>> Narrator: Live from Washington D.C. it's theCUBE, covering .conf2017. Brought to you by Splunk. (techno music) >> Well welcome back here on theCUBE as we continue our coverage at .conf2017. Splunks get together here in the nation's capital, Washington D.C. We are live here on theCUBE along with Dave Vellante. I'm John Walls. Glad to have you with us here for two days of coverage. We're joined now by Team Dell EMC I guess you could say. Colin Gallagher, who's the Senior Director of VxRail Product Marketing. Colin, good to see you, sir. >> Likewise. >> And Cory Minton, many time Cuber. Colin, you're a Cuber, as well. Principle Engineer, Data Analytical Leader at Dell EMC, and BigDataBeard.com, right? >> Yes, sir. >> Alright, and just in case, you have a special session going on. They're going to be handing these out a little bit later. So, I'm going to let you know that I'm prepared >> Cory: I love that, that's perfect. >> With you and your many legions of fans, allow me to join the club. >> That's awesome. Well welcome, we're so glad to have you. You've got a big data beard. You don't have to have a beard to talk big data at Dell EMC, but it certainly is not frowned upon if you do. >> John: Alright, well this would be the only way I'd ever grow one. >> There you go. >> I can promise you that. >> Looks good on you. >> I like the color, though, too. Anyway, they'll be handing these out at the special session. That'll be a lot of fun. Fellows, big announcement last week where you've got a marriage of sorts with Splunk technology and what Dell EMC is offering on VxRail. Tell us a little bit about that. Ready Systems is how you're branding this new offer. >> So we announced our Ready Systems for Splunk. These are turnkey offerings of Dell EMC technology pre-certified and pre-validated with Splunk and pre-sized. So we give you the option to buy from us both your Splunk solution and the underlying infrastructure that's been certified and validated in a wide variety of flavors based on top of VxRail, based on top of VxRack, based on top of some of our other storage products, as well, that gives you a full turnkey implementation for Splunk. So as Splunk is moving from the land of the hoodies and the experimenters to more mainstream running the business, these are the solutions that IT professionals can trust from both brands that IT professionals (mumbles). >> So you're both a Splunk reseller and a seller of infrastructure, is that right? >> Indeed. So we actually, we joined Splunk in a partnership as a strategic alliance partner a little over a year ago. And that gave us the opportunity to act as a reseller for Splunk. And we've recently gone through a rationalization of their catalog, so we actually have now an expanded offering. So, customers have more choice with us in terms of the offers that we provide from Splunk. And then part of our alliance relationship is that not only are we a reseller, but because of our relationship they now commit engineering and resources to us to help validate our solutions. So we actually work hand in hand with their partner engineering team to make sure that the solutions that we're designing from an infrastructure perspective at least meet or exceed the hardware requirements that Splunk wants to see their platform run on top of. >> Dave: Okay, cool. So you're a data guy. >> Indeed. >> You've been watching the evolution of things like Hadoop. When I look at the way in which customers deal with Hadoop, you know, ingest, you know, clean or transform, analyze, etc., etc., operationalize, there seem to be a lot of parallels between what goes on in that big data world and then the Splunk world, although Splunk is a package, it seems to be an integrated system. What are the similarities? What are the differences? And, what are the requirements for infrastructure? >> I think that the ecosystems, like you said, it's open source versus a commercial platform with a specific objective. And if you look at Splunk's deployment and their development over the years they've really started going from what was really a Google search for log, as Doug talked about today in the kickoff, to really being a robust analytics platform. So I think there's a lot of parallels in terms of technology. We're still ... It's designed to do many of the same things, which is I need to ingest data into somewhere, I need to make sense of it. So, we index it or do some sort of curation process to where then I can ask questions of it. And whether you choose to go the open source route, which is a very popular route, or you choose to go a commercial platform like Splunk, it really depends on your underlying call it ethos, right? It's that fundamental buy versus build, right? For somebody to achieve some of the business outcomes of like deploying a security event and information management tool like Splunk can do, to do that in open source may require some development, some integration of disparate open source platforms. I think Splunk is really good about focusing specifically on the business outcome that they're trying to drive and speeding their customers' time to value with that specific outcome in mind, whereas I think the open source community, like the Hadoop community, I think it offers maybe some ability to do some things that Splunk maybe wouldn't be interested in, things like rich media analytics, things that aren't good for Splunk indexing. >> Are there unique attributes of a data rich workload that you've accommodated that's maybe different from a traditional enterprise workload, and what are those? >> Yeah, so at the end of the day any application is going to have specific bottlenecks, right? One of the basis of performance engineering is move the bottleneck, right? In enterprise applications we had this evolution of originally they were kind of deployed in a server, and then we saw virtualization and shared storage really come in vogue for a number of years. And that's true in these applications, these data rich applications, as well. I think what we're starting to see is that regardless of what the workload is, whether it's a traditional business application like Oracle, SAP, or Microsoft or it's a data application like Splunk, anytime it becomes critical to the operation of a business organizations have to start to do things that we've done to every enterprise IT app in the past, which is we align it to our strategy. Is it highly available? Is it redundant? Is it built on hardware that we can be confident in that's going to be up and running when we need it? So I think from a performance and an engineering perspective, we treat each workload special, right? So we look at what Splunk requirements are and we understand that their requirements may be slightly different than running SAP or Oracle, and that's why we build the bespoke systems like our Ready System for Splunk specifically, right? It's not a catch all that hey it works for everything. It is a specifically designed platform to run Splunk exceptionally well. >> So Colin, a lot of the data practitioners that I talk to at this show and other data oriented shows like, "Ah, infrastructure. "I don't care about infrastructure." Why should they care about infrastructure? Why does infrastructure matter, and what are the things that they should know? >> Infrastructure does matter. I mean infrastructure, if youre infrastructure isn't there, if your infrastructure isn't highly available, as Cory said, if it lets you down in the middle of something, your business is going to shut down, right? Any user can say, "Talk about what happened "the last time you had a data center event, "and how long were you offline, "and what did that really mean for your business? "What's the cost of downtime for you?" And everything we build at an application level and a software level really rests on an infrastructure foundation, right? Infrastructure is the foundation of your data center and the foundation of your IT, and so infrastructure does matter in the sense that, as Cory said, as you build mission critical platforms on it the infrastructure needs to be highly reliable, highly available, and trusted, and that's what we really focus on bringing. And as applications like Splunk evolve more into that mainstream world, they need to be built on that mission critical, reliable, managed infrastructure, right? It's one thing for infrastructure development, and this kind of happens in the history of IT, as well. It happened in client server back in the day. You know, new applications ... Even the web environment I remember a company was running, one of my clients was running a web server under their secretary's desk, and she was administering in half time. You would never have a large company doing that. >> They'd be back up (mumbles). Before you leave. >> As it becomes more important it becomes more central, but also it becomes more important to centrally manage those, right? I'm a 15 year storage veteran, for good or for worse, and what we really sell in storage is selling centralized management of that storage. That's the value that we bring from centralized infrastructure versus a bunch of servers that are sitting distributed around the environment under someone's desk is that centralized management, the ability to share the resources across them, the ability to take one down while the others keep running, shift that workload over and shift it back. And that's what we can do with our Ready Systems. We can bring that level of shared management, shared performance management, to the Splunk world. >> I'll tell you, one of the things that we talked about, we talked about in a number of sessions this week, is application owners, specifically the folks that are here at this conference, need to understand that when they decide to make changes at the application level, whether they like infrastructure or they think it's valuable or not, what they need to understand is that there are impacts, and that if you look at the exciting things that were announced today around Enterprise Security updates, right? Enterprise Security is an interesting app from Splunk, but if a customer goes from just having Splunk Enterprise to running Enterprise Security as a premium application, there's significant downstream impacts on infrastructure that if the application team doesn't account for they can basically put themselves in a corner from a performance and a capacity perspective that can cause serious problems and slow down the business outcome that they're trying to achieve because they didn't think about the infrastructure impacts. >> Well, and what they want really is they want infrastructure that they can code, right? And we talked about this at VMworld we were talking about off camera that cloud model, bringing that cloud model to your data as oppose to trying to force your business into the cloud. So what about Ready Systems mimics that cloud model? Is it a cloud like infrastructure? Wondering if you could talk-- >> Yeah, I think it's that cloud like experience. Because we know we're in a multi cloud world, right? Cloud is not a place, cloud is an operating model, right? And so I think that the Ready Systems specifically provides a couple of things that are that cloud like experience, which is simple ordering and configuration and consumption that is aligned to the application, right? So we actually align the sizing of the system to the license size and the expected experience that this one customer would have so they get that very curated bespoke system that's designed specifically for them, but in a very easy to consume fashion that's also validated by the software vendor, in this case Splunk, that they say, "These are known good configurations "that you will be successful with." So we give customers that comfort that, "Hey, this is a proven way "to deploy this application successfully, "and you don't have to go through "a significant architecture design concept "to get to that cloud like experience." Then you layer in the fact that what makes up the Ready System, which is it is a platform powered by, in the VxRail case powered by VMware, right, ESX and vSAN, which obviously if you look at any of the cloud providers everything is virtualized at the end of the day for the most part, or at least most of the environments are. And so we give, and VMware has been focused on that for years and years of giving that cloud like experience to their customers. >> You talk about, you mentioned selling, sort of reseller, you've got this partnership growing, you're a customer. So, you have all these hats, right, and connections with Splunk. What does that do for you you think just in general? What kind of value do you put on that having these multiple perspectives to how they operate whether it's in your environment or what you're doing for your customers using their insights? >> Yeah, I think at the end of the day we're here to make it simpler for customers. So if we do the work, and we invest the time and energy and resources in this partnership, and we go do the validation, we do the joint engineering, we do the joint certification, that's work that customers don't have to do, and that's value that we can deliver to them that whatever reason they buy Splunk for whatever workload or business outcome they're trying to achieve, we accelerate it. That's one of the biggest values, right? And then you look at who do they interact with in the field? Well, it's engineers from our awesome presales team from around the world that we've actually trained in Splunk. So we have now north of 25 folks that have Splunk SE certifications that are actually Dell EMC employees that are out working with Splunk customers to build platforms and achieve that value very, very quickly. And then them understanding that, "Oh, by the way, Dell EMC is also a user of Splunk, "a great customer of Splunk "and a number of interesting use cases "that we're actually replatforming now "and drinking our own Kool Aid so to say," that I think it just lends credibility to it. And that's a lot of the reason why we've made the investments in being part of this awesome show, but also in doing things like providing the applications. So we actually have four apps in Splunkbase that are available to monitor Dell EMC platforms using Splunk. So I think customers just get a wholistic experience that they've got a technology partner that wants to see them be successful deploying Splunk. >> I wonder if we could talk about stacks, because I've heard Chad Sack-edge talk about stack wars, tongue and cheek, but his point is that customers have to make bets. You've heard him talk about this. You've got the cloud stacks, whether it's Azure or AWS or Google. Obviously VMware has a prominent stack, maybe the most prominent stack. And there's still the open source, whether it's Hadoop or OpenStack. Should we be thinking about the Splunk stack? Is that emerging as a stack, or is it a combination of Splunk and these other? >> You know, we actually had that conversation today with some of the partner engineering team, and I don't know that I would today. I think Splunk continues to be, it's its own application in many cases. And I actually think that a lot of what Splunk is about is actually making sure that those stacks all work. So there was even announcements made today about a new app. So they have a new app for Pivotal Cloud Foundry, right? So if you think about stacks for application development, if you're going to hit push on a new application you're going to need to monitor it. Splunk is one of those things that persistent. The data is persistent. You want to keep large amounts of data for long periods of time so that you can build your models, understand what's really going on in the background, but then you need that real time reporting of, "Hey, if I hit push on a Cloud Foundry app "and all of a sudden I have an impact "to the service that's underlying it "because there's some microservice that gets broken, "if I don't have that monitoring platform "that can tell me that and correlate that event "and give me the guidance to not only alert against it "but actually go investigate it and act against it, "I'm in trouble." The stacks, I think many of them have their own monitoring capabilities, but I think Splunk has proven it that they are invested in being the monitoring and the data fabric that I think is wanting to help all the stacks be successful. So I don't necessarily put it in the stack. And I kind of don't put Hadoop in its own stack, either, because I think at the end of the day Hadoop needs a stack for deployment models. So you may see it go from a physical construct of being, a bit trying to be its own software that controls the underlying hardware, but I think you're seeing abstraction layers happen everywhere. They're containerizing Hadoop now. Virtualization of Hadoop is legit. Most of the big cloud providers talk about the decoupling of compute from storage in Hadoop for persistent and transient clusters. So I think the stacks will be interesting for application development, and applications like Splunk will be one of two things. They'll either consume one of those stacks for deployment or they'll be a standalone monitoring tool that makes us successful. >> So you don't see in the near term anyway Splunk becoming an application development platform the way that a lot of the-- >> Cory: They may have visions of it. That's not, yeah. >> They haven't laid that out there. It's something that we've been bounding around here. >> Yeah, I think it's interesting. Again, I think it goes back to .. Because the flexibility in what you can do with Splunk. I mean we've developed some of our own applications to help monitor Dell EMC storage platforms, and that's, it's interesting. But in terms of building what we'd I guess we'd consider like traditional seven factor app development, I don't know that it provides it. >> Yeah, well it's interesting because, I'm noodling here, Doug Merritt said, "Hey, we think we're going to be the next five billion, "10 billion, 20 billion dollar ecosystem slash company," and so you start to wonder, "Okay, how does that TAM grow to that point? That's one avenue that we considered. I want to talk about the anatomy of a transaction and how that's evolved. Colin, you mentioned Client Server, and you think about data rich applications going from sort of systems of record and the transactions associated with that. And while there were many going to Client Server and HTTP, and then now mobile apps really escalated that. And now with containers, with microservices, the amount of data and the complexity of transactions is greater and greater and greater. As a technologist, I wonder if you could sort of add some color to that. >> Yeah, I think as we kind of go down a path of application stacks are interesting, but at the end of the day we're still delivering a service, right? At the end of the day it's always about how do I deliver service, whether it's a business service, it's a mobile application, which is a service where I could get closer to my customer, I could transact business with them on a different model, I think all of it ... Because everything has gone digital, everything we do is digital, you're seeing more and more machines get created, there's more and more IP addressed devices out there on the planet that are creating data, and this machine generated data deluge that we're under right now it ain't slowing down, right? And so as we create these additional devices, somebody has got to make sense of this stuff. And if you listen to a lot of the analysts they talk about machine data is the most target rich in terms of business value, and it's their fastest growing. And it's now at a scale because we've now created so many devices that are creating their own logs, creating their own transactional data, right, there's just not that many tools that out of the box make it simple to collect the data, search the data, and derive value from it in the way that Splunk does. You can get to a lot of the things that Splunk can deliver from an outcome other ways with other platforms, but the simplicity and the ability to do it with a platform that out of the box does it and has a vibrant community of folks that will help you get there, it's a pretty big deal. So I think it's, you know, it's interesting. I don't know, like under the covers microservices are certainly interesting. They're still services. They're just smaller and packaged slightly differently and shared in a different way. >> And a lot more of them. >> Yeah, and scaled differently, right? And I totally get that, but at the end of the day we're still from a Splunk perspective and from a data perspective, we've still got to make sense of all of it. >> Right, well, I think the difference is just the amount of data. You talked about kind of new computing models, serverless sort of, stateless, IoT coming into play. It's just the data curve is reshaping. >> Well, it's not just the amount of data, it's the number of sources. The data is exploding, but also, as Cory mentioned, it's exploding because it's coming from so many places. Your refrigerator can generate data for you now, right? Every single ... Everything that generates Internet, anything doing anything now really has a microprocessor in it. I don't know if you guys saw my escape room at VMworld. There were 12 microprocessors running this escape room. So one of the things we played about doing was bring it here and trying to Splunk the escape room to actually see real time what the data was doing. And we weren't able to ship it back from Barcelona in time, but it would've been interesting to see, because you can see just the centers that are in that room real time and being able to correlate all that. And that's the value of Splunk is being able to pull that from those disparate sources altogether and give you those analytics. >> Yeah, it's funny you talk about an IoT use case. So we've got these... Our partner, who's a joint partner of both Dell EMC and Splunk, we actually have these Misfit devices that are activity trackers. And we're actually-- >> Misfit device? >> Misfit. Yeah, it's a brand. >> John: Love it. >> It's fitting, I think. But we have these devices that we gave away to a number of the attendees here, and we actually asked them if they're willing to participate. They can actually use the app on your phone to grab the data. And by simply going to a website they can allow us to pull the data from their device about their activity, about their sleep. And so we actually have in our booth and in Arrow's booth we're Splunking Conf and it's called How Happy is Conf? And so you can actually see Splunk running, and by the way, it's running in Arrow's lab. It's running on top of Dell EMC infrastructure designed for Splunk. You can actually see us Splunking how happy conf attendees are. And we're measuring happiness by their sleep. How much sleep-- >> John: Sleep quality and-- >> The exercise, the number of steps, right? So we have a little battle going between-- >> Is more sleep or less sleep happy? >> Are consumption behaviors also tracked on that? I just want to know. I'm curious. >> It's voluntary. You'd have to provide that. >> Alright, because that's another measure of happiness. >> It certainly is. But it's just a great use case where we talk about IoT and the number of sources of data that Splunk as a platform ... It's very, very simple to deploy that platform, have a web service that's able to pull that data from an API from a platform that's not ours, right, but bring that data into our environment, use Splunk to ingest and index that data, then actually create some interesting dashboards. It's a real world use case, right? Now, how much people really want to (mumbles) Splunk health devices we'll determine, but in the IoT context it's an absolute analog for what a lot of organizations are trying to do. >> Interesting, good stuff. Gentlemen, thanks for being with us. We appreciate that. Cory, it's probably not the real deal, but as close as I'm going to go. Good luck with your session. We appreciate the time to both of you, and you and your Misfit. Back with more here on theCUBE coming up in just a bit here in Washington D.C. (techno music)