing : Offer Monitoring

Offer and program popularity in the market through recent or even real-time analysis. This helps illustrate return on investment (ROI) for specific marketing campaigns.

© 2017 SPLUNK INC.

Operations : Call Center MonitoringLarge US Credit Union

These dashboards are optimized for “one click” access to three tiers of information;

• The top level KPI color coded for severity

• The recent trend of that KPI• The specific metrics that

provide context around the value of that KPI.

Clicking on any top tier KPI refreshes the sub panels without refreshing the page.

Color Coded KPI

Trend Of KPI

Relevant Metrics To KPI

© 2017 SPLUNK INC.

Summary

• The ability to analyze real time operations utilizing machine data opens a whole new set of innovation possibilities – Experiment and Fail Early

Source: Karl G. Shoemer, MS

© 2017 SPLUNK INC.

Summary

• The ability to analyze real time operations utilizing machine data opens a whole new set of innovation possibilities – Experiment and Fail Early

• Innovation requires change, and the impact of change on the organization can’t be ignored

20%

50%

30%Source: Karl G. Shoemer, MS

Design(promotes change)Default(accepts status quo)

Defiance(resists change)

© 2017 SPLUNK INC.

Summary

• The ability to analyze real time operations utilizing machine data opens a whole new set of innovation possibilities – Experiment and Fail Early

• The right platform for operational innovation has to enable change, not stand in the way

• Innovation requires change, and the impact of change on the organization can’t be ignored

© 2017 SPLUNK INC.© 2017 SPLUNK INC.

THANK YOUQ + A

© 2017 SPLUNK INC.

Splunk for Electronic Trading Operations Monitoring

Subir Grewal, CFA | Head of Splunk Practice, Risk Focus

SEPTEMBER 13, 2017 | CHICAGO

© 2017 SPLUNK INC.

Splunk partners of choice for Capital Markets

© 2017 SPLUNK INC.

Agenda▶ About Us

▶ Splunk Adoption Path

▶ Challenges

▶ Use Case Examples

▶ Summary

67

© 2017 SPLUNK INC.

Risk Focus▶ Expertise in Trading, Risk Management & Cloud Transformation▶ Right-sized:

• technical organization big enough to deliver• small enough to be efficient

▶ Capital Markets specialists▶ Top Ten Most Promising Cloud Banking Solution Providers of 2015 by Banking CIO Outlook Magazine▶ Splunk Practice

• Splunk Premier partner with Certified SEs, Architects and Consultants (US and EU).

• Integrated into every solution we deliver to provide operational visibility.

68

© 2017 SPLUNK INC.

Splunk Adoption Path

69

Log Aggregation Operational Intelligence

Automation and Machine Learning

© 2017 SPLUNK INC.

Challenges

70

Deployment Normalization and Visualization Scalability

© 2017 SPLUNK INC.

APIsMessaging layer

Standard Capital Market business process

71

Transaction

Data

Logs

Risk / Margin, Valuation EngineMarket Data

Trade Capture

Client reporting

Post-trade

Reference Data

Liquidity provider

© 2017 SPLUNK INC.

Validate.Trade Use Case▶ Trade workflow/validation engine▶ Objective is to improve Dodd-Frank/EMIR compliance.▶ Product coverage (FX, FI, IR etc.)▶ Supports all major regulatory regimes (US, EU, Canada, HK, etc.)▶ Global trade repositories (such as DTCC, ESMA)▶ Splunk dashboard delivered with Validate.trade

72

© 2017 SPLUNK INC.

Validate.Trade demo

73

Demo

© 2017 SPLUNK INC.

Cloud Infra monitoring case study▶ Build a private cloud at Top 5 N.A. Bank:

• Hosting over 10,000 VMs

• Tools to manage provisioning, rollout process

▶ Splunk monitors cloud service layer, and all VMs.▶ Delivers system and application logs across entire fleet in every environment.▶ Met retention requirements for ephemeral infrastructure.

74

© 2017 SPLUNK INC.

Scaling Splunk within Capital Markets▶ Segregated data to support information barriers

▶ Role-based access to allow some users to search across tenants

▶ Leverages administration benefits of common environment

▶ Manage varying retention requirements

▶ Scale to adapt to Splunk growth

© 2017 SPLUNK INC.

Manage the Splunk SDLC▶ Splunk Infrastructure as CODE

• Provision VM

• Install Agents

• Bootstrap Splunk install

• Configure indexers, search-heads

▶ Follow the same SDLC for Splunk as for other software

© 2017 SPLUNK INC.

Multi-Tenant Splunk for a firm-wide data lake

A rich topology with many different components

Deployment sequencing can be complex

© 2017 SPLUNK INC.

Multi-Tenant Splunk Management Console

78

© 2017 SPLUNK INC.

How We Do It▶ Automation….▶ Splunk infrastructure as code

▶ Fleet configurable at deployment▶ Installs are automated with minimal manual intervention▶ “Surge” capacity or additional nodes can be deployed in a similar manner

© 2017 SPLUNK INC.

Summary▶ Splunk can solve….

▶ We can help you:• Deploy

• Gain Intelligence

• Scale

80

© 2017 SPLUNK INC.© 2017 SPLUNK INC.

THANK YOUQ + A

© 2017 SPLUNK INC.© 2017 SPLUNK INC.

SEPTEMBER 13, 2017 | FINANCIAL SERVICES

© 2017 SPLUNK INC.

Ideal Use Cases for Machine Learning and Predictive Analytics

Andrew Stein – Analytical Architect for Machine Learning

SEPTEMBER 13, 2017 | FINANCIAL SERVICES

© 2017 SPLUNK INC.

During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC.

The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release.

Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved.

Forward-Looking Statements

THIS SLIDE IS REQUIRED FOR ALL 3 PARTY PRESENTATIONS.

© 2017 SPLUNK INC.

“Machine Learning Tour”

© 2017 SPLUNK INC.

Humans are good at learning, but we get lost in volume and details…

© 2017 SPLUNK INC.

▶ Improve decision making ▶ Uncover hidden trends or

relationships▶ Alert on deviations▶ Forecast or anticipate incidents

All of this requires diverse data from across many silos. Lots of unstructured, real-time data.

Why Do We Need Machine Learning?

© 2017 SPLUNK INC.

Overview of ML at Splunk

CORE PLATFORM SEARCH

PACKAGED PREMIUM SOLUTIONS

MACHINE LEARNING TOOLKIT

Platform for Operational Intelligence

© 2017 SPLUNK INC.

▶ Assistants: Guided model building, testing and deployment for common objectives

▶ Showcases: Interactive examples for typical IT, security, business and IoT use cases

▶ Algorithms: 25+ standard algorithms included with the toolkit

▶ ML Commands: New SPL commands to fit, test and operationalize models

▶ Python for Scientific Computing Library: Access to 300+ open source algorithms

Splunk Machine Learning ToolkitExtends Splunk platform functions and

provides a guided modeling environment

Build custom analytics for any use case

© 2017 SPLUNK INC.

Algorithms supported (v2.0, .conf2016)

© 2017 SPLUNK INC.

Custom Machine Learning – Success Formula

DomainExpertise

(IT, Security, …)

Data Science

ExpertiseSplunk

Expertise

Identify use cases

Drive decisions

Set business/ops priorities

SPL

Data prep

Statistics/math background

Algorithm selection

Model building

Splunk ML Toolkitfacilitates and simplifiesvia examples & guidance

Operational success

© 2017 SPLUNK INC.

AI

Machine Learning

Deep Learning

AI, Deep Learning, And Machine Learning

Intelligent Agents

No Human Involvement

Sentient Machines

Tensorflow

Data sets are large and unknowable

Guided Data Driven Decisions

Augmenting Human Reasoning

Operational Intelligence

Splunk ML offerings today

Neural Networks

© 2017 SPLUNK INC.

”Where does the MLTK live in the Splunk platform?”

© 2017 SPLUNK INC.

Continuous Data Ingest at Scale

DevelopVisualize PredictAlertSearch

Engineers Data Analysts

Security Analysts

Business Users

Native InputsTCP, UDP, Logs, Scripts, Wire, Mobile

Industrial DataSCADA, AMI, Meter Reads

Modular InputsMQTT, AMQP, COAP, REST, JMS

HTTP Event CollectorToken Authenticated Events

Technology PartnershipsKepware, AWS IoT, Cisco, Palo Alto

MaintenanceInfo

AssetInfo

DataStores

External Lookups/EnrichmentOT

Industrial Assets

IT

Consumer and Mobile Devices Real Time

© 2017 SPLUNK INC.

Sense and Respond

OT

Industrial Assets

IT

Consumer and Mobile Devices

Search

Third-PartyApplications

Smartphones and Devices

Tickets

Email

Send an email

File a ticket

Send a text

Flash lights

Trigger process flow

Every Search Can Use Machine Learning

AlertReal Time

© 2017 SPLUNK INC.

Splunk: Data Fabric

OT

Industrial Assets

IT

Consumer and Mobile Devices

Real Time

IT Users Analysts Biz Users

Ad hoc Search

Custom Dashboards

Monitor and Alert

Reports/Analyze

Clickstreams HadoopDevices Networks

GPS/Cellular

Online Shopping

CartsServers Applications

Data Warehouses

Structured Data Sources

CRM ERP HR Billing Product Finance

DB Connect Look-ups

ODBCSDKAPI

Analysts Biz Users

© 2017 SPLUNK INC.

Splunk and Tensorflow for SecurityCatching the Fraudster with Behavior Biometrics

© 2017 SPLUNK INC.

Qualitative Rule Engine

Identify Transaction

Paths

Uncover Relationships

and Relevancy

Part of a Solution Suite

Partner Solutions: Transaction AnalysisInvestigate and Analyze Transactional Behavior.

© 2017 SPLUNK INC.

“The Future”

© 2017 SPLUNK INC.

Today’s Workflow for Splunk to Spark

Hive Meta Store

Splunk DB Connect

Simba JDC

Splunk Thrift Server

© 2017 SPLUNK INC.

Future Splunk MLTK workflow with Spark

MACHINE LEARNING TOOLKIT

© 2017 SPLUNK INC.

Coming Soon : Mini SolutionsPredicting when a system is going to be resource constrained

MACHINE LEARNING TOOLKIT

ML Use Case

Technical overview

•Preselected Algorithm•Customer identifies the target field•Focused on single use case

•A Customizeable Workflow •Custom configuration of insights generated from workflow•Requires the MLTK and Python for Scientific Computing

© 2017 SPLUNK INC.© 2017 SPLUNK INC.

THANK YOUQ + A

© 2017 SPLUNK INC.

▶ Get the Machine Learning Toolkit from Splunkbase▶ Go watch Machine Learning Videos on Splunk YouTube Channel

http://tiny.cc/splunkmlvideos▶ Go watch the Machine Learning talks from .conf2016:

• Advanced Machine Learning in SPL with the Machine Learning Toolkit by Jacob Leverich

• Extending SPL with Custom Search Commands and the Splunk SDK for Python by Jacob Leverich

▶ Early Adopter and Customer Advisory Program: [email protected]

▶ Field ML Architects: Andrew Stein (astein@), Brian Nash (bnash@)

What Else?

© 2017 SPLUNK INC.© 2017 SPLUNK INC.

SEPTEMBER 13, 2017 | FINANCIAL SERVICES

© 2017 SPLUNK INC.

Closing Remarks

Andrew Stein | Data Scientist & Business Analytics Practice, Splunk

SEPTEMBER 13, 2017 | FINANCIAL SERVICES

WhySplunk?

FAST TIME-TO-VALUE

CLOUD, ON-PREMISE & HYBRID DEPLOYMENT

VISIBILITY ACROSS STACK, NOT JUST SILOS

ONE PLATFORM, MULTIPLE USE CASES

ANY DATA, ANY SOURCE, ASK ANY QUESTION

107

108

b e f o r e 2 0 1 52 0 1 2

Splunk for targeted solutions only. Isolated pockets of data and dashboard expertise

2 0 1 4

Desktop/Server Events and Performance for Plant Management. Consolidated Splunk metrics & logs for Proxy, App, Infra, Desktops

Federated Splunk• All data accessible to all users• Correlation across firm on a

global scale

Splunk Center of Excellence providing self-service and custom visualization solutions

dashboard expertiseindexed dataSplunk install

Monitoring can be divided into three layers

It checks performance and availability of application functionality e.g. by simulation end-user experience, interfaces, queues etc. – legal constraints to be considered.

It checks performance and availability of end to-end process leveraging also on functional monitoring results/application.

It manages and monitors base infrastructure in terms of resources utilization (memory, CPU, file systems, swap, network, disk space, throughput…) and main subsystems activity (processes, services…)

BusinessProcess

Function

Layer

Technology

< Components on Mainframe/Open (JCL, DB, Server…)

< Application

< Process

TargetGroup

Agg

rega

tion

& In

tegr

atio

n

< Business- / Process-Owner

< IT Application Manager

< IT Application Manager

< Application Owner

< Application Owner

< Operating/Provider

Server DataBase

Sto-rageetc..

Ally’s Splunk Journey

Multiple LoB

AD

OPT

ION

2012 2013 2014 2015 2016

“Find & Fix”Tool

Developers

LoBDashboards

EnterpriseSecurity

SINGLE LINE OF BUSINESS ENTERPRISE DEPLOYMENT,MULTIPLE LINES OF BUSINESS

© 2017 Ally Financial. Ally is a registered trademark. All rights reserved.

© 2017 SPLUNK INC.

Splunk Enterprise at ING Bank ŚląskiCollected data and its value

Data Operational Intelligence

Search and Investigation

Proactive Monitoring

Operational Visibility, DevOps

Real-time Business Insights

Online Services

Web Services

Servers SecurityNetworks

Domain systems

CustomApplications

Databases

ActiveDirectory

LogfilesSocialMedia

© 2017 SPLUNK INC.

Take the Survey on Pony Poll

ponypoll.com/finforumchi

© 2017 SPLUNK INC.

SEPT 25-28, 2017Walter E. Washington Convention Center Washington, D.C.

.conf2017The 8th Annual Splunk Conference

conf .sp lunk .com

You will receive an email after registration opens with a link to save over $450 on the full conference rate.You’ll have 30 days to take advantage of this special promotional rate!

SAVE OVER $450

© 2017 SPLUNK INC.

Delivered Globally: Online, Classroom, Self-

Paced

15 FreeGetting Started

VideosGet Splunk Certified

in 5 Days20 Classes

For more information: splunk.com/education

Knowledge is PowerSplunk Education

© 2017 SPLUNK INC.

Get Started Fast!splunk.com/education