Presented at SplunkLive! Paris 2018: - Introduction to Splunk for IT Troubleshooting & Monitoring - Metrics Overview - Use Cases

1. Integrating Metrics and Logs
Enhanced Troubleshooting & Monitoring
Romain Testu | Sales Engineer
27 Mars 2018 | Paris
#splunklive

2. During the course of this presentation, we may make forward-looking statements regarding future events or
the expected performance of the company. We caution you that such statements reflect our current
expectations and estimates based on factors currently known to us and that actual events or results could
differ materially. For important factors that may cause actual results to differ from those contained in our
forward-looking statements, please review our filings with the SEC.
The forward-looking statements made in this presentation are being made as of the time and date of its live
presentation. If reviewed after its live presentation, this presentation may not contain current or accurate
information. We do not assume any obligation to update any forward looking statements we may make. In
addition, any information about our roadmap outlines our general product direction and is subject to change
at any time without notice. It is for informational purposes only and shall not be incorporated into any contract
or other commitment. Splunk undertakes no obligation either to develop the features or functionality
described or to include any such feature or functionality in a future release.
Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in
the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2018 Splunk Inc. All rights reserved.
Forward-Looking Statements

3. © 2018 SPLUNK INC.
1. Introduction to Splunk for IT
Troubleshooting & Monitoring
2. Metrics Overview
3. Use Cases
• Splunk Enterprise 7.0
• Project Waitomo
• Project MintJS
What will we be
covering today?
Agenda

4. Escalating IT Complexity…
VIRTUALIZATION
STORAGE
PACKAGED
APPLICATIONS
CUSTOM
APPLICATIONS
HR
Email
Finance
App Svr
DB
Web Svr
INFRASTRUCTURE
APPLICATIONS
VPN
IP Phone
Identify
SERVERS NETWORKING
SaaS/PaaS
IaaS

5. VIRTUALIZATION
STORAGE
PACKAGED
APPLICATIONS
CUSTOM
APPLICATIONS
HR
Email
Finance
App Svr
DB
Web Svr
INFRASTRUCTURE
APPLICATIONS
VPN
IP Phone
Identify
SERVERS NETWORKING
SaaS/PaaS
IaaS
Escalating IT Complexity…
Complex, silo-based technologies
Disconnected and outdated point solutions
‘Swivel Chair’ to view both metrics and logs
Over 80% of time spent on
maintaining, not innovating

6. Splunk Evolution
The Evolution of Metrics and Logs

7. Raw Event Search on Log Events
Splunk 1.0: Find the “Needle in the Haystack”
Raw Event
Search

8. Statistical Analysis on Log Events
Splunk 3.0 and 5.0: Scan through and report on many events
Raw Event
Search
Optimization for
Statistical Queries

9. Metric Analysis on Metric Data Points
Splunk 7.0: Perform statistical calculations
Raw Event
Search
Optimization for
Statistical Queries
Optimization for
Metrics Queries

10. What are Metrics?
How are Metrics Defined and why are They Important?

11. Why Metrics?
… when you already use logs?
▶ Metrics
• Structured data
• Best way to observe a process or device
• Easy way to do monitoring
• You know what you want to measure
• e.g. performance, CPU, Number of
users, memory used, network latency,
disk usage
▶ Events (e.g. Logs)
• Unstructured data
• Needle in the haystack
• Can tell you all about the “why”
• Answers questions you might not even
have yet
• Very versatile

12. Time Metric Name
system.cpu.idle
Measure
(aka Value)
numeric data point,
different types,
e.g., count, gauge,
timing, sample
Dimensions
Host
(10.1.1.100, web01.splunk.com)
Region
(us-east-1, emea-1, apac-2)
IntanceTypes
(t2.medium, t2.large, m3.large)
What Does a Metric Consist of?
Numerical data points captured over time that can be compressed,
stored, processed and retrieved far more efficiently than events
ABC.XYZ

13. © 2018 SPLUNK INC.
“Splunk provides one platform to
analyze and investigate across
both events and metrics.”

14. Faster, Better, More
Efficient
How Metrics Improves Troubleshooting & Monitoring in
Your IT Environment

15. © 2018 SPLUNK INC.
▶ 20x and beyond performance
improvement for monitoring and
alerting using metrics data
▶ Sample use cases: CPU utilization,
temperature fluctuations in devices,
app downloads
▶ All Splunk Platform benefits apply:
• Visualizations and alerting
• Role-based access controls
• Data onboarding
• Clustering, Scaling, Alerting
• Leverage open source for existing
sourcetypes (statsd, collectd)
• Supports SaaS apps + legacy/on-
premises systems
Splunk Metrics
Taking the meh out of metrics
Metrics car telemetry dashboard–
example of high volume data, large # of searches in one dashboard

16. DEMO
SPLUNK ENTERPRISE 7.0

17. What’s new for 2018 ?!

19. Project Waitomo
Seamless Monitoring
and Troubleshooting
Expandable Install to Insight
in Minutes
Built for Infrastructure
Monitoring, deploys in
minutes and easy to
maintain
Start monitoring for free,
expand to span across
teams, use cases and
large hybrid environments
Metrics and logs in one
unified experience

20. © 2018 SPLUNK INC.
The Marriage of
Metrics & Logs
Splunk Project
Waitomo

21. Download Splunk Enterprise or try Splunk Cloud for free:
www.splunk.com/download
www.splunk.com/waitomo

22. MintJS … Soon in LAR

23. © 2018 SPLUNK INC.
1. Splunk allows you to troubleshoot and
monitor from a single platform
2. Splunk natively supports metrics at scale,
helping you reduce MTTR
3. New in 2018 – Project Waitomo purpose
built for infrastructure monitoring
Splunk provides one
platform to analyze and
investigate across both
Events and Metrics
Key
Takeaways

24. Save the Date 2018
October 1-4, 2018
▶ 8,750+ Splunk Enthusiasts
▶ 300+ Sessions
▶ 100+ Customer Speakers
Plus Splunk University:
▶ Three Days: September 29-October 1, 2018
▶ Get Splunk Certified for FREE!
▶ Get CPE credits for CISSP, CAP, SSCP
Walt Disney World Swan and Dolphin Resort in Orlando
conf .splunk.com
SAVE THE DATE!

25. © 2018 SPLUNK INC.
Thank You!
https://www.surveymonkey.com/r/SLParis2018