(upbeat music) >> Narrator: Live from Orlando, Florida. It's theCUBE, covering .conf 18 brought to you by Splunk >> Welcome back to Orlando, everybody. This is Dave Vellante with Stu Miniman You're watching theCUBE, the leader in live tech coverage. We go out to events, we extract the signal from the noise. This is day two of Splunk's big user conference #Splunkconf18 Winding down, Stu. Been quite an amazing two days just said Doug Paradon had tons of customers, a lot of security talk today. Luke Bampton is here, another security expert, he's the application security specialists with SecurePay, >> Hi guys >> from Australia. Hi, how ya doing, mate? >> Good, not bad, can you tell that I'm from Australia, or not so much from the accent? >> That rack of beer you got down there gives it away. >> Haha, yeah (laughing) >> Australians like beer or so they say. But they don't drink Fosters so I hear. >> No, no, no such thing, actually, it's yeah, >> That's great marketing to dumb Americans. >> Yeah, a very common misconception though, so kudos to you for picking it up. >> Well, we were talking about the Melbourne Cup, but we'll get back to that later. But lets talk about SecurePay. >> Luke: Sure >> What do you guys do and what's your role there? >> Yeah so, we're an online payment gateway, so we help businesses trade online facilitating e-commerce, so we're actually owned by Australia Post so, Australia's premiere mail network. So that gives us kind of a unique competitive advantage being able to sell both parceled delivery and payments facilitation all in one service to our customers. Um, makes it really compelling offering to customers have an all in one kind of one-stop shop for all their e-commence needs. >> What's your role and what are the big drivers from the business or the operations that are effecting that role? >> So my role is an Application Security Specialist, so I look after a lot of the PCI, DSS constraints, so payment card industry, data security standard. I do a lot of stuff around vulnerability management, card reviews, penetration testing, web application, firewall administration, I work very heavily with our SOC guys work very heavily with our network, security team, platform application, you name it, we do it pretty much. >> So-- >> Yeah, yeah I mean security obviously for a payment company is pretty important, maybe you can talk about you know, what was changing in the industry, how does that impact your job? >> Yeah, so financial tech or fin tech has kind of boomed in Australia. If not the world in the last like five ten years, so there are a lot of new companies, and so therefore, it's driving a lot of innovation. So big players even like SecurePay are even feeling that, feeling that desire to work faster, more agile, and be more competitive in market, and that means a lot of change, a lot of fast paced change, especially when you're dealing with industry regulation such as calculating surcharges on the flyer, making sure the people aren't skimming off the top of what is just what it's supposed to be at cost covering exercise. For our merchants, so competing with legislative changes competing with industry changes, best practice, and if payments stopped then your entire ecosystem stops, and the economy stops. >> Yeah, so, I see hear application security, and I'm a networking guy by background so I start thinking level four through say, layer four through seven. Bring us inside a little bit. What your team does and kind of solutions you're using, I would expect Splunk's, piece of it, what's the stack and security layer look like? >> Yeah, sure, so from a security viewpoint, SecurePay being a subsidiary and being a payment card provider kind of has to be stand alone, so we can't leverage, we have to manage a lot of stuff in-house, I should say. Um, so what that means is basically you have to think of it as condensing your entire organization into a team of like five, six, seven. And really making the most of your products that you've got available to you. So that means really making the most of technologies out of the firewall space, out of the application security space, code scanning, basically everything that you'd expect a full blown enterprise to do, only with a much smaller team, much smaller budget, which means you've got a lot of competing priorities all the time. >> So when you say, in house, I'm inferring that means a lot on PREM as well or not sure? >> Yeah so at the moment, we are prominently on PREM, in terms of our infrastructure, we are moving to more of a hybrid cloud, particularly with non production environmentS. But, with that said, everything's got to be to be in line with all of the network controls, all of the application controls, segmentation all the rest of it is required under PCI. As far as individual tooling is concerned, we work very heavily with Splunk in terms of the event correlation, event management, alerting. Our risk guys use it to fraud profile, and risk profile both our merchants and our customers. And really like just keep an eye on what's going on in the overall enrollments payment ecosystem. Not only for our customers, but also for customers in the overall payment scene, because we hold relationships with other significant players, we can give them a head's up of what's going on. So any market trends, intelligence, like sharing, makes it a really good place to be. >> How long have you been a Splunk customer? >> So we've been a Splunk customer about 18 months now. >> Okay great. So relatively recent? >> Yeah. >> Tell us about life, what was the catalyst to bring Splunk in? What was life like before and the after? >> Yeah, so, the catalyst for bringing Splunk in was really the contract negotiation with our parent company in Australian Post. So we've moved away from our previous tooling and moved to Splunk. I'll be honest, there wasn't a huge adoption 'cause there was so much going on at that point in time, but about twelve months ago, we started really investing heavily in optimizing our instance of Splunk cloud, to the point where we're now able to leverage it's functionality in terms of application monitoring, making logs available and searchable. Just make things a lot more visible for even our senior leadership team to come up and see a dashboard on a TV screen on a wall and be like, "Hey, we're doing really well today". Or "hey, what's with that number, do I need," "is there something that I need to know?" The power of visibility when you're talking to leadership teams is just amazing. >> And you couldn't do this before, or you could do it would take a lot more resources? >> Yeah, exactly. You could do it, it's just that it's a lot less visual, and a lot more time intensive to actually pull that out. So where Splunk has really assisted us is in the ease of reporting, and the visibility and speed with which we can deliver the information required. So, with our previous tools, there was an issue with the timeliness of the data, so by the time that we'd actually pulled it out, taken the core insights that we needed it was probably not as accurate, or as up to date as what we like, and being in high paced financial industry time is money. >> So what have you done with that extra time is it just sort of perfecting the dashboards and the reporting and that process, or have you shifted resources to other activities? >> Yeah, so I mean when you're dealing with such a small team, time is key. And really that reporting time got shifted away and back into the hands of more technical on hands, technical uplift. You have more time you know, making sure that your firewall rules are correct, you've got more time making sure that you're applications, and your code reviews are going well, and you're clearing pipelines, and you're looking at training, you're looking for indicators of compromise instead of just kind of sitting there hoping that your current configures okay, but knowing that you could probably give it some more love if you had more time. >> Alright, yup Luke, one of the things we talked to a lot of customers about is that they start with a specific use case for Splunk, but then the business starts asking questions other groups get involved, what's your experience? >> Yeah, no, as our experience in that field is exactly the same, so we brought Splunk onboard purely as a seam for the security team to use. And it got to the point where you had say the sales team approach us and were like, "hey we know that you" "guys are pulling out a lot of metrics about" "our customers and what activities are going on in system," "is there any way we can leverage this" "to say calculate profitability for various accounts" "or you know can we offer bulk discounts?" Or you know, whatever so it kind of starts getting extended to the sales team, and then the customer service guys came aboard and they're like, "Hey, if we had access to this information" "sooner, we could better service our customers." And that offering itself was really powerful because it has a direct impact on our ability to deliver as a service provider. And it just keeps growing, and growing and growing to the point where pretty much every single team uses Splunk in some way, shape, or form, and are getting real value out of it. >> Now, when you say every single team, >> Yeah >> You mean across the company or? >> Yeah, just, across our company, so across SecurePay, so from the infrastructure guys to the network guys to the dev team, to the QA's to the BA's, just yeah. >> What about well, so we heard a lot of announcements today there sort of positioning Splunk for the lines of business the business users, the less technical folks. Do you see that happening in the near to midterm? >> Yeah, so that has. That's going to have a big impact as to where we sit, so on our current experience has been with the internal customers using Splunk who aren't as technical because we are using Splunk Cloud and we've got that shared like service pool from Splunk. Can unfortunately impact the ability of users who do need access to certain things, in a faster manner can be limited sometimes. So the ability to actually give those guys the ability to self serve a little bit bettter, up skill and actually kind of kind of teach them to fish as opposed as to delivering fish. Is really going to be very powerful, and it's just going to be it's going to be something to play to Splunk's credit. >> How large of an installation are you? How do you measure that, is that like, I guess it's gigabytes or terabytes right? >> Yeah, so in terms about our daughter in just I'm not 100% sure. I think we're, the majority of our logging comes out of our firewalls and perimeter stuff, as you'd expect, being a public facing organization so we've always got scans and whatever going on. But, in terms of the rest of our ingest, >> Dave: So small, medium or large? >> Yeah, I'd say we're probably, small or medium, depending on our ingest. So SecurePay for reference is only about 100, 120 people strong. So, we try to keep things as agile as possible and as lightweight as possible and Splunk's kind of there to support that because we can, we know when we're hitting our overhead and what we can do to actually kind of peg that back or wrap it up and where we've got the head room. >> Things you'd like to see Splunk do, what's on their to do list? >> That's a fantastic question, I'd like to, so I'm personally not a Splunk ninja by any means, I'm still very new, so given the fact that we've only had Splunk for about 18 months I would like, there are people here who would Splunk me into the ground. (laughing) >> But, >> That sounds vicious. (laughing) >> But personally what I'd like to see is a lot of that natural language translation stuff coming through that they announced, Can be really, really powerful. Just to empower those guys who haven't got quite like trying to reduce that barrier to entry rather than in nothing else. >> Luke, thanks so much for coming on theCUBE and good luck >> Yeah, no worries. >> with the future. That's it for us too, that's a wrap, I mean your final thoughts, you want to bring it home? >> Yeah, at the crossroads at day to day, it's really amazing to see this, they going to have WAS tomorrow, they got a huge party at Universal, so it's been a great experience for me, I really appreciate ya you know coming and sharing the ride. >> My pleasure. It's all about the data. We're seeing, we've watched the ascendancy of Splunk, Splunk went public with a very little of the cash, forty million dollars in cash, got to the public markets been growing like crazy, we're seeing a massive CAM expansion now into lines of business and new areas like IOT, so we're actually very excited about Splunk. We really appreciate them having us here. Busy month for theCUBE. theCUBE team's packing up. I'll be going to Miami. Stu will be going to Miami. You guys will be going to Miami. You guys are going back to California. We'll see you next week. Check out the Cube.net it will show you where theCUBE is for all the shows, checkout siliconangle.com for all the news. Some big news today, so look for that in the big data space Hortonworks and Cloudera merging evidently, just just came across the wire, wow. Hatfields and the McCoys. And, check out wikibottom.org sorry wikibottom.com for all the research. Thanks for watching everybody, This is theCUBE, we're out from Splunk .conf 2018 We'll see you next time. (upbeat music)

>> Announcer: Live from Orlando, Florida, it's theCUBE, covering .conf 18. Brought to you by Splunk. >> Hello everybody. Welcome back to Splunk's .conf 18, #splunkconf18. You're watching theCUBE, the leader in live tech coverage. My name is Dave Vellante. He's Stu Miniman, @stu, @dvellante. Tweet us with any questions you might have. Larry Shatzer is here. He's an Operational Intelligence Engineer at Myriad Genetics and he's joined by Amarbir Dhindsa who's an Analyst in SalesOps, also at Myriad Genetics. Gentlemen, welcome to theCUBE. Good to see you again. >> Thanks for having us. >> Thanks for having us. >> Myriad Genetics, tell us about the company. What do you guys do? >> So we test people to know if they have a tendency to develop, maybe breast cancer, ovarian cancer. We have a series of questions that people like to ask of like, will I get cancer, do I have cancer, what should I treat it with, and how should I treat it? And so we try to answer those questions over different diseases and cancer being the most prevalent one. >> And Operational Intelligence Engineer, what does that entail? >> So I'm part of the group of developers that maintain the labs and I work in the Business Intelligence group and then my primary focus is the lab and the operation. So I work with the different process engineers and clinical scientists to help maintain their, the different ask days that they perform and make sure that the robots are working at peak performance and if we could predict where problems might be. >> And Amarbir, you used to be in operational intelligence, right now you're in the sales side in the line of business, is that right? >> Yes, yeah, yeah. I get to mix both worlds and look at some lab metrics and see what kind of effect they're having on business indicators like turnaround time. So if there's something weird going on in the lab, we want to see what it's effecting in terms of the turnaround time that we might be getting customers back their sample in time, or if it's taking longer than competitors, or if it's taking a little bit longer than the norm. >> Now, in the old days of business intelligence, you had maybe a guy, maybe a couple of folks, maybe a team of people, but they were the experts, and you'd go there and you'd beg them to build theCUBE. And then you'd wait. And then by the time you got the data, often times things had changed. You got a nice report but sometimes it just wasn't worth it. You probably remember that world. >> Yes. >> How is that dynamic changed? >> Users are more demanding. There's a lot of more users that are more savvy when it comes to technology. A lot of our users were used to doing things in Excel that I was surprised that they even knew what a VLOOKUP was. And stuff like that. And their level of quality that they expect from you is higher but they also know their data more than you know it. There's only so much data I can understand, you know. We've got all kinds of parts of the domain knowledge that's needed to perform different parts of the process. You know, coming from the chemistry stuff to sales, to HR, to finance, all that stuff, you lose focus, and you go from one project to another and it's hard, so now it's a better world where the users come to you also with solutions in hand. Sometimes that's bad, but sometimes it's good. >> Well, but so the tooling has to change to accommodate that right? >> Larry: Yes. >> So presumably that's where Splunk fits in but how has the tooling evolved? And I'm really interested in learning how you've become this, sort of, power user within sales presumably. >> Yeah and I can attest to both worlds. So before I moved into sales, I used to monitor quality and labs manually. So everyday I'd come in and a good hour, two hour would be spent characterizing each platform, each re-agent, each user, and now it's just one click away. So you can get a verdict on quality daily, really quick and you can make changes really quick, rather than something infiltrating the system, having its effect and going out, you can catch it way early. And my days have gotten a lot more productive, right. Instead of copying and pasting from a remote query, now that query runs in the background and populates everything. >> So where does Splunk fit in all this? How do you use it? >> So we started with Splunk with the traditional use case of we've got a web service that we've deployed, we want to bring in the logs and analyze them, and then we were in a meeting with some business users and we happened to show them Splunk and one of the users was like, I want that. We've got logs coming off of our robots in the lab that when users click this button that they shouldn't click that we can't change 'cause it's from a vendor, we want to know when that happens, because there's a potential for something bad happening down stream. So we want to catch that early. And we've got these Perl scripts that are ugly, hard to maintain, can we look at Splunk? And so we were like, okay we'll start looking at your logs. It's more data, I'm a data nerd. I like looking at random weird data. So we started bringing it in and then it just exploded from there. >> It's actually been the catalyst for change right. Splunk has been the catalyst for change, where we've gone from manual oversight to having an automated oversight. Not just in the lab end but also in the front end of where samples are coming from, where volumes might be decreasing. Is there a special market where there's a downtrend that we want to be conscious of, not at every weekday of reporting in a row. We want to be conscious of that everyday. It's hard to find that manually and Splunk is the catalyst that's given us real time information on key performance indicators that we can act on. >> One of the things I'm wondering if you can comment on is how much are you the one that everyone goes to? You're the center of knowledge, all the data lives there, and how much does this tooling enable you to allow the business team, the sales team, to be able to self-service? You've given them a dashboard and they don't need to come to you. >> It's been a long journey and getting to that point I hold weekly user sessions with different users to sort of help enable them, hold their hands. At the early on, it was, this is how you do a search, this is what alert is, this is what a dashboard is and now it's more about what are the problems you're having and then showing them different dashboards that use different techniques that I'm like, this is for this user, but you can apply some of the same techniques and then they'll just copy, paste, and change it for their use case. And it's just been fantastic to enable them. Since our group is small, there's me and another guy, who's here, wandering around right now. Our mantra is teach them to fish. You know, they know their data better than we know it. We prefer to be more like a consultant with them to say we know the math, we know the techniques, you know the data, let's just put our minds together, then usually will come out with a great product at the end. >> So one of the things we were talking about was how Splunk is different than some of the other disruptive technologies and you're able to do things that you really couldn't do before. Like you can't teach lines of business users how to maintain Perl scripts. It's just not going to happen right. And so now maybe in SecOps we heard that some of the sim tools were competitive and Splunk was disruptive 'cause it was easy to use but it seems like, as Amarbir was saying, this is a catalyst for change because it's new, it's different, it's enabling you to do things that you really couldn't do before. Is that an accurate characterization? >> I think that is. The other aspect, at least for us, is that some of our business units were so data starved, because they just didn't have access to the data. Armabir's old boss, when he worked in the lab, said if you don't have answers to your questions, it's your own fault for not asking for help. Now he's like, now with Splunk in the mix, we've gained insight to some of our products that we've had running for like 13 years with no visibility into it and now we've got this visibility and they're discovering new and interesting metrics that they want to look at and make decisions off of. >> Yeah I'm wondering, we've heard from a number of customers where they've got really what we'd called those hero stats out there, you know, we heard one company up on stage this morning was like, oh saving $60,000 a month in fraud. I'm curious as you report to the business, what success to your team? >> Well we've been able to identify turnaround time changes really quickly. We've reduced it by an appreciable amount when problems come in. That's the cool thing about Splunk. You can actually catch things before they infiltrate your system. Now you were talking about it might be a little bit harder to get users to be comfortable with the search processing language but one of the keynotes, somebody was saying that if you know about 20 commands in Splunk, and you're comfortable, three users sessions that Larry runs, you can explore your data a little bit more and you can become a steward of your data, that will help you catch influxes of problems way before they become prevalent. >> So you're saying they can do some basic SPL in there, it's not just okay, we've got a gooey in a dashboard for ya. >> I think with a little bit of help they can right. Especially with the documentation and the videos that Splunk provides, users can be self proficient to some degree. >> Where are you today with Splunk? I mean how do you measure the size of your Splunk installation? Is it capacity ingested? Or number of indexers? How do you guys look at that? >> We're a small license. We'd only ingest about 20 gigs. Or that's what our license is. And we do about half of that, so we make that license count. We are also very pragmatic, starting off with, what do we want to ingest first? What's the highest value logs that we can get in that we could, with a little bit of effort, get the most reward out of? And then it's just been growing. And also as our company's bot and a few other companies as we've made some acquisitions, some of them are like, we want some of that as well. Some of them run the same platforms we do in their lab, both labs, so we can take what we've learned there and apply it at other places as well. >> How long you been a Splunk customer? >> Larry: Five years. >> So it's been a while though. Okay so you're likely going to stay more focused but it was interesting, 'cause Amarbir you go from an operations intelligence role into a sales role, that's sort of, an indication, that this platform is permeating throughout the business but will that continue or you pretty much confined to where you are and you're getting the value out of what you have today? >> There's new users asking us questions all the time. In fact, just yesterday got an email from a user in a different lab that we haven't been focusing on, saying hey, in fact it was Amarbir that was talking to him, saying you should send an email to Larry and his boss and ask about getting some more visibility in your lab, you know, their small little lab that runs, you know, they're not the big product that we offer but they've got data needs. Just because you don't impact the top line like other parts of the business, doesn't mean you can't have data problems and data needs yourself so. >> I think once people see the answers that Splunk can provide in their realm. So for a given lab, if Splunk can answer your questions and you're immediate needs in a quick fashion, then you become enamored and want more, as to what Splunk can provide. And it's done that across a variety of departments in our company and more departments, I think, will hop on board when they become more familiar with what Splunk can do and how fast it can do it. >> And you're in the sales organization correct? >> Right I migrated over into the sales organization and over there, we're really concerned with what the effectiveness of our sales call is, right. So now we can, kind of, the world is the possibility with Splunk. If we have data, now we can explore it. In that past, the exploration wasn't as user friendly and I know user friendly is one of those things that people don't associate with the SPL, kind of based platform, but I think once users see what this can do, they're a big fan of it. >> I mean I ask because you're not marching to the tune of a centralized analytics group. The sales folks can say, hey I need this, help me. And on a moment's notice. And so you're a resource that's dedicated for them. How do you like that world? >> It's a little bit of a change but it's data rich, so I kind of love it. And all of a sudden, we can model things. I'm just going to give you a quick example. We can model a territory that overtime has changed from being a poor performer to being a good performer. Now we can try and get indicators that have changed overtime and we can monitor them and maybe propose changes to area managers that can emulate that process. So that's just one use case where data will drive decisions and possibly can give more insight to decision makers. >> All right guys we got to leave it there. Thanks so much for coming to theCUBE. Always appreciate the customer insights and congratulations on your great work. >> Thank you. >> Thank you very much. Thanks for having us. >> You're welcome. All right, keep it right there everybody. Stu and I will be back with our next guest. We're live, day two from .conf 18. You're watching theCUBE.

(energetic music) >> Live from Orlando, Florida, it's theCUBE covering .conf 18, brought to you by Splunk. >> We're back in Orlando, Splunk .conf 2018, I'm Dave Vellante, Stu Miniman, and this is theCUBE, the leader in live tech coverage. Doug Merritt is here, the CEO of Splunk, long time CUBE guest, great to see you again. >> Thank you, Dave, great to be here. >> So, loved the keynote yesterday and today. You guys have a lot of fun, I was laughing my you-know-what off at the auditions. They basically said, Doug wasn't a shoo in for the keynote, so they had these outtake auditions. They were really hilarious, you guys are a lot of fun. You got the great T-shirts, how do you feel? >> It's been a, my favorite time of year is .conf, both because there's usually so much that we're funneling to our customers at this time, but being here is just infectious, it's, and one of the things that always amazes me is it's almost impossible to tell who are the customers and who are the employees. That just, I think Devonia this morning said it's a family affair, and it's not just a family affair, it's that there's a shared passion, a shared, almost culture and value set, and there's, it just is a very inspiring and naturally flowing type of event and I know I'm biased because I'm the CEO of Splunk, but I don't, I just don't know of events that feel like our, like .conf does. There's a lot of great shows out there, but this has got a very unique feel to it. >> Well, we do a lot of shows, as you know, and I've always said, .conf, I think ServiceNow, does a great job obviously, re-invent the tableau shows. That energy is there, and the other thing is, we do, when we go to these shows, a lot of times, you'll look at the keynotes and say, are there any products being announced? You guys, that wasn't a problem here. You guys announced this -- >> Not this year. >> Bevy of products, I mean, it's clear the R and D is translating into stuff that people can consume, and obviously that you can sell, so that's huge. >> I'm really excited about the product roadmap right now, and it's, that was, when I got the job, almost three years ago, one of the key areas I leaned forward and the board was excited about it was, what, where or how are we going to take this product beyond the amazing index and search technology that we have? And this show, it takes a while to progress the roadmap to the point that you can get the type of volume that we have here, but this show was the first time that I felt that we had laid enough of the tracks, so you could see a much, much broader landscape of capabilities, and now it's a challenge of packaging and making sure our customers are successful with it, with the product that we just have, the products we've announced. >> Cloud caught a lot of companies and a lot of end user companies, flatfooted. You guys have embraced the cloud, not only with the AWS partnership, which we're going to talk about, but also the business model. You're successfully transitioning from a company with perpetual license model, to a ratable model, which is never easy. Wall Street is killing companies who try to do that. Why have you been successful doing that? You know, give us an update. >> Yeah, so five years ago, less than 20% of our contracts were, had any type of subscription orientation to it, whether it's a multi-year term or a cloud. We'd just launched our cloud four years ago. And we moved from there to we had told the street there would be 65% term in subscription by the end of this year and updated guidance at the end of the second quarter, which is just a month and change ago, that we've already hit the 75% mark that we were set in for next year, so it's been a pretty rapid progression and I think there're two elements that have helped us with that. One: cloud continues to catch fire and so the people's orientation on "Do I do something in the cloud?" four years ago they were much more nervous, so less nervous today. But data is growing at such a huge rate and people are still wrapping their heads around, "How do I take advantage of this data, how do I even begin to collect this data and then how do I take advantage of it?" And the elasticity that comes in the cloud and that comes with term contracts, we can flex out and flex back in, I think it's just a much more natural contracting motion than you bought this big, perpetual thing and pay maintenance on it, especially when someone is growing as fast as data is growing. >> Well and it requires you to communicate differently to the financial analysts. >> It does. >> Obviously, billings, you know, was an important metric. You've come up with some new metrics to help people understand the real health of the business. And one of the other metrics that strikes me, and you see this with some of the successful companies, I actually think Aneel Bhusri was sort of the modern version of this, is the number of seven figure deals. You're startin' to hit that, and it's not, the way he's phrased it was pretty good. It's not something you're trying to engineer, it's the outcome -- >> Yes. >> of having great, loyal customers, it's not something you try to micromanage. >> Right, and that's, just recently we dropped six figure deals, which, when I joined, you got this wonderful dynamic forecasting system that sits on top of sales for us, and so as head of sales, where I started, you're really paying attention to deals. I'd go down to a hundred thousand dollar deals that would track throughout the quarter. And now it's hard to get it down to the six figures 'cause we've got a big enough envelope of seven figure deals. So the business has changed pretty dramatically from where it was, but it is an outgrowth of our number one customer priority, which is, or number one corporate priority, which is customer success. 'Cause that investment by companies, when you get to a million dollars plus, in most cases that's a million annually, you better believe in and trust that vendor, 'cause that's no longer an easy, small departmental sale. You're usually at the CIO, CFO type level. So it's something that we're very honored by, that people trust us enough to get that footprint of Splunk to be that size and to feel like they're getting a value from Splunk to justify that purchase. >> Alright we'll get off the income statement, Stu, and you can read about all that stuff, and we're going to get into, we've got a lot of ground to cover with you, Doug. Jump in here, Stu. >> Yeah, so Doug, I've really enjoyed talking to some of your customers that, you know, most of them started on premises with you and now many of them, they're using Splunk cloud, it's really kind of a hybrid model, and it's been really interesting to watch the maturation of your partnership with Amazon, and being the leader in the cloud space. Give us a little bit of color as to what you're hearing from the customers, you said three, four years ago, you know, they were obviously a little bit more cautious around it, and bring us inside a little bit that partnership. >> Sure, so the first piece that, as part of Splunk, that I think is a little bit different than other vendors is because we are both a lower level infrastructural technology, right, data is, the way I frame what we do is there's these raw materials, which are all these different renditions of data around, and companies increasingly have to figure out how to gather together these different raw materials, put them together different ways, for the output that is driving their business. And we are the manufacturing parts provider that makes it easy for them to go and pick up any of these different compounds and then actually do what they want to do, which is make things happen with data. And that middle layer is really important and we have never taken a super strong stance either, we started on prem, but as we moved to cloud, we never took a strong stance saying everything should be in the cloud or everything should be on prem because data has gravity, there is physics to data. And it doesn't always make sense to move data around and it doesn't always make sense to keep data stagnant, so having that flexibility, being able to deploy your collection capability, whether it's ours or third party, your storage capability, and then your process and your search, what are you going to do with the data, anywhere that makes sense for a customer, I think, is important. And that's part of that hybrid story, is as people increasingly trust and interview us and other cloud vendors to build core apps and then house a lot of their data, we absolutely need to be there. And I think that momentum of the cloud is certainly as secure and, in many cases, more secure than my on prem footprint, and the velocity of invention that some like ABDS is driving allows me to be much more agile and effectively drive application development and leading edge capability, I think just has people continuing to trust the cloud service providers a little bit more. >> Yeah well, we're here in the pavilion, and seeing your ecosystem grow, we've been at re:Invent for about five years, that ecosystem is just so >> It's been amazing. >> massive and full, give us a little bit about the relationship with Amazon and how you look at that, how Amazon looks at a company like yours. >> Yeah, it's been, so one, whenever you're playing with a highly inventive and hugely successful company like Amazon, my orientation and what I convey back to the company is our job is to be more inventive, more agile, and continue to find value with our maniacal focus every day being the data landscape. Data is a service and outcomes is a service, so our job is run faster than Amazon. And I think that this show and our announcements help illustrate that our invention cycle is in high tilt gear and for what we do, we are leaning in in a really aggressive way to add that value. With that backdrop, Andy and I formed this partnership four years ago. He felt there's enough value in Splunk and we were a good enough partner and the way we consume their services that he would commission and quota their sales reps whenever a Splunk sale was done in the ADBS landscape, which I think has been really helpful for us, but we obviously are a huge customer of ADBS's and they become an increasingly large customer of ours and finally gave us approval with their three year renewal a quarter ago to publicly reference them as a sizeable customer for us. >> Oh, okay, congratulations on that. And something I've really, it's really crystallized for me: so many administrators out there, you look at their jobs, you know, what are they? It's like okay, I'm the security expert, I'm the network certified person. You're really, your users here, you know, they are the beacons of knowledge, they are the center of data, is really what they are. You know, Splunk's a tool, they're super excited about the product, but it's data at the center of what Splunk does and therefore, you're helping them in just such a critical aspect of what is happening in the industry today. >> Yeah, the key aspects of the keynote, of my keynote, were we are moving to a world where data is the product that people care about so the whole object is how do you make things happen with data and the people that can get that done increasingly are becoming the most valuable players on the field, so what infrastructure, what tooling, what capability exists that allows people from all departments, you know, we're very heavy within IT and security, but increasingly HR departments, finance departments, marketing departments, sales departments, manufacturing departments will not be successful without a really competent group of folks that understand how to make things happen with data and our job is to lower that bar so you don't have to go to Carnegie Mellon for four years and get a Masters in Computer Science and Data Science to be able to be that most valuable person on the field. >> I want to take a moment, I want to explain why I'm so bullish on Splunk. We had a conversation with Susan St. Ledger yesterday. Digital transformation is all about data. >> Yup. >> And you guys are all about data, there's the cliche which is "data is the new oil" and we've observed, well not really. I could put oil in my car, I can put oil in my house, I can't put it in both places, but data? I can use that same data in a lot of different use cases and that's exactly what you guys are doing now as you expand into line of business -- >> Yup. >> With Splunk Next. >> Yup. >> So you've announced that, you showed some cool demos today. I'd like you to talk about how you're going from your core peeps, the IT ops guys and the sec ops guys, and how, what your plan is to go to lines of business. More than just putting the data out there, you've come up with some new products that make it simpler, like business work flows, but what else are you doing from a go to market standpoint and a partnership standpoint, how do you see that playing out? >> Yeah, I think that the innovation on product, there are three key pillars that we're focusing on. Access data, any type of data, anywhere it lives. Make sure that we're driving actionable outcomes with that data, and acquisitions like Phantom and VictorOps have been a key pillar of that, but there's other things we're doing. And then, expand the capability of finding those outcomes to a much broader audience by lowering the bar. So the three key themes across the portfolio. But all of those are in service of the developers at a customer site, the developers in the ecosystem, to make it easier for them to actually craft a set of solutions that help a retailer, help a discrete manufacturer, help a hospital actually make things happen with data. 'Cause you could certainly start with a platform and build something specific for yourself but it's much easier if you start with a solution. And a lot of the emphasis we've been putting over the past two to three years is how do we up that platform game. And the many, many, 20 different product announcements that we rolled at this .conf and one of them that I'm also very excited about is our developer cloud where we've really enhanced the API layer that interacts with the different services that the entire Splunk portfolio represents. Not just the search and index pieces that people are familiar with but everything from orchestration to role based access to different types of visualization so a very broad API layer that's a well-mannered, restful set of APIs that allows third parties to much more crisply develop, excuse me, applications to compliment the 1800 apps that are already part of our Splunk base and right behind me is a developer pavilion where we've got the first hand full of early adopter OEM partners that are building their first sets of apps on top of that API framework. >> Dozens of them, it's actually worth walking around to see. Now, so that developer cloud is a lever, those developers are a lever for you to get into lines of business and build those relationships through the software, really, and through the apps. Same thing for IOT. >> Yup. >> Industrial IOT. Now, we've observed, and a lot of the IT companies that we see are trying to take a top down approach into IOT and we don't think it's going to work. It's, we talk about process engineers, it's operations technology people, they speak a different language. It's not going to be a top down, here, IT. >> A very different audience. >> It's going to be a bottoms up set of standards coming from the OT world. The brilliance of what you guys have, it's the data, you know, it's data coming off machines, data, you don't care. And so, you're in a good position to do a bottoms up in IOT and we heard some of that today. Now, there are some challenges. A lot of that data is still analog, okay, you can't really control that. A lot of the devices aren't instrumented, they're not connected, you can't control that. But once they become instrumented and connected and that analog data gets digitized, you're in a really good position, but then you got to build out the ecosystem as well. >> Yup. >> So talk about how you're addressing some of those challenges in industrial IOT. >> Yup, man, it's a great subject 'cause I think that the trying to rely on standards is the wrong approach. The velocity across this digital landscape is so high and my view over the past 30 years, I think it's only accelerated now, is there's going to be more and more varieties of data with different formats than there's ever been, and we've seen it in the past five years. Just look at the variety of services on top of AWS, which didn't even exist ten years ago, but and they now have hundreds of services and there is no organizing principle across those services as far as data definition. So it's a very chaotic data landscape and I don't think there's any way to manage it other than to embrace the chaos and work a little bit more bottoms up, you know, grab this data, don't worry about cleansing it, don't worry about structuring it, just make sure you have access to it and then make sure that you've got tools like Splunk that allow you to play with the data and try and find the patterns and the value inside of that data, which is where I think we're very uniquely suited as a technology set. Helping the ecosystem come to that realization is a key aspect of what we're doing. We're trying to attack it the same way we attacked the IT security piece which is pick a handful of verticals and really focus on the players, both the marquis anchor tenants, the BMWs, the Siemens', the Deutsche Bahn railroads of the world, as customers. And through that, get access to the key influencers and consultants and advisors to those industries and start to get that virtuous circle of "I actually have more data than I think I have." Even though there's some analog machines, there's so many different ways to attach to the signal that those machines are emitting and it may not be bi-directionally addressable, but at least you can see what's happening within those machines without a full manufacturing floor rip and replace. And everyone is excited about doing that. The advisors to the industry are excited, the industry themselves are excited. We had BMW on stage who walked through how they're using Splunk to help on everything from product design all the way through to predictive maintenance and feedback on the quality of the cars that they're rolling out. We've all heard stories that there's more lines of code in the Ford F150 and these other vehicles than there is within Facebook right now, so we all are dealing with rolling and sitting in building's and house's data centers. How do you make sure that you're able to pay attention what's happened within that data center? So I think that that is as big or bigger of an opportunity than what we've done with IT and security, it just has its own pace of understanding and adoption. >> Carnival Cruise Line, another one, Stu. We had those guys on today and they basically look, they have a lot of industrial equipment on those ships, so they're excited. >> Yeah, absolutely. Alright, so Doug, we started the beginning talking about the last couple years, how we measure Splunk has changed. Going to more subscription models, talk about how many customers you have. I look at developers, I look at IOT, whole different set of metrics. So if you look at Splunk Next, how do we measure you, going forward? What is success for your team and your customers going forward? >> Yeah, and the whole orientation around Splunk Next, as I'm sure Susan covered, it's not a product, it's a messaging framework. People are so used to Splunk being all about the collection of data within the index and searching in said index, and we're increasingly moving, we're complementing the index, the index is a incredibly unique piece of IP for us. But there's a lot of other modalities that can complement what that index does and Splunk Next represents all of our investments in next generation technologies that are helping in with everything from stream processing to distributed compute capability, next generation visualizations, et cetera. The metric that I care about over time is customer adoption and customer success. How many use cases are being deployed at different customers? How many companies, both customers and partners, are incorporating Splunk in what they do every day? You're getting OEM Splunk, making Splunk a backbone of their overall health and success. And ultimately that needs to translate into revenue, so revenue and bookings will always be a metric that we care about, but I think the leading indicators within theses different markets of rate of adoption of technology and, more importantly, the outcomes that they're driving as they adopt this technology, are going to be increasingly important. >> Yeah, I just have to tell you, when you talk about your customers not only excited, but it's a deeper partnership when you talk to insurance company out of Toronto that, like, they're talking to the people that they insure about, should they be using Splunk and how do they do that. It just, a much deeper, and you know, deeper than a partnership model for your customers. >> It's one of the things I love about this conference, is it's, we were talking about earlier, it's hard to tell the customers from the employees, like, there's a, there's a, this whole belief and purpose that everybody shares, which I adore about being here. But when you look at a sea of data, we've thought traditionally looked at the data we manufacture, typically data that's historic and at rest from our ERP systems. This next wave is certainly all the data that's happening within our organizations but increasingly it's all the data that's available in the world at large. And whether it's insurance or automotive or oil and gas, the services that I'm going to have to deliver to customers require me to farm data outside of my walls, data inside my walls, combine those two, to come up with unique value added services for my customers. So it's great to hear that, that our customers are on that journey 'cause that's where we all need to go to be successful. >> And there's a definitely alignment there. Doug, I know you're super busy, we got to go. Thanks so much for coming on theCUBE. Give you the last word, .conf 18 takeaways. >> (laughs) Unbelievable excitement and enthusiasm. A huge array of products that, I think, broaden the aperture of what Splunk does so dramatically that people are really trying to digest, "What should, how should I be thinking about Splunk moving forward?" And I'm, we started a whole series of transformations three years ago, and I'm really excited that they're all starting to land and I can't wait for the slow realization of the impact that our customers are counting on us to provide and that we'll increasingly be known for across the data landscape. >> Well and the landscape is messy and, as you said, the messiest part of that landscape is the data landscape. You guys are helping organize that, curate it. And hopefully we're helping curate some of the, from some of the noise and distracting to the signal to you on theCUBE. Doug, thanks so much for coming on theCUBE, great to see you again. >> Thank you Dave, thank you Stu, you guys do a great job. >> Thanks, we appreciate that. >> Thanks for being here with us. >> Alright, keep it right there, buddy. We'll be back with our next guest from .conf 18 from Orlando, we'll be right back. (digital music)

>> Live from Orlando, Florida, it's theCUBE, covering .conf 18. Brought to you by Splunk. >> We're back in Orlando, everybody, at Splunk .conf18, #splunkconf18. I'm Dave Vellante with my co-host Stu Miniman. You're watch theCUBE, the leader in live tech coverage. We like to go out to the events. We want to extract the signal from the noise. We've been documenting the ascendancy of Splunk for the last seven years, how Splunk really starts in IT operations and security, and now we hear today Splunk has aspirations to go into the line of business, but speaking of security, Gary Mikula is here. He's a senior director of cyber and information security at FINRA, and he's joined by Siddharta "Sid" Dadana, who's the director of information security engineering at FINRA. Gentlemen, welcome back to theCUBE, Gary, and Sid, first-timer, welcome on theCUBE. So, I want to start with FINRA. Why don't you explain, I mean, I think many people know what FINRA is, but explain what you guys do and, sort of, the importance of your mission. >> Sure, it's our main aspiration is to protect investors, and we do that in two ways. We actually monitor the brokers and dealers that do trades for people, but more importantly, and what precipitated our move to the Cloud was the enormous amount of data that we have to pull in daily. Every transaction on almost every US stock market has to be surveilled to ensure that people are acting properly, and we do that at the petabyte scale, and doing that with your own hardware became untenable, and so the ability to have elastic processing in the Cloud became very attractive. >> How much data are we talking about here? Is there any way you can, sort of, quantify that for us, or give us a mental picture? >> Yeah, so the example I use is, if you took every transaction that Visa has on a normal day, every Facebook like, every Facebook update, and if you took every Twitter tweet, you added them altogether, you multiplied it by 20, you would still not reach our peak on our peak day. >> (laughs) Hence, Splunk. And we'll talk about that but, Sid, what's your role, you got to architect all this stuff, the data pipeline, what do you... >> So, my role is basically to work with the webs teams, application teams to basically integrate security in the processes, how they roll out applications, how they look at data, how they use the same data that security uses for them to be able to leverage it for the webs and all the performances. >> So, your mission is to make sure security's not an afterthought, it's not a bolt-on, it's a fundamental part of the development process, so it's not thrown over the fence, "Hey, secure this application." It's built in, is that right? >> Yes. >> Okay. Gary, I wonder if you could talk about how security has changed over the last several years. You hear a lot that, well, all the spending historically has been on keeping the bad guys out the perimeter. As the perimeter disappears, things change, and the emphasis changes. Certainly, data is a bigger factor, analytics have come into play. From your perspective, what is the big change or the big changes in security? >> So, it's an interesting question. So I've been through several paradigm changes, and I don't think anyone has been as big as the move the Cloud, and... The Cloud offers so much opportunity from a cost perspective, from a processing perspective, but it also brings with it certain security concerns. And we're able to use tools like Splunk to be able to do surveillance on our AWS environments in order to give us the confidence to be able to use those services up there. And so, we now are actually looking at how we're going to secure individual AWS services before we use them, rather than looking to bring stovepipe solutions in, we're looking to leverage our AWS relationship to be able to leverage what they've built out of the box. >> Yeah, people oftentimes, Stu, talk about Cloud security like it's some binary thing. "Oh, I don't want to go the Cloud, because Cloud is dangerous" or "Cloud security is better". It's not that simple, is it? I mean, maybe the infrastructure. In fact, we heard the CIA, Stu and I were in D.C. in December, we heard the CIO of the CIA say, "The Cloud, its worse day is better than my client's server from a security perspective." But he's really talking about the infrastructure. There's so much more to security, right? >> Absolutely, and, so I agree that the Cloud gives the opportunity to be better than you are on PRAM. I think the way FINRA's rolled out, we've shown that we are more secure in the Cloud than we have been on traditional data centers, and it's because of our ability to actually monitor our whole AWS environment. Everything is API-based. We know exactly what everybody's doing. There's no shadow IT anymore, and those are all big positives. >> Yeah, I'm wondering how you've, what KPIs you look at when you look at your Splunk environment. What we hear from Splunk, you know, it's scalability, cost, performance, and then that management, the monitoring of the environment. How are they doing? How does that make your job easier? >> So, I think we still look at the same KPIs that Splunk advertises all the time, but some of the reasons, from our perspective, we kind of look at it in terms of, how much value can we give it to not just one part of the company, but how can we make it much more enhanceable part for everyone in the organization. So, the more we do that, I think that makes it a much better ROI for any organization to use a product like this one. >> You guys talk about the "shift left" movement. What is "shift left" and what is the relevance to security? >> Yeah so, "shift left" is a concept where, instead of looking at security as a bolt-on, or an add-on, or a separate entity, we're looking to leverage what are traditional DevOp tools, what are traditional SDLC pipeline roles, and we're looking at how we integrate security into that, and we use Splunk to be able to integrate collection of data into our CDCI pipelines, and it's all hands-off. So, somebody hits a button to deploy a new VPC and AWS, automatically things are monitored and into our enterprise search, I'm sorry, enterprise security SIM, and automatically being monitored. There's no hands-on that needs to be done. >> So, on a scale of one to five, thinking of a maturity model in terms of, in a DevOps context, five being, you know, the gold standard and one being you're just getting started. Where would you put FINRA on that spectrum, I mean, just subjectively? >> So, I'll never say that we're a five because I think there's always, >> You're never done. >> You're never done and there's always room for improvement, but I think we're at least a strong four. We've embraced those concepts, and we've put them into action. >> And so, I thought so, and I want to ask you from a skill standpoint how you got there. So, you've been around a long time. You had a Dev team and an Ops team before the term DevOps even came around, right? And we talk about this a lot, Stu. What did you do with the Ops guys and the Dev guys? Is it OpsDev or DevOps? Did you retrain them? Did you fire them all and hire new people? How did you go through that transition? >> Yep, that's a fair thing. I went to my CISO John Brady a couple of years ago and I told him that we were going to need to get these new skill sets in, and that I thought I had the right person in Sid to be able to head that up, and we brought in some new talent, but we also retrained the existing talent because these were really bright people, and they still had the security skills. And what Sid's been able to do is to embrace that and create a working relationship with the traditional DevOps teams so that we can integrate into their tools. >> So, it does include a little bit work even on our end to do where you kind of learn how the DevOps forces work, so you've got to do it on your own to first figure out things and then you can actually relate to the problems which they will go through and then you work through problems with them, rather than you designing up a solution and then just say, "Hey, go and implement it out." So, I think that kind of relationship has helped us and in the long run, we hope to do a bit better work. >> Yes, Sid, can you bring us in a little bit, when you look at your Splunk deployment, FINRA'S got a lot of applications, how do you get all those various applications in there? You know, Splunk talks about, you can get access to your data your way, do you find that to be the reality? >> Yes, to a certain extent, so... Let's take a step back here. So our design is much more hybrid-oriented. So, we use Splunk Cloud, but that's primarily for our indexers whereas we host our own sort of class receptor. All the data basically goes in from servers from AWS components, from on-prem, basically it flows into our Splunk Cloud indexers, and we use a role-based access management to actually give everyone access to whatever data they need to be looking at. >> Alright. The number of enhancements from 702, updates, the Cloud, Gar-Gar, is there anything that's jumped out that's going to architecturally help your team? >> So, I think one of the interesting things is the new data pipeline, and to be able to actually mangle that data before I get it into my Splunk indexers is going to be really really life-changing for us. One of the hard parts is that developers write code and they don't necessarily create logs that are event-driven. They don't have date-time stamps, they do dumps. So, I'm going to be able to actually massage that before it hits the indexers, and it's going to speed up our ability to be able to provide quick searches because the indexers won't be working on mangling that data. >> And how big of a deal is it for you? They announced yesterday the ability to scale storage and compute separately in a more granular fashion, is that a big deal for you? >> So, I actually, I remember speaking to Doug Merritt probably three years ago. >> You started this! (laughing) >> And I said, "Doug", I said, "I really think that's the direction that you need to go. You're going to have to separate those two, eventually, because we're doing a petabyte scale, we realized very early that that'd need to be done. And so, it's really really refreshing to see, because it's going to be transformative to be able to do compute-on-demand after that. Because now we can start looking at API brokers, and we can start looking at containers, and all those other things can be integrated into Splunk. >> Love having customers on like you guys, so knowledgeable. I have to ask, switch gears a little bit, I want to ask you about your security regime. We had a customer on yesterday, and it was the CISO who reported to him. He was the EVP, and he reported to the CIO. A lot of organizations say, "You know what? We want the CISO to be separate from the CIO. Cause it's like the, you know, the fox in the henhouse kind of thing. And we want that a little bit of tension in there." How do you guys approach it? What's the regime you have for... >> That is a fair question, and I've heard that from many other CISOs that have that same sort of complaint. And I think it's really organization-based. And I think, do you have the checks and balances in place? First of all, our CIO, Steve Randich, is extremely, he cares a lot about security, and he is very good at getting funding for us for initiatives to help secure the environment. But more importantly, our board of directors bring up security at every board event. They care about it, they know about it, and that permeates through the organization. So there's a checks and balances to make sure that we have the right security in place. And it's a working relationship, not adversarial at all, so, having our CISO John Brady report to Steve Randich, the CIO, has not been a hindrance. >> And I think that's a change in the last several years, because that regime that I described, which was, there was sort of a wave there, where that became common, and I think you just hit on it. When security became a board-level issue, and for every Fortune 1000, Global 2000 company, it's a board-level issue. They talk about it every board meeting. When that occurred, I think there was an epiphany of, "We need the CIO to actually be on this." And you want the CIO to be responsible for that. And the change was, it used to be, "Hey, if I fail, I get fired." And I think boards now realize that "failure" in security doesn't mean you got breached. >> Sure. >> You know. Breaches are going to happen. It's how you respond to them and, you know, how you react to them that is becoming more important. So there's much more transparency around security in our view. I wonder if you agree with that. >> I think there's transparency. And the other thing is is that you have to put the decision-making where it makes the most sense. Most of the security breaches that we're talking about are highly technical in nature, where a CIO is better able to evaluate some of those decisions, not all companies have a CEO that came from a technology train in order to be able to make those decisions. So, I think it makes more sense to have the CISO report to somebody in the technology world. >> Great, thank you for that. Now, the other question I have for you is, in terms of FINRA's experience with Splunk, did it start with SecOps and security, or was it, sort of, IT operations, or...? >> It did, it started with security. We were disenfranchised with traditional SIMs that were out there, and we decided to go with Splunk, and we made the decision that security was going to own it, but we wanted it to be a corporate asset from day one. And we worked our tails off to integrate, through brown bags, through training. So we permeated through the organization. And, on any given week, we pull about 35-40% of all of technology is using Splunk at FINRA. >> So, I'm curious as to, we heard some announcements today, I don't know if you saw them, about, you know, Splunk Next, building on that, Splunk for the line of business, the business flow, they did a nice demo there. Do you see, because security sort of was the starting point, and your mission was always to permeate the organization, do you see that continuing to other parts of the organization more aggressively now given this sort of democratization of data for the business lines, and... Will you guys be a part of that, directly? >> We hope so. We hope we are part of that change, too. I mean, the more we can use the same data for even business users that will help them, that would relieve a lot of, and they made this point again and again in the keynote, too, that, the It Ops and SecOps are already burdened enough. So, how do we make life easy for business users who actually leverage the same data? So we hope to be able to put these tools up and see if it can make any difference to business users. >> So, you guys have put a lot of emphasis on integrating with Splunk and AWS Cloud. You have a presentation later on today at .conf18 around the AWS Firehose that you have with Splunk. What's that all about? What's the AWS Firehose? How are you integrating it? Why is it important? >> So, it is streaming and it allows me to get information from AWS that's typically in something called the CloudWatch Logs, that is really difficult to be able to talk to. And I want to get it into the Splunk so I can get more value from it. And what I'm able to do is put something called a subscription filter on it, and flow that data directly into Splunk. So, Splunk worked with AWS to create this integration between the two tools, and we think we've taken it to a high level. We use it for Lambda, to grab those logs, we use it for VPC Flow Logs, we're using it for SaaS Providers, provide APIs into their data, we use it for that, and finally, we're going to be doing database activity monitoring, all leveraging this same technology. >> Love it, I mean, you guys are on the forefront of Cloud and Splunk integration, Cloud adoption, DevOps, you guys have always been great about sharing your knowledge, you know, with others, and we really appreciate you guys coming on theCUBE. Thank you. >> Thanks for having us. >> You're welcome. Alright, keep it right there, everybody. Stu and I will be back. You're watching theCUBE from .conf18, Splunk's big user conference. We'll be right back. (electronic music)

live from Orlando Florida it's the cube coverage conf 18 got to you by spunk welcome back to Splunk kampf 18 hashtag Splunk conf 18 you watching the cube the leader in live tech coverage we go out to the events we extract the signal from the noise I'm Dave Volante with my co-host Stu many men we love to talk to the customers too we've had seven out of ten of our interviews today have been with the customers Tony Alessandra was here as the chief architect at the co-operators group limited insurance company up in Canada leader in that field Tony thanks so much for coming on the yeah it's great to be here thanks for having me so we were talking off-camera about some of the innovation that's going on in Toronto and want to get to that innovation is actually in your long title yeah there's the time but tell us about your role as chief architect and then some of the other areas that you touch yes certainly so my primary role at the co-operators group is to serve as chief architect for the group of companies and so it's a fancy term to mean that I influence how we invest in technology and process for our strategy and for our operational imperatives I also have responsibility for information security within our organization so I have a great team led by a C so at the co-operators group and essentially our role is to to protect the data of our clients right we have a million unique clients across Canada that entrust us with a lot of personal and confidential data we have thousands of financial advisers throughout the company and so we have retail outlets throughout the entire geography of Canada and essentially we collect a lot of data and and with respect to policies for commercial businesses for private clients for subscribers etc and I also manage an innovation portfolio for the organization and so it's actually I'll work with our business stakeholders within the organization to figure out how we could accelerate new businesses accelerate new capabilities with the use of technology who's excited that's a big big big role that you have if I want to send the the regime you have for security say the seaso reports to you yes sir and there's a set CIO there right there is yeah so I report to the to the executive vice president and CIO of the co-operators group of companies and and my responsibility within the organization is to report back to our CIO on all the responsibilities that I talked to you about okay so this the C so technically reports up through the CIO and C so reports up through me into the CIO yeah which is that's a whole other interesting discussion maybe if we have time we could talk about that absolutely um so a lot of data I mean we think about insurance company regulated you got your claim systems which are critical you have your agent systems which are also critical different types of data both data on customers but when you talk about the data that you guys collect where's it come from what are you trying to do with with that data yes so so you know I'll start I'll start with the motive right the problem that we're trying to solve and so I'll say first and foremost we're an insurance company we offer assurance and protection to our clients right and so in the process of offering assurance and protection to our clients you know they entrust us with massive amounts of data like you know as we as we mentioned before but we'll also need to set a good example because a lot of the assurance some of the assurance that we offer to our clients is also cyber protection we offer cyber insurance to our clients we need to set a good example we need to demonstrate resilience right Splunk is a primary tool in our Arsenal where we're showing our clients that we have good resilience to be able to detect and respond to security threats when they happen that's part of our mandate right so our responsibility with respect to using Splunk is to collect data from all of our major systems within our organization we use Blonk to monitor we use Blanc to detect and we also use Splunk to respond when something is going on what is this is really interesting you're being proactive about from your you know from an actuarial standpoint you rate your risk you're being very proactive when many if not most insurance companies would do is say ok what what's the history yeah and are there any high-profile breaches and yeah as opposed to what you're doing like sounds like you're really inspecting what the policies and the procedures and the technology of your clients is I think you hit on an important point right and so the important point is that you know the the the art of actuarial science is to rely on a lot of history in the past you know to predict the risks of the future but the reality is that model is falling apart very quickly because there is very little history for cyber threats and the other aspect of it is its inconsistent its evolving and it's changing on a regular basis right and so that's why you use platforms like Splunk use platforms like spunk to detect new threats and to end to in sort of to advance new correlations what should we be concerned about which threats are relevant to us which ones can we ignore and unless you have good platforms to do correlation unless you have good automation you're gonna need a large army of people to chase things that may not be relevant to either you or your clients so Tony your industry usually has quite a bit of M&A as to kind of fund the growth that's going on curious how does Splunk in your data strategy fit into M&A type a quiz yeah yeah and so I think that's one of the biggest potential uses of Splunk for us right and so the way that insurance is evolving right now is insurance companies are all trying to figure out how they get involved in the loss prevention game right in the past it's all been about assurance right it's all been about protection and so when you think about the Internet of Things is one of the biggest untapped opportunities for insurance companies it's all about data right so smart homes smart buildings cars outfitted with telematics so it's every history you wearing wearable devices so in terms of health and you know a health insurance and life insurance protection etc all of this data is meaningful to offer value to clients beyond what we've been able to do in the past one of the things we've looked at I know the industry is looking at is well how do you value that data is that something your company's gotten into yeah absolutely and so you know part of what we need to figure out is how to model that data to give the right level of engagement to the customer so to create that two-way engagement with the customer right how am i doing how am i driving is the weather a threat for me in in the in the foreseeable future in terms of things that I need to protect is there a hailstorm coming you know should I should I you know have alerts and and and you know provide you know ask clients to move some of their valuables indoors I mean all of these are things that will increase that engagement with our clients because face it with insurance your clients engage with you two times a year right two major time policy renewal and if they're unfortunate enough to have a claim right we need to have a but we need to have a better game much more proactive game with them so you're in other ways a risk consultant with your your clients right yeah so describe that so you client comes to you says they're interested or you go to them they're interested in in in in a security you know insurance where does it start do you ask them you have Splunk do you advise them as to what are you going to look at their policies and procedures well how does it work so so I think you know Splunk is one of those valuable assets that enables the capability right insurance you know the game is becoming all about data having massive amounts of data and being able to use that data to help assess the risks for a client properly right because without having good data everything is a great guest these days I mean with climate change with cyber risks evolving with customers preferences changing data is going to be the meaningful difference in terms of understanding what risks a client has what the probability is and how to write a meaningful policy for them where they're engaged and they understand it well enough as well understand it well enough to prevent some of their losses and that's really the issue that we're trying to figure out how do we help clients understand their risks and then prevent losses prevent or minimize losses for them and and what role does Splunk play in that you you know your your your client are you a an advisor or you encourage your customers to use belong counters at all so we're talking about our future roadmap right now and this is what we're trying to figure out what's blanc this is where we see the strategic opportunities with blah right and so when we look at the co-operators the way that co-operators has been using Splunk in the past is for their security sim we were one of the very first large companies in Canada to put our security sim on Splunk we were the very first large company in Canada to put our sim in Splunk clout right and so we we you know we're very proud with being able to work with Splunk for for charting that course right for setting the example our next course is how do we leverage a platform as powerful as Splunk now to give value to our customers we're protecting our customers data assets and now it's about returning valuable insights back to the customers in terms of loss prevention that's our forward-thinking approach in terms of how we stay ahead in terms of leveraging this as a unique asset as a unique capability so your leader you've got street cred you can now extend that to your client base I mean for an insurance company risk you know chaos is just cash as I like to say it's opportunity for you guys and to the extent that you can help clients mitigate that risk to win-win it's essentially for them the reduction in expected loss it can actually hate to say this but could actually pay for the insurance which is let's take attractive it's a massive win and I think you know the other part you know that people need to think differently about is the way that people consume insurance will change dramatically as well in the next tenure so and so where you think now that you know your typical home and auto insurance you will buy an annual policy well the reality is that Home Sharing car sharing ride-sharing insurance will change to what we call episodic oh right and so essentially you'll be consuming insurance for an activity right and the only way that you'll be able to sort of drive that activity in a meaningful way is to have a lot of data on that activity right where are you driving how did you drive you know what what are the risks associated to when you're driving in the geography that you're driving where are you renting out your home what are the rooms to which client and so understanding all of those elements give us the best opportunity at giving you just in time insurance for the right risks surance as a service I love it personalized for me I mean the model generally item as a consumer is broken it's very bespoke my insurance company doesn't know who I am it's just to check a bunch of boxes off and they sent me another form every year and advised some new things and I don't even know what half the time they are that's exactly right right then the and the only way you're able to personalize is to have all of that data on an individual on a company on an event right so we give you insurance for you based on your needs based on your risks Tony we know there's a lot of AI happening up in the Toronto area yeah maybe our audience might not know tell them a little bit about that and how you're thinking about AI and what interest you have and what's Blanc's talking about when they talk about AI yeah you're absolutely right I mean there's a loop there's a massive amount of artificial intelligence activity in the Toronto Kitchener corridor within southern Ontario I would say it's early days for insurance in terms of how we leverage AI I think you know some of the early wins for us have been what we refer to as chat BOTS or virtual assistants right helping clients so this is basically speed and convenience for clients right clients need to know something very quickly very predictive short-tailed answers we're there for customers who choose to do that where it's going next is helping clients assess risk and predict outcomes associated to risks right and so there's a lot of different use cases that we're working there partnerships with startups partnerships with mainstream organizations like Splunk is an important partner for us in this area and of course academic institutions that are investing right this is all part of it for the sales channel for the risk channel for claims processing so imagine being able to submit a claim on a mobile device gathering all that data being able to correlate that data to say we've seen this before right based on the correlation here's your damages we could processes as quickly here's the experts you need to go to here's the restoration facilities that you'll engage those are massive opportunities for client service and for an ability for an insurance company to settle things quickly right we're talking about weather before it's obviously a changing dynamic has a change variable and maybe it's it's model Abel I don't know but but clearly weather incidents are on the rise have caught companies and probably insurance companies you know a little bit off guard you know climate change etc the boiling seas this we've heard yeah what do you guys what's your position on that how do you accommodate that and pass it on to your customers and well I think this is what we're well known for right and so first of all we're not gonna be able to control the weather but what we'd be able to do is prevent it from getting worse right and so when you'll hear the leadership within our organization talk especially our CEO our CEO is very passionate about building resilient communities and that starts with making sure that we're building communities in the right spots not in flood plains not in areas of high risk of forest fires or or other things that you could you know potentially prevent you know within a certain geography and so that's first and foremost right and so we're a leader in this space in Canada how do you become a leader in this area you collect data understand the geography understand the trends associated to the understand the future risks associated to those geographies based on weather trends and then lobby governments builders entrepreneurs everybody land development consortiums to say we need to build communities in better places we need to build more resilient communities and then thereafter it's making sure that you're leveraging data to be able to predict and minimize losses for clients in those areas right and that's what you'll use weather data for right who do I need to alert we have threats on the way what can we prevent how do we minimize these losses for Canadians I think the big risk that we all need to understand if the weather continues to change at the same pace are our you know people will not be able to afford the risks right and so the insurance will rise exponentially and and you know will we we won't have a sustainable model for the future so it's clear for you guys it's really all about the data one of the challenges that a lot of companies in your industry have is the data it's about the data for them to insurance companies you could argue our you know IT companies in many respects they develop products that are put together by technologists but a lot of the data is in silos yeah as Splunk allowed you to break down those silos and and is that yet part while you're a leader well like I could talk about what's where Splunk has been able to to offer us that that that ability is with security right and so we have data we have information security log data associated to our systems and our application everywhere on Prem our partner sites in our agency offices on different endpoint devices in the cloud with our different service providers so what Splunk has been able to do is us to be able to aggregate that data consume that data build valid use cases and to correlate that and raise proper alerts right that's our main priority right now is to build resilience with information security that knowledge will take us to these other areas that we want to do in offering now the value back to our clients right embed that value into our product offerings is our next logical step awesome Tony thanks very much for coming on the cube really appreciate it you're welcome it's good to meet you in the pleasure have the leaves changed in Toronto its Toronto by the way stew no tea it's coming it's coming fast Dave a lot a force to Minutemen thanks for watching we'll be right back after this short break you're watching the cube from Splunk Kampf 18 [Music]

live from Orlando Florida it's the cube covered conf 18 got to you by Splunk welcome back to our land Oh everybody I'm Dave Volante with my co-hosts two minima and you're watching the cube the leader in live tech coverage we're brought here by Splunk toises Splunk off 18 hashtag spunk conf 18 Susan st. Leger is here she's the president of worldwide field operations at Splunk Susan thanks for coming on the cube thanks so much for having me today so you're welcome so we've been reporting actually this is our seventh year we've been watching the evolution of Splunk going from sort of hardcore IT OPSEC ops now really evolving in doing some of the things that when everybody talked about big data back in the day and spunk really didn't they talked about doing all these things that actually they're using Splunk for now so it's really interesting to see that this has been a big tailwind for you guys but anyway big week for you guys how do you feel I feel incredible we had you know we've it announced more innovations today just today then we have probably in the last three years combined we have another big set of innovations to announce tomorrow and you know just as an indicator of that I think you heard Tim today our CTO say on stage we to date have 282 patents and we are one of the world leaders in terms of the number of patents that we have and we have 500 pending right so if you think about 282 since the inception of the company and 500 pending it's a pretty exciting time for spunk people talk about that flywheel we were talking stew and I were talking earlier about some of the financial metrics and you know you have a lot of a large deal seven-figure deals which which you guys pointed out on your call let's see that's the outcome of having happy customers it's not like you turn to engineer that you just serving customers and that's what what they do I talk about how Splunk next is really bringing you into new areas yeah so spike next is so exciting there's really three three major pillars if you will design principles to spunk next one is to help our customers access data wherever it lives another one is to get actionable outcomes from the data and the third one is to allow unleash the power spunk to more users so there really the three pillars and if you think about maybe how we got there we have all of these people within IT and security that are the experts on Splunk the swing ninjas ful and their being they see the power of spunk and how it can help all these other departments and so they're being pulled in to help those other departments and they're basically saying Splunk help us help our business partners make it easier to get there to help them unleash the power spunk for them so they don't necessarily need us for all of their needs and so that's really what's what next is all about it's about making it again access data easier actionable outcomes and then more users and so we're really excited about it so talk about those new users I mean obviously the ITA ops they're your peeps so are they sort of advocating to you into the line of business or are you probably being dragged into the line of business what's that dynamic like yeah it's definitely we're customer success first and we're listening to our customers and they're asking us to take them that should go there with them right there being pulled that they know that what we what we say with our customers what are what our deepest customers understand about us is everybody needs funk it's just not everyone knows it yet and I said they're teaching their business why they need it and so it's really a powerful thing and so we're partnering with them to say how do we help them create business applications more which you'll see tomorrow in our announcements to help their business users you know one of the things that strikes us if we were talking it was the DevOps gentleman when you look at the companies that are successful with so-called digital transformation they have data at the core and they have sort of I guess I don't want to say a single data model but it's not a data model of stovepipes and that's what he described and essentially if I understand the power of Splunk just in talking to some of your customers it's really that singular data model that everybody can collaborate on with get advice from each other across the organization so not this sort of stovepipe model it seems like a fundamental linchpin of digital transformation even though you guys haven't been using that overusing that term thank you sort of a sign of smug you didn't use the big data term when big data was all hot now you use it same thing with digital transformation you're a fundamental it would seem to me to a lot of companies digital transformation that's exactly if you think about we started nineteen security but the reason for that is they were the first ones to truly do digital transformation right those are just the two the two organizations that started but exactly the way that they did it now all the other business units are trying to do it and that same exact platform that same exact platform that we use there's no reason we can't use it for those other areas those other functions but but if we want to go there faster we have to make it easier to use spunk and that's what you're seeing with spunk next you know I look at my career the last couple of decades we've been talking about oh well there's going to we're gonna leverage data and there's go where we want to be predictive on the models but that the latest wave of kind of AI ml and deep learning what I heard what you're talking about and in the Splunk next maybe you could talk a little bit about why it's real now and why we're actually going to be able to do more with our data to be able to extract the value out of it and really enable businesses sure so I think machine learning is that is at the heart of it and you know we we actually do two things from a machine learning perspective number one is within each of our market groups so IT security IT operations we have data scientists that work to build models within our applications so we build our own models and then we're hugely transparent with our customers about what those models are so they can tweak them if they like but we pre build those so that they have them in each of those applications so that's number one and and that's part of the actionable outcomes right ml helps drive actionable outcomes so much faster the second aspect is the ML TK right which is we give the our customers in ml TK so they can you know build their own algorithms and leverage everything all of the models that are out there as well so I think that two-fold approach really helps us accelerate the insights that we give to our customers Susan how are you evolving your go-to-market model as you think about Splunk next and just think about more line of business interactions so what are you doing on the go-to-market side yeah so the go to market when you think about reaching all of those other verticals if you will right it's very much going to be about the ecosystem all right so it's it's going to be about the solution provider ecosystem about the ISV ecosystem about the big the si is both boutique and the global s is to help us really Drive Splunk into all the verticals and meet their needs and so that will be one of the big things that you see we will obviously still have our horizontal focus across IT and security but we are really understanding what are the use cases within financial services what are the use cases within healthcare that can be repeated thousands of times and if you saw some of the announcements today in particular the data stream processor which allows you to act on data in motion with millisecond response that now puts you as close to real-time as anything we've ever seen in the data landscape and that's going to open up just a series of use cases that nobody ever thought of using spoil for so I wonder what you're hearing from customers when they talk about how do they manage that that pace of change out there I really like I walked around the show floor stuff I've been hearing lots people talking about you know containers and we had one of the your customers talking about how kubernetes fits into what they're doing seems like it really is a sweet spot for spunk that you can deal with all of these different types of information and it makes it even more important for customers to come to you yeah as you heard from Doug today in our keynote our CEO and the keynote it is a messy world right and part of the message just because it's a digital explosion and it's not going to get any slower it's just going to continue to get faster and I know you met with some of our customers earlier today and if'n carnival if you think about the landscape of NIF right I mean their mission is to protect the arsenal of nuclear weapons for the country right to make them more efficient to make them safer and if you think about all of it they not only have traditional IT operations and security they have to worry about but they have this landscape of lasers and all these sensors everywhere and that and when you look at that that's the messy data landscape and I think that's where Splunk is so uniquely positioned because of our approach you can operate on data in motion or at rest and because there is no structuring upfront I would I want to come back to what you said about real-time because that you know I oh I've said this now for a couple years but never used to use the term when Big Data was at its the peak of what does a gardener call it the hype cycle you guys didn't use that term and and so when you think about the use cases and in the Big Data world you've been hearing about real time forever now you're talking about it enterprise data warehouse you know cheaper EDW is fraud detection better analytics for the line of business obviously security and IT ops these are some of the use cases that we used to hear about in Big Data you're doing like all these now and sort of your platform can be used in all of these sort of traditional Big Data use cases am i understanding that problem 100% understanding it properly you know Splunk has again really evolved and if you think about again some of the announcements today think about date of fabric search right rather than saying you have to put everything into one instance or everything into one place right we're saying we will let you operate across your entire landscape and do your searches at scale and you know spunk was already the fastest at searching across your global enterprise to start with and when we were two to three times faster than anybody who compete it with us and now we improve that today by fourteen hundred percent I don't I don't even know where like you just look at again it ties back to the innovations and what's being done in our developer community within our engineering and team in those traditional use cases that I talked about in big data it was it was kind of an open source mess really complex zookeeper is the big joke right and always you know hive and pig and you know HBase and blah blah blah and we're practitioners of a lot of that stuff that's it's very complex essentially you've got a platform that now can be used the same platform that you're using in your traditional base that you're bringing to the line of business correct okay right it's the same exact platform we are definitely putting the power of Splunk in in the users hand so by doing things like mobile use on mobile and AR today and again I wish I could talk about what's coming tomorrow but let's just say our business users are going to be pretty blown away by what they're going to see tomorrow in our announcements yeah so I mean I'm presuming these are these are modern it's modern software micro services API base so if I want to bring in those open source tool tools I can in fact what you'll actually see when you understand more about the architecture is we're actually leveraging a lot of open-source and what we do so you know capabilities a spark and flink and but what we're doing is we're masking the complex the complexity of those from the user so instead of you having to do your own spark environment your own flink environment and you know having to figure out Kafka on your own and how you subscribe to what we're giving you all that we're we're masking all that for you and giving you the power of leveraging those tools so this becomes increasingly important my opinion especially as you start bringing in things like AI and machine learning and deep learning because that's going to be adopted both within a platform like use as yours but outside as well so you have to be able to bring in innovations from others but at the same time to simplify it and reduce that complexity you've got to infuse AI into your own platform and that's exactly what you're doing it's exactly what we're doing it's in our platform it's in our applications and then we provide the toolkit the SDK if you will so users can take it to another level all right so you've got 16,000 customers today if I understand the vision of SPARC next you're looking to get an order of magnitude more customers that you of it as addressable market talk to us about the changes that need to happen in the field is it just you're hitting an inflection point you've got those you know evangelists out there and I you know I see the capes and the fezzes all over the show so how is your field get ready to reach that broader audience yeah I think that's a great question again once again it will I'll tell you what we're doing internally but it's also about the ecosystem right in order to go broader it has to be about this this Splunk ecosystem and on the technology side we're opening the aperture right it's micro services it's ap eyes it's cloud there's there's so much available for that ecosystem and then from a go-to-market perspective it's really about understanding where the use cases are that can be repeated thousands of times right that the the the big problems that each of those verticals are trying to solve as opposed to the one corner use case that you know you could you could solve for one customer and that was actually one of the things we found is when we did analysis we used to do case studies on Big Data number one use case that always came back was custom because nothing was repeatable and that's how we were seeing you know a little bit more industry specific issues I was at soft ignite last week and you know Microsoft is going deep on verticals to get specific as to you know for IOT and AI how they can get specific in those environments I agreed I think again one of the things that so unique about Splunk platform is because it is the same platform that's at the underlying aspect that serves all of those use cases we have the ability in my opinion to do it in a way that's far less custom than anybody else and so we've seen the ecosystem evolve as well again six seven years ago it was kind of a tiny technology ecosystem and last year in DC we saw it really starting to expand now you walk around here you see you know some big booths from some of the SI partners that's critical because that's global scale deep deep industry expertise but also board level relationships absolutely that's another part of the the go-to markets Splunk becomes more strategic this is a massive Tam expansion that where we are potentially that we're witnessing with Splunk how do you see those conversations changing are you personally involved in more of those boardroom discussions definitely personally involved in your spot on to say that that's what's happening and I think a perfect example is you talk to Carnival today right we didn't typically have a lot of CEOs at the Splunk conference right now we have CEOs coming to the spunk conference right because it is at that level of strategic to our customers and so when you think about Carnival and yes they're using it for the traditional IT ops and security use cases but they're also using it for their customer experience and who would ever think you know ten years ago or even five years ago of Splunk as a customer experience platform but really what's at the heart of customer experience it's data so speaking of the CEO of Carnival Arnold Donald it's kind of an interesting name and and so he he stood up in the States today talking about diversity doubling down on diversity as an african-american you know you frankly in our industry you don't see a lot of african-americans CEOs you don't see a ton of women CEOs you don't see the son of women with with president in their title so he he made a really kind of interesting statement where he said something to the effect of forty years ago when I started in the business I didn't work with a lot of people like me and I thought that was a very powerful statement and he also said essentially look at if we're diverse we're gonna beat you every time your thoughts as an executive and in tech and a woman in tech so first of all i 100% agree with him and i can actually go back to my start i was a computer scientist at NSA so i didn't see a lot of people who looked like me and so from that perspective I know exactly where he's coming from and I am I'll tell you at Splunk we have a huge investment in diversity and not because it's a checkbox but because we believe in exactly what he says it's a competitive edge when you get people who think differently because you came from a different background because you're a different ethnicity because you were educated differently whatever it is whether it's gender whether it's ethnicity whether it's just a different approach to thinking all differentiation puts a different lens and and that way you don't get stove you don't have stovepipe thinking and I what I love about our culture at spunk is that we we call it a high growth mindset and if you're not intellectually curious and you don't want to think beyond the boundaries then it's probably not a good fit for you and a big part of that is having a diverse environment we do a lot of spunk to drive that we actually posted our gender diversity statistics last year because we believe if you don't measure it you're never going to improve it and it was a big step right to say we want to publish it we want to hold herself accountable and we've done a really nice job of moving it a little over 1% in one year which for our population is pretty big but we're doing really unique things like we have all job descriptions are now analyzed there's actually a scientific analysis that can be done to make sure that the job description does not bias whether men are women whether men alone or whether it's you know gender neutral so that that's exciting obviously we have a big women in technology program and we have a high potential focus on our top women as well what's interesting about your story Susan and we spent a lot of time on the cube talking about diversity generally in women in tech specifically we support a lot of WI t and we always talk him frequently we're talking about women and engineering roles or computer science roles and how they they oftentimes even when they graduate with that degree they don't come into tech and what strikes me about your path is your technical and yet now you've become this business executive so and I would imagine that having that background that technical background only helped in terms of especially in this industry so there are paths beyond just the technical role one hundred percent it first of all it's a huge advantage I believe it's the core reason why I am where I am today because I have the technical aptitude and while I enjoyed the business side of it as much and I love the sales side and the marketing side and all of the above the truth of the matter is at my core I think it's that intellectual curiosity that came out of my technical background that kept me going and really made me very I took risks right and if you look at my career it's much more of a jungle gym than a ladder and the way you know I always give advice to young people who generally it's young women who ask but oh sometimes it's the young men as well which is like how did you get to where you are how do I plan that how do I get and the truth of the matter is you can't if you try and plan it it's probably not going to work out the exactly the way you plan and so my advice is to make sure that you every time you're going to make a move your ask yourself what am I going to learn Who am I going to learn from and what is it going to add to my experience that I can materially you know say is going to help me on a path to where I ultimately want to be but I think if you try and figure it out and plan a perfect ladder I also think that when you try and do a ladder you don't have what I call pivots which is looking at things from different lenses right so me having been on the engineering side on the sales side on the services side of things it gives me a different lens and understanding the entire experience of our customers as well as the internals of an organization and I think that people who pivot generally are people who are intellectually curious and have intellectual capacity to learn new things and that's what I look for when I hire people I love that you took a nonlinear progression to the path that you're in now and it's speaking of you know the the technical I think if you're in this business you better like tech or what are you doing in this business but the more you understand technology the more you can connect the dots between how technology is impacting business and then how it can be applied in new ways so well congratulations on your careers you got a long way to go and thanks so much for coming on the queue so much David I really appreciate it thank you okay keep it right - everybody stew and I'll be back with our next guest we're live from Splunk Don Capcom 18 you're watching the cube [Music]

live from Orlando Florida it's the cube coverage conf 18 got to you by Splunk hey welcome back to Splunk kampf 18 conf 8 hashtag Splunk conf 18 my name is Dave Volante I'm here with my co-host a minimun you watching the cube the leader and live tech coverage there's two days of wall-to-wall coverage is our seventh year stew at conf we're seeing the evolution of Splunk from kind of analyzing log files to having deep business impact across the organization and doing more with data Jim Nichols is here is the DevOps manager in Improv odda healthcare company good to see it thanks for coming to the cube again thank you for having me thank you so tell us about M privada and then love the the title DevOps in the title we'll get into that sure first the company yep so in providers the healthcare IT security company and we provide health court healthcare organizations around the world with secure Identity Management multi-factor authentication and enable just ubiquitous access to whatever sort of medical systems that they need to get into and we really try to enable healthcare by establishing trust between the medical providers the patient's the data and do that all securely and seamlessly so that we're not Security's not a part of their workflow it's just in there and they don't have to think about it and they just get access to what they need when they need it so I hear yeah on your website trust between people technology and information reminds me a little bit of a certain software company that branding is all around us today that is there seems like there's a line up between what Splunk does in your company's mission oh they're there absolutely is and you know like Splunk in privada has a very strong on premises in the data center footprint and we're expanding that into the cloud and that's where most of my work is is kind of managing those cloud systems that kind of complement the on-premise appliance and we're looking at how that's going to move into the cloud and what that means and it's very similar to like what Splunk is done with Splunk enterprise and now moving into Splunk cloud and we're actually a customer's point cloud everything that we do that we could possibly do is out in the cloud not in the data center in you you've got DevOps two new titles maybe bring us inside you know what that means that improv odda you usually think about you know moving fast things are changing all the time it's themes that we heard in the keynote this morning so explain that a little bit yeah so the way the DevOps model that we follow at improv odd is really like kind of a consultant model where we've got a small team of a very senior very expert DevOps folks and they kind of get assigned out to the agile teams and they're a team member that gets planned into the Sprint's plan and what we're going to be dealing and really kind of make sure that those deployment events or the DevOps work that we need to do is planned in as part of the normal development work and that consultancy model is really good in regards to Splunk because we run the Splunk infrastructure we do all the training we do some of the basic dashboard work and make sure that no matter what the team products onshore offshore wherever they are we're all looking at data exactly the same way exact same dashboards and it really kind of forces the knowledge to get shared throughout the organization across products and how we think about things and so Splunk you know DevOps isn't like a tool or a thing or whatever but Splunk is definitely a great like enabling forcing function to make sure that we are sharing metrics how the system works what we're learning on and all that stuff in a really consistent way so you know the t-shirt met tricks I've seen that I have what do you think that means oh so it's like the same old same old man metrics so huh what does that mean to you guys you have new metrics do you have a sort of new set of KPIs that you're using ourselves so I think the metrics part is that it's maybe 10 years ago the IT industry figured out how to get every single metric about CPU memory disk ram and all the tool there are a lot of different tools for doing it you know Splunk zabbix data dog others I don't know if it's okay to talk about other products or whatever but you know when you get like a CPU alert that goes off all right the CPU usage is 92% is that good or is that bad it sounds kind of high and you get that alert you look at that CPU chart and it's like there's no context there's no information and you know you might be designing your system to run at 90% if it's doing some batch processing or something so it's like metrics it's like you need to get the alert you need to know what's going on but you really need to like get the insight into what it is and that's why a lot of this stuff that they show this morning at the keynote was really exciting where you've got the metrics in one place the logs in one place it's all in one place so you get that alert and you can look at it and then see what else is going on without having to like jump into a bunch of different systems and how about DevOps your DevOps in the title what is how do you guys look at DevOps what is DevOps to you and where did it come from and where is it going I think that I've been doing DevOps my entire career since I got out of college and I came out of WPI and was studying like performance evaluation and it's like how do you measure systems get the insight how do you make sure they're running efficiently and I think that what I was kind of doing on the performance engineering side kind of intersected with like the agile movement and folks get into agile development teams and trying to integrate that knowledge and the metrics and how you're gonna run it in production into that sort of product building process so I feel like I've been doing DevOps for a long time and called it different things over the years you know for for us at improv Adi it's really about enabling our developers to deliver functionality to our customers as fast and as safely as possible so you know we're in the healthcare industry and you know the the systems that we build and integrate and support support life right like these are doctors that are using these systems they have to work a hundred percent all the time and that adds some interesting wrinkles where you wouldn't really think about doing continuous deployment for the system that you know somebody's going to get logged into to get into their medical records you might want to be able to move that quickly if you need to if there's an emergency bug fix but the level of safety and testing that we need to put in before it actually gets into production that's really where we spend a lot of our time in DevOps is making sure that that's a fish but that's fast and then when it goes from going from like a test environment into production if it takes an hour for office is not that big of a deal we're doing like you know multi week to week release cycles or even longer and so as far as like DevOps a lot of the movement has been around like continuous delivery and deployment and we kind of use that to optimize like the test build and debug cycle and that way when we know when we get to production that's going to go smoothly and that there aren't going to be any unanticipated how do security fit into this conversation sometimes you know the the buzzword term you know dev sac ops is you know how to how to Splunk in your practice look at security well so you know where a security company you know you know and we wouldn't really ever call anything dev sack offs because security is ingrained in a part of every single thing that we do walking into the building every day when we badge in I think about it our security people like is the building's secure all the way into like what we're ending up doing in the system so obviously Splunk is a huge supporter of that so we've got audit trail information on all the systems and we can know not only what you are system administrators and DevOps users are doing but like what docker is doing what commands it runs and really get at a very very low level of detail and we literally have everything that ever happens on those systems is audited and we've built a whole set of alerts around things that we know about things that we think might be a problem and we use kind of our expertise in the healthcare security space and then apply that to all our cloud systems so it's like we never have a team called dev sack ops it's like it's it's just what we do it's the first most important thing that we think about every day is security so that's why it's a little bit different for us but we like some of the ideas and I've you know we've started doing some work around automated security testing on the application code you know running like static analysis dynamic analysis integrating web scanning tools into our CI CD pipelines so that it just makes it that much easier you know and not wait till the end before you ship it or whatever we have it right in the development process what's the regime for your organization you know the classic development and operations throw it over the fence and okay DevOps brings those together but you still got a spectrum of skills and presumably you've got people on you know some kind of maturity model where you've got sort of newer folks maybe guys coming out of college like you were several years ago and you're training them and sort of you're one unified team at the same time you you might have some degrees of specialization so what have you found is the right regime for the DevOps team well I think the consultant model that we've established works really well and we've got a very senior DevOps person that's on the agile team and they may do some of the really tricky bits but once we get out of the part that only us as DevOps can do we really try to get the developers to do it so a lot of that's like Splunk training how do you build a dashboard here's maybe a simple example dashboard now you do the next panel that sort of thing to try to level everybody up and get everybody on the same page you know turned in terms of this divide between like Devon Ops when I actually joined and provided DevOps was NIT it was managed as part of like our SAS management offering along with like a lot of the other applications that IT managed and one of the very first things that our senior vice-president did was like they get to be in development they can't Oregon is a we were working together we're all on the same teams we're all doing all that stuff but just mentally organizationally get rid of the divide put them in engineering and report to the VP of engineering just like the developers development managers and architects and that's the way we've just get rid of any organizational or thought divide between the between the groups Jim you mention alerts just now and we've heard a few times you get alerts and you know I imagined the beeper in the old days now you get an alert on your mobile phone where are we in terms of being able to take action on those alerts have the machines take action for us is that an objective that you have is that just too damn scary your thoughts yeah so my first my first impression is that it's a little scary we do have some problems that occur with some frequency right so losing an Amazon ec2 instance happens you know 10 times out of 100 instances in the cloud on a given month so there's certain types of those failures that we've automated around just because you have to as a part of just doing business in the cloud so why do the Amazon like auto scaling groups all that stuff we've got a couple of you know issues that happen that we want to just resolve faster and repair faster they don't impact customer experience or user experience but we just want to get on top of those sooner so we've started to automate some of the very thin small carefully controlled controlled use cases so that if the alert were to go up spurious lis I know it's not gonna then take down a system that was running and finding good false positives exactly so only were places where false positives can be tolerated is where we're looking to do that yeah you don't want to take the humans out of the equation just yet or maybe ever for some of the simple things we we have and we can and we will but some of the complicated things it's like just stop and look at it and think about it for 90 seconds and then make the action we're to come up with how to program that 90 seconds of thought is like maybe talk about it be complete about it off oh this way okay let me explain it to somebody a second time and make sure it's right and then go and do a quake like just philosophically that's where I have to get a sheen to do that so Jim you're wearing the revolution a word shirt my understanding in privada is now one of two two-time Award winners if I got it right you're a commander Award winner maybe you could explain what that means and what it means to you and your company sure so the commander award is really about getting you know other folks in your organization using Splunk looking you know either looking at a dashboard at a report or digging down into the data and you know so why I won the award was really around like our use of docker containers so it was really important to me that developers people in DevOps people and support don't really have like a strong like network operations function but those types of folks that they're all looking at the exact same thing all the exact same tools all the exact same data so kind of as part of that mission it's just I hold trainings I hold office hours I've got one of my DevOps folks down here today or at the conference to then kind of spread the Splunk gospel show people how to use it if they've got questions all that sort of stuff and then the other part of that is really just showing people what we can do and advocating for the making decisions based on the data we have it in data you know I have it in spunk let's look at that to make the decision so that's really what that commander Awards kind of all about so if you're doing the doctor stuff you're a bit of a trailblazer so we were only a few years into this container initiative I was walking the show floor I even saw some companies looking at like the serverless technology you know what what led you to kind of put these pieces together and you know it tell us a little bit about kind of the community that you lean on to learn these things yes so the the technology trend around containers was very strong and very fast like with Amazon's especially like that when they came out with their ECS orchestration it was really fast and very strong and really the the technology trend kind of led me into it and then the developers being like we're gonna use docker we're gonna have to figure you're gonna have to figure out how to Splunk it so really from the very beginning I've gone through each and every sort of possible way to get data out of a dr. container in this Splunk and part of that is you know networking with the Splunk folks pretty good relationship with the with the fella that wrote the logging driver that went into the dock or open source project and like looked at the code reviews and all that and then it's really just trying it out trying things out and eventually kind of got to the sweet spot now where I've got the developers are all using local docker compose and that's configured a certain way then when we run in Amazon it's using Amazon ECS where I've also been working on kubernetes for a while and the way that you configure your docker in each of those environments is totally different the code running in the is exactly the same so we've realized that vision but the runtime environment is totally different so kind of where we're at now the config may be totally different on the logging drivers but in the end when you load up Splunk and you look at it and Splunk it's exactly the same whether it's your local laptop and amazon in production staving staging or whatever and I think my kind of favorite part in terms of like the Splunk commander award and getting folks using Splunk is that the way that I have it set it up set up now there is literally no local log file for the developers on their laptop it just doesn't exist it all goes out to Splunk so you can do a lot with grep and text pad and stuff on your local local laptop and I get that but now that they're in Splunk and it's just it's been a great way to get folks on board with what its gonna look like in production I know what it looks like in dev so I can make sure that my logs are good I'm logging enough and not too much and all that stuff so that's really where docker is really software is the same now we've got the logging the same the tools are all the same but then the runtime bits those are a little bit different and that's abstracted away hopefully Jim what does a DevOps guy want from a vendor you got a lot of open source stuff that you're working with you got a lot of different tooling what do you look for in a vendor what's what's the thumbs-up and positives and what what stuff really kind of ticked you off well so you know we're we're a key trusted vendor for a lot of healthcare organizations so I can kind of talk about how I we prison if a customer or a user comes up comes to us with a problem doesn't matter what it is it's our problem and we go through exhaustive lengths to identify where the problem actually is and so that may be in our code that maybe in another vendors code some third party some open source thing doesn't matter we're after the evidence we're after the facts we don't care if it's not in our code we're gonna help our customer be successful and that's what we would want from any vendor right so if we contact them with a support case we've got a problem we don't want any of this uh looks like a firewall problem or something like get to the data get to the facts and if you can prove if the vendor can prove that the problem is somewhere else great but we want a reproducible test case we want this whole finger-pointing thing is like it's horrible inside of an organization in terms of like running operational systems but then when you've got like as your Google Cloud Amazon Cloud Salesforce service now all these things all working together like you can't people just going to own the problem basically and that's what that's what we do right so if the customer comes to us with an issue it's our problem and then we go from there and figure it out and that's really what any vendor that we work with especially like a production operational sort of system that's really what we look for so you look for collaboration and focus on solving the problem not not the finger-pointing you know a virtual single throat to choke if you will yeah exactly hm well thanks very much for joining us on the cube is great to have you yeah thank you thank you very much appreciate I keep right - everybody stew and I'll be back hashtag Splunk conf 18 you're watching the cube right back [Music]

you live from Orlando Florida it's the cube coverage conf 18 got to you by Splunk welcome back to comp 2018 this is the cube the leader in live tech coverage my name is Dave Volante I'm here with my co-host Stu minimun we're gonna start the day we're going to talk to some customers we love that John Morris here is the MIS program director at UConn the Huskies welcome to the cube good to see you and he's joined by Ryan O'Connor who's the senior advisory engineer at Splunk he's got the cool hat on gents welcome to the cube great to have you thank you thank you for having us so kind of a cool setting this morning is the Stu's first conf and I said you know when you see this it's kind of crazy we're all shaking our phones we had the horse race this morning we won so that was kind of orange yeah team are and team orange as well that's great you're on Team Orange so we're in the media section and the median guys were like sitting on their hands but Stu and I were getting into it good job nice and easy so Jon let's start with you start always left to start with the customer perspective maybe you describe your role and we'll get into it sure so as you mentioned I'm the director of our undergrad program Mis management information systems business technology we're in the school of business under the operations and information management department the acronym OPI M okay cool and gesture Ryan tell us about your role explain the Hat absolutely yeah so I'm a member of an honorary member of the Splunk trust now I recently joined Splunk about a month ago back in August and yeah and outside of my full-time job working at Splunk I'm also an adjunct professor at the University of Connecticut and so I helped John in teaching and you know that's that's kind of my role and where our worlds sort of meet so John we were to when I were talking about the sort of evolution of Splunk the company that was just you know okay log file analysis kind of on-prem perpetual license model and it's really evolved and its permanent permeating throughout you know many organizations but maybe you could take us through sort of the early days and it was UConn for a while what what was life like before Splunk what prompted you to start playing around with Splunk and where have you taken it what's your journey look like so about three years ago we started looking at it through kind of an educational lens started to think of how could we tie it into the curriculum we started talking to a lot of the recruiters and companies that many of our students go into saying what skillsets are you looking for and Splunk was definitely one of those so academia takes a while to change the curriculum make that pendulum swing so it was how can we get this into students hands as quickly as possible and also make it applicable so we developed this initiative in our department called OPI M innovate which was all based around bringing emerging technology skills to students outside of the general curriculum we built an innovation space a research lab and really focused in bringing students in classes and incorporating it that way we started kind of slowly different parts of some early classes about three years ago different data analytics predictive analytics courses and then that really built into we did a few workshops with our innovate initiative which Ryan taught and then from there it kind of exploded we started doing projects and our latest one was with the Splunk mobile team okay you guys had some hard news around now well today right yeah maybe take us through that absolutely wanted sure yeah I'll take that so we we teach a course on IOT industrial IOT at the University of Connecticut and so we heard about the mobile projects and you know the basically they were doing a beta of the mobile and application so we we partnered with them this summer and they came in you know we have a Splunk Enterprise license through Splunk for good so we're able to actually ingest Splunk data and so as part of that course we can ingest IOT data and use Splunk mobile to visualize it all right right right maybe you could explain to our audience that might not know spun for good absolutely yeah so spun for good is a great initiative they offer a Splunk pledge license they call it to higher education institutions and research initiatives so we're able to have a 10 gig license for free that we can you know run our own Splunk enterprise we can have students actually get hands-on experience with it and in addition to that they also get free training so they can take Splunk fundamentals one and two and actually come out of school with hands-on experience and certifications when they go into the job market that's John name you know we talk so much about them the important role of data and you know that the tools change a lot you know when we talk about kind of the next generation of jobs you're right at that intersection maybe you can give you know what what are what are the students what are they looking for what are the people that are looking for them hoping that they come out of school with you know yeah it's it's um you have two different types of students I would say those that know what they're looking for and those that don't that I really have the curiosity they want to learn and so we we try to build this initiative around both those that maybe they're afraid of the technology and the skills so how do we bring them in how do we make a very immersive environment kind of have that aha moment quickly so we have a series of services around that we have what's called tech kits the students come in they're able to do something applicable right away and it sparks an interest and then we also kind of developed another path for those that were more interested in doing projects or they had that higher level skill set but we also wanted to cultivate an environment where they could learn more so a lot of it is being able to scaffold the learning environment based off of the different student coming in so it's interesting my son's a junior in college at GW and he's very excited he's playing around with date he says I'm learning are I'm learning Tablo I'm like great what about Splunk and he said what's that yes so yeah then though it's a little off-center from some of the more traditional visualization tools for example so it's it's interesting and impressive that you guys sort of identified that need and actually brought it to two students how did that all how what was in an epiphany or was that demand from the students how'd that come about it was a combination of a lot of things you know we were lucky Ryan and I have known each other for a long time as the director of the program trying to figure out what classes we should bring in how to build out the curriculum and we have our core classes but then we have the liberty to build out special topics things that we think are irrelevant up-and-coming we can try it out once if it's good maybe teach it a few more times maybe it becomes a permanent class and that's kind of where we were able to pull Ryan in and he had been doing consulting for Splunk for a number of years I said I think you know this is our important skill set is it something that you could help bring to the students sure yeah yeah I mean one of the big courses we looked at was a data analytics course and we were already teaching with a separate piece of software not gonna name names but essentially I looked at it one for one like what key benefits does this piece of software have you know what are the students trying to get out of it and then just compared to one for one to Splunk like could Splunk actually give them the same learning components and all that and it could and and with this one for swum for a good license and all that stuff we could give them the hands-on experience and augment our teaching with that free training so and they come out of school they have something tangible they can say you know I have this and so that would kind of snowball once that course worked then we could integrate it into multiple other courses so you were able to essentially replicate the value to the students of the legacy software and but also have a modern platform exactly exactly yep yeah you know that and that was a what was like a Doug was talking about making jokes about MDM and codifying business processes and yeah it's a little bit more of an antiquated piece of software essentially you know and I mean it was nice it did a great job but there wasn't when we were talking to recruiters and stuff it wasn't a piece of software that recruiters were actually looking at so we said we were hearing Splunk over and over again so why not just bring it into the classroom and give them that so in the keynote this morning started to give a vision I believe they call it Splunk next and mobile things like augmented reality are fitting in you know how do you look at things like this what what how's the mobile going to impact you especially I would think yeah so when we kind of came up with our initiative we identified five tracks that both skill sets we believe the students needed and that and companies were kind of looking for a lot of that was our students would go into internships and say hey you know the the set skills that were learning you know they're asking us to do all this other work in AWS and drones and VR so as again it's part of this it was identifying let's start small five tracks so we started with 3d printing virtual reality microcontrollers IOT and then analytics kind of tying that all together so we had already been building an environment to try and incorporate that and when we kind of started working with the spunk mobile team there's all these different components we wanted to not only tie into the class but tied into the larger initiative so the goal of the class is not to just get these students the skills interesting interested in it but to spread that awareness the Augmented part is just kind of another feature was the next piece that we're looking in to build activities and it just had this great synergy of coming in at the right time saying hey look at this sensor that we built and now you can look at data in an AR it's a really powerful thing to most people so yeah they showed that screenshot of AR during the keynote and one of the challenges that we have at the farm so we're teaching that this is the latest course that we're talking about on an industrial IOT one of the challenges we have at that farm is we don't have a desk we don't have a laptop but we do have a phone in our pocket and we have we can put a QR code or NFC tag anywhere inside that facility so we can actually have we have students go around and you know they can put an iPhone upto a sensor or scan a QR code and see actual live real-time data of what those sensors are doing which is it's an invaluable tool inside the classroom and in an environment like that for sure so it's interesting able to do things we never would have been able to do before I want to ask you about come back to mobile yeah as you you just saying it was a something that people have wanted for a long time it took a while yeah presumably it's not trivial to take all this data and present it in a format and mobile that's simple number one and number two is a lot of spunky users are you know they're at the command center right and they're on the grid yep so maybe that worked to your advantage a little bit and that you know you look at how quickly mobile apps become obsolete hmm so is that why it took so long because it was so complicated and you had a user profile that was largely stationary yeah and how is that change yes honestly I'm not sure in the full history of the mobile app I know there previously was a new mobile app and I are there was an old mobile app and this new one though is you use it the new one yes oh so when we're talking about augmented reality that might be we may not been clear on that augmented reality is actually part of its features and then in addition we have the Apple TV app is in our lab we have a dashboard displayed on a monitor so not only can we teach this class and have students setting up sensors and all this but we can live display it for everyone to come in and look at all the time and we know that it's a secure connection to our back-end people walk into the lab and the first thing I see is this live dashboard Splunk data from the Apple TV based off of project we've been working on what's that well that's a live feed from a farm five miles off campus giving us all these data points and it's just a talking point people are like wow how did you do that and you know it kind of goes from there yeah and the farm managers are actively looking at it too so they can see when the doors are open and closed to the facility you know the temperature gets too high all these metrics are actually used by the you know that was the important part to actually solve a business problem for them you know we we built a proof of concept for the class so the students could see it then their students are kind of replicating another final project in the class class is still ongoing but where they have to build out a sensor for for plants to so it's kind of the same type of sensor kit but it's they're more stationary plant systems and then they have to figure out how to take that data put it into Splunk and make sense of it so there's all these different components and you get for the students get the glam factor you can put it in a fishbowl have the Apple TV up there exactly and that's I mean part of it when we when we started to think about in ishutin you know it was recruitment you know how do we get students beyond that fear of technology especially kind of coming into a business school but it really went well beyond that we aligned it with the launch of our analytics minor which was open to anyone so now we're getting students from outside the school a bit liberal arts students creating very diverse teams and even in the class itself we have engineers business psychology student history student that are all looking to understand data and platforms to be able to make decisions so there's essentially one Splunk class today instead of a Splunk 101 there this semester there's there's a couple classes that are actually using Splunk inside the classroom and I mean depends on the semester how many we have going on that are actually there's three the semester I sorry I misspoke there we have a another professor as well who's also utilizing it so so yeah we have three three classes that are essentially relying on Splunk to teach different components or you know is it helped us understand is it part of almost exclusively part of the analytics you know curriculum or is it sort of permeate into other Mis and computer science or right now it's within our kind of Mis purview trying to you know build all their partners within the university and the classes they're not it's not solely on spunk spunk is a component of you the tool so it's like for example the particular industrial IOT course it is understanding microcontrollers understanding aquaponics and sustainability understanding how to look at data clean data and then using Splunk as a tool to help bring that all together yeah it's kind of the backbone you know love it and then and I mean in addition to I just wanted to mention that we've had students already go out into the field which is great and come back and tell us hey we went out to a job and we mentioned that we knew Splunk and we were you know a shoo-in for certain things once it goes up on their LinkedIn profile and start getting yeah I mean I again I would think it's right up there with I mean even even more so I mean everybody says and right and our day it was SPSS now it's our yep tableau obviously for the VIS everybody's kind of playing around but spunk is a very you know specific capability that not everybody has except every IT department on the planet exactly coming out of school you take a little bit deeper you either you find you find that out yeah cool well great work guys really thank you guys coming on the cube it was great to meet you I appreciate it incoming all right you're welcome all right keep it right - everybody stew and I will be right back after this this is day one of cough 18 from Splunk this is the cube [Music]