>> Narrator: Alumni. (upbeat music) >> Announcer: Live from Stanford University in Palo Alto, California, it's theCUBE. Covering Women in Data Science Conference 2018. Brought to you by Stanford. >> Welcome back to theCUBE, we are live at Stanford University for the third annual Women in Data Science Conference, WiDS. I'm Lisa Martin, very honored to be joined by one of the co-founders of this incredible WiDS movement and phenomenon, Dr. Margot Gerritsen. Welcome to theCUBE! >> It's great to be here, thanks so much for being at our conference. >> Oh, likewise. You were the senior associate dean and director of the Institute for Computational Mathematics and Engineering at Stanford. >> Gerritsen: That's right, yep. >> Wow, that's a mouthful and I'm glad I could actually pronounce that. So you have been, well, I would love to give our audience a sense of the history of WiDS, which is very short. You've been on this incredible growth and scale trajectory. But you've been in this field of computational science for what, 30, over 30 years? >> Yeah, probably since I was 16, so that was 35 years ago. >> Yeah, and you were used to being one of few, or if not the only woman >> That's right. >> In a meeting, in a room. You were okay with that but you realized, you know what? There are probably women who are not comfortable with this and it's probably going to be a barrier. Tell us about the conception of WiDS that you and your co-founders had. >> So, May, 2015, Esteban from Walmart Labs, now at Facebook, and Karen Matthys, who's still very active, you know, one of the organizers of the conference, and I were having coffee at a cafe in Stanford and we were lamenting the fact that at another data science conference that we had been to had only had male speakers. And so we connected with the organizers and asked them why? Did you notice? Because very often people are not even aware, it's just such the norm to only have male speakers, >> Right, right. >> That people don't even notice. And so we asked why is that? And they said, "Well, you know we really tried to find "speakers but we couldn't find any." And that really was, for me, the last straw. I've been in so many of these situations and I thought, you know, we're going to show them. So we joke sometimes, a little bit, we say it's sort of a revenge conference. (laughs) We said, let's show them we can get some really outstanding women, and in fact only women. And that's how it started. Now we were sitting at this coffee shop and I said, "Let's do a conference." And they said, "Well, that would be great, next year." And I said, "No, this year. "Let's just do it. "Let's do it in November." We had six months to put it together. It was just a local conference here. We got outstanding speakers, which were really great. Mostly from the area. And then we started live-streaming because we thought it would be fun to do. And to our big surprise, we had 6,000 people on the livestream just without really advertising. That made us realize, in November 2015, my goodness, we're onto something. And we had such amazing responses. We wanted to then scale up the conference and then you can hire a fantastic conference center in San Francisco and get 10,000 people in like they do, for example, at Grace Hopper. But we thought, why not use online technology and scale it up virtually and make this a global event using the livestream, that we will then provide to people, and asking for regional events, local events to be set up all around the world. And we created this ambassador program, that is now in its second year. the first year the responses were actually overwhelming to us already then. We got 75 ambassadors who set up 75 events around the world >> In about 40 countries. >> This was last year, 2017? >> Yeah, almost exactly 13 months ago, and then this year now we have over 200 ambassadors. We have 177 events in 155 cities in 53 countries. >> That's incredible. >> So we're on every continent apart from Antarctica but we're working on that one. >> Martin: I was going to say, that's probably next year. >> Yeah, that's right. >> The scale, though, that you've achieved in such a short time period, I think, not only speaks to the power, like you said, of using technology and using live-streaming, but also, there is a massive demand. >> Gerritsen: There is a great need, yeah. >> For not only supporting, like from the perspective of the conference, you want to support and inspire and educate data scientists worldwide and support females in the field, but it really, I think, underscores, there is still in 2018, a massive need to start raising more profiles and not just inspiring undergrad females, but also reinvigorating those of us that have been in the STEM field and technology for a while. >> Gerritsen: That's right. >> So, what are some of the things, so, this year, not only are you reaching, hopefully about 100,000 people, you mentioned some of the countries involved today, but you also have a new first this year with the WiDS Datathon. >> That's right. >> Tell us about the WiDS Datathon, what was the idea behind it? You announced some winners today? >> Yeah. Yeah, so with WiDS last year, we really felt that we hit a nerve. Now there is an incredible need for women to see other women perform so well in this field. And, you know, that's why we do it, to inspire. But it's a one-time event, it's once a year. And we started to think about, what are some of the ways that we can make this movement, because it's really become a movement, into something more than just an annual, once-a-year conference? And so, Datathon is a fantastic way to do that. You can engage people for several months before the conference, and you can announce the winner at the conference. It is something that can be done really easily worldwide if it is supported again by the ambassadors, so the local WiDS organizations. So we thought we'd just try. But again, it's one of those things we say, "Oh, let's do it." We, I think, thought about this about six months ago. Finding a good data set is always a challenge but we found a wonderful data set, and we had a great response with 1100, almost 1200 people in the world participating. >> That's incredible. >> Several hundred teams. Yeah, and what we said at the time was, well, let's have the teams be 50% female at least, so that was the requirement, we have a lot of mixed teams. And ultimately, of course, that's what we want. We want 50-50, men-women, have them both at the table, to participate in data science activities, to do data science research, and answer a lot of these data questions that are now driving so many decisions. Now we want everybody around the table. So with this Datathon, it was just a very small event in the sense, and I'm sure next year it will be bigger, but it was a great success now. >> Well, congratulations on that. One of the things I saw you on a Youtube video talking about over the weekend when I was doing some prep was that you wanted this Datathon to be fun, creative, and I think those are two incredibly important ways to describe careers, not just in STEM but in data science, that yes, this can be fun. >> Yep. >> Should be if you're spending so much time every day, right, doing something for a living. But I love the creativity descriptor. Tell us a little bit about the room for interpretation and creativity to start removing some of the bias that is clearly there in data interpretation? >> Oh. (laughs) You're hitting the biggest sore point in data science. And you could even turn it around, you say, because of creativity, we have a problem too. Because you can be very creative in how you interpret the data, and unfortunately, for most of us, whenever we look at news, whenever we look at data or other information given to us, we never see this through an objective lens. We always see this through our own filters. And that, of course, when you're doing data analysis is risky, and it's tricky. 'cause you're often not even aware that you're doing it. So that's one thing, you have this bias coming in just as a data scientist and engineer. Even though we always say we do objective work and we're building neutral software programs, we're not. We're not. Everything that we do in machine learning, data mining, we're looking for patterns that we think may be in the data because we have to program this data. And then even looking at some of the results, the way we visualize them, present them, can really introduce bias as well. And then we don't control the perception of people of this data. So we can present it the way we think is fair, but other people can interpret or use little bits of that data in other ways. So it's an incredibly difficult problem and the more we use data to address and answer critical challenges, the more data is influencing decisions made by politicians, made in industry, made by government, the more important it is that we are at least aware. One of the really interesting things this conference, is that many of the speakers are talking to that. We just had Latanya Sweeney give an outstanding keynote really about this, raising this awareness. We had Daniela Witten saying this, and various other speakers. And in the first year that we had this conference, you would not have heard this. >> Martin: Really? Only two years ago? >> Yeah. So even two years ago, some people were bringing it up, but now it is right at the forefront of almost everybody's thinking. Data ethics, the issue of reproducibility, confirmations bias, now at least people now are aware. And I'm always a great optimist, thinking if people are aware, and they see the need to really work on this, something will happen. But it is incredibly important for the new data scientists that come into the field to really have this awareness, and to have the skill sets to actually work with that. So as a data scientist, one of the reasons why I think it's so fun, you're not just a mathematician or statistician or computer scientist, you are somebody who needs to look at things taking into account ethics, and fairness. You need to understand human behavior. You need to understand the social sciences. And we're seeing that awareness now grow. The new generation of data scientists is picking that up now much more. Educational programs like ours too have embedded these sort of aspects into the education and I think there is a lot of hope for the future. But we're just starting. >> Right. But you hit the nail on the head. You've got to start with that awareness. And it sounds like, another thing that you just described is we often hear, the top skills that a data scientist needs to have is statistical analysis, data mining. But there's also now some of these other skills you just mentioned, maybe more on the softer side, that seem to be, from what we hear on theCUBE, as important, >> Gerritsen: That's right. >> As really that technical training. To be more well-rounded and to also, as you mentioned earlier, to have to the chance to influence every single sector, every single industry, in our world today. >> And it's a pity that they're called softer skills. (laughs) >> It is. >> Because they're very very hard skills to really master. >> A lot of them are probably you're born with it, right? It's innate, certain things that you can't necessarily teach? >> Well, I don't believe that you cannot do this without innate ability. Of course if you have this innate ability it helps a little, but there's a growth mindset of course, in this, and everybody can be taught. And that's what we try to do. Now, it may take a little bit of time, but you have to confront this and you have to give the people the skills and really integrate this in your education, integrate this at companies. Company culture plays a big role. >> Absolutely. >> This is one of the reasons why we want way more diversity in these companies, right. It's not just to have people in decision-making teams that are more diverse, but the whole culture of the company needs to change so that these sort of skills, communication, empathy, big one, communication skills, presentation skills, visualization skills, negotiation skills, that they really are developed everywhere, in the companies, at the universities. >> Absolutely. We speak with some companies, and some today, even, on theCUBE, where they really talk about how they're shifting, and SAP is one of them, their corporate culture to say we've got a goal by 2020 to have 30% of our workforce be female. You've got some great partners, you mentioned Walmart Labs, how challenging was it to go to some of these companies here in Silicon Valley and beyond and say, hey we have this idea for a conference, we want to do this in six months so strap on your seatbelts, what were those conversations like to get some of those partners onboard? >> We wouldn't have been able to do it in six months if the response had not been fantastic right from the get-go. I think we started the conference just at the right time. There was a lot of talk about diversity. Several of the companies were starting really big diversity initiatives. Intel is one of them, SAP is another one of them. We were connected with these companies. Walmart Labs, for example, one of the founders of the company was from Walmart Labs. And so when we said, look, we want to put this together, they said great. This is a fantastic venue for us also. You see this with some of these companies, they don't just come and give us money for this conference. They build their own WiDS events around the world. Like SAP built 30 WiDS events around the world. So they're very active everywhere. They see the need, of course, too. They do this because they really believe that a changed culture is for the best of everybody. But they also believe that because they need the women. There is a great shortage of really excellent data scientists right now, so why not look at 50% of your population? >> Martin: Exactly. >> You know, there's fantastic talent in that pool and they want to track that also. So I think that within the companies, there is more awareness, there is an economic need to do so, a real need, if they want to grow, they need those people. There is an awareness that for their future, the long term benefit of the company, they need this diversity in opinions, they need the diversity in the questions that are being asked, and the way that the companies look at the data. And so, I think we're at a golden age for that now. Now am I a little bit frustrated that it's 2018 and we're doing this? Yes. When I was a student 30 some years ago, I was one of the very few women, and I thought, by the time I'm old, and now I'm old, you know, as far as my 18-year-old self, right, I mean in your 50s, you're old. I thought everything would be better. And we certainly would be at critical mass, which is 30% or higher, and it's actually gone down since the 80s, in computer science and in data science and statistics, so it is really very frustrating in that sense that we're really starting again from quite a low level. >> Right. Right. >> But I see much more enthusiasm and now the difference is the economical need. So this is going to be driven by business sense as well as any other sense. >> Well I think you definitely, with WiDS, you are beyond onto something with what you've achieved in such a short time period. So I can only imagine, WiDS 2018 reaching up to 100,000 people over these events, what do you do next year? Where do you go from here? (laughs) >> Well, it's becoming a little bit of a challenge actually to organize and help and support all of these international events, so we're going to be thinking about how to organize ourselves, maybe on every continent. >> Getting to Antarctica in 2019? >> Yeah, but have a little bit more of a local or regional organization, so that's one thing. The main thing that we'd like to do is have even more events during the year. There are some specific needs that we cannot address right now. One need, for example, is for high school students. We have two high school students here today, which is wonderful, and quite a few of them are looking at the live-stream of the conference. But if you want to really reach out to high school students and tell them about this and the sort of skill sets that they should be thinking about developing when they are at university, you have to really do a special event. The same with undergraduate students, graduate students. So there are some markets there, some subgroups of people that we would really like to tailor to. The other thing is a lot of people are very very eager to self-educate, and so what we are going to be putting together, at least that's the plan now, we'll see, if we can make this, is educational tools, and really have a repository of educational tools that people can use to educate themselves and to learn more. We're going to start a podcast series of women, which will be very, very interesting. We'll start this next month, and so every week or every two weeks we'll have a new podcast out there. And then we'll keep the momentum going. But really the idea is to not provide just this one day of inspiration, but to provide throughout the year, >> Sustained inspiration. >> Sustained inspiration and resources. >> Wow, well, congratulations, Margot, to you and your co-founders. This is a movement, and we are very excited for the opportunity to have you on theCUBE as well as some of the speakers and the attendeees from the event today. And we look forward to seeing all the great things that I think are going to come for sure, the rest of this year and beyond. So thank you for giving us some of your time. >> Thank you so much, we're a big fan of theCUBE. >> Oh, we're lucky, thank you, thank you. We want to thank you for watching theCUBE. I'm Lisa Martin, we are live at the third annual Women in Data Science Conference coming to you from Stanford University, #WiDS2018, join the conversation. I'll be back with my next guest after a short break. (upbeat music)

>> Announcer: Live from Washington DC, it's theCUBE. Covering .conf2017. Brought to you by Splunk. >> Welcome back here on theCUBE, we're in Washington DC at the Walter Washington Convention Center, day one of .conf2017, Splunk's big get together here with some 7,000 plus attendees, 65 countries, and traveled something like some 30 million miles to get here? Incredible turn out, it really is impressive, and a great day we're having here on theCUBE. Which of course is the flagship broadcast of SiliconANGLE TV. Joining me is Jeff Chancey, who is a managing director within Accenture Technology Ecosystem and Ventures. Jeff, good to see you here in Washington, welcome to town. >> Likewise, thank you very much. Excited to be here. >> Yeah, it's certainly been a great day, great first day, let's talk about your partnership, Accenture with Splunk, and what do you see the future for the partnership, how is it evolving? >> Well it's interesting you might ask that, it's probably the $64,000 question. The future of the partnership is indeed exciting. Let me kind of articulate what I mean by that. We Accenture, we're a large professional services firm, our competencies around Accenture Strategy, Accenture Consulting, Accenture Digital Technology Operations, and Accenture Security. What makes the partnership with Splunk so interesting and unique, and also very dynamic, is the fact that Splunk as a transformational data platform applies across the full spectrum of business that Accenture does. So if you can bring the power of an Accenture and our presence in the market, across all the different industry verticals, all the horizontals, and the power of a transformational data engine like Splunk together, you could say it should be a very exciting future indeed. Probably our biggest objective is to really help, in Accenture we call it rotating to the new. So rotating to new technology, and Splunk is definitely part of our agenda to rotate to the new. We are looking to help our clients become data and digital driven businesses, by leveraging the enormous volumes of data that keep exponentially getting generated every single day, through connected devices, applications, infrastructure, across the board, the Internet of Things, everything is now connected, and everything is spooling data. So, we know that our enterprise executive clients, they're all struggling with this challenge that says, "how do I not only, get value out of my data, how do I solve this challenge with the exponential generation of data, so that I don't just survive in the market, but I win?" This is really what we're after as a partnership is that step change transformational agenda, with our enterprise clients. >> So you have this budding partnership, you've talked about all these fantastic opportunities and great potentials and whatever, is it possible, can you focus on one thing that you're most excited about when it comes to the partnership? >> The one thing I would say we're most excited about right now is our security agenda. We all know where Splunk sits, in terms of the security market. Accenture Security, our very first joint market offering is the Cyberdefense Engine, formally known as, our Cyberdefense Platform. That joint market offering stands to be, really what credentializes the partnership between Accenture and Splunk in the market. Very exciting. Every customer needs to mitigate risk, they must protect their enterprises, they're breaches happening every single day, it's in the news, and Splunk is a powerful technology to help our clients protect their enterprises. So, what you want to do, with Accenture and Splunk is we want to help our clients take out cost, take out cost out of the back office, to drive up their profitability and drive down their cost to serve their customers, we want to help them protect their enterprise through security, and then we want to help them drive step change value for their customers and for them through Internet of Things, and business analytics, automating away the work, and driving that value in the market. >> You're talking about this vast array of services, that you could provide, we know about your relationship with Splunk, you've got hordes and hordes of machine data right, pouring in all the time, how are your clients putting all that together, how are -- maybe some of the innovative ways that they're pulling these various resources and sources together and putting them to use? >> What our clients and what we're observing with our clients, is, with their data, they're data tends to reside in multiple silos, within the enterprise. This is normal, this is natural. What we can help do with a powerful technology like Splunk, is aggregate that data across all the different silos and bring it together in a single view. That not only helps the operations staff, as we said before, protecting the enterprise through security, and driving that value through business analytics, real time digital marketing, using geolocation services, for example. One of our exciting offerings is in the retail industry vertical. We're leveraging the power of Splunk to understand through Point of Sale data what product is going out the door, in say, a store operations environment, and also what inventory is coming through the back door, and triangulating that with the real time rate at which product is leaving the shelves, being able to help those retail customers actually do real time order management and trigger those events in real time. because if you're a retail custoner, the last thing you want to do is have products not on the shelf that your customers want to buy, and in the case of a grocery store for example, you don't want to have, your fresh foods spoil before you have a chance to sell it. So if you can bring together the dynamics of what's going in and out of the store with customer loyalty programs and geolocations, you can actually real time target those customers when they're in the vicinity of your store, and say, "The broccoli, we're offering you a special. Come in right now -- >> (laughing) >> We'll give you 15% off of broccoli", because we know you're a customer that likes to buy a lot of broccoli. That's a really exciting -- >> Inventory's everything, right? Inventory control. In this case -- >> And really applying it to the entire supply chain, 'cause obviously, the inventory from the manufacturing side, the consumer goods and services side, has to be available, has to be in the warehouses and the distribution centers, so, optimizing that entire, call it material and product movement, from the raw material and the manufacturing all the way to the consumer. >> We've heard a line, I know you have, greater insight, greater value. How are you at Accenture and Splunk bringing that statement to life for me as your customer? >> Clearly, if we can bring the power of data transformation leveraging next generation technologies like Splunk, and I have to say, we as a partnership, we view Splunk as an emerging technology. Not emerging in the sense that it -- doesn't exist yet, I mean they've been around for over a decade now, but emerging onto the world stage to really help power the way businesses drive their business by leveraging all of that data. The secret sauce that Splunk has, is that ability to aggregate that data from multiple disparate sources, and to do that in real time. If we can drive greater insight into the customer's data, we can collectively drive greater value. Interestingly enough, the greater than sign, is a coincidence, it's part of both Splunk and Accenture's logos. >> Yeah right, you both have it working for you, don't you? You're known for vertical industry practices, is there one or a specific vertical that you can think of that maybe where you all have teamed up and that you're creating this interest or some kind of innovative solution that you're able to specifically develop and apply? >> I mentioned retail, and I mentioned security previously. An interesting area that we're getting into now, is in Health and Life Sciences, so healthcare. We want to be able to predict and prevent hospital Code Blue's before they happen. How much would you be able to do that? All of the devices, all the monitors that all the hospitals have, they're all from different manufacturers, they're all spooling data, and most of the hospital staff are using eyes on glass. To understand, we have a Code Blue, you've seen it in the movies, everybody's running to resuscitate and save the patient. What we want to be able to do leveraging Splunk is to apply machine learning and predictive analytics, to understand what the monitors tell us, that in 15 minutes this patient is likely to be a Code Blue, and how do we predict and prevent that from happening in the first place. I really can't think of anything better than figuring out how to leverage technology to save lives. >> Absolutely. Well, if I'm in need, I want you around, okay? (laughing) >> Okay, you got it. >> We got a deal. Jeff Chancey, from Accenture, thanks for being with us here on theCUBE, appreciate the time and wish you success down the road. >> Thank you very much, appreciate it. >> You bet. We'll continue here, from .conf2017, we are live, in our nation's capital, Washington DC.

>> Narrator: Live from Washington DC, it's The Cube. Covering .conf2017, brought to you by Splunk. >> And welcome back to .conf2017 here on The Cube. We continue our coverage from the Walter Washington Convention Center. Dave Vellante, John Walls, if you're wondering where we are, I mean physically, the White House is about a mile that way, and the U.S. Capitol is about a mile that way. So we're kind of sandwiched between where it's all happening, Dave. >> Yeah, I mean this exhibit hall is about a mile that way and a mile that way. (laughing) >> Yeah, if you're hungry, leave now for lunch. It's going to be a bit of a hike. We're going to talk about analytics, obviously, at this show, but with Cisco's Altaf Karim, Senior Manager of service line and product lead, so a practice lead. So Altaf, thank you for being with us here. >> You're very welcome. >> Thanks for the time. Let's talk about the Cisco network optimization service, and obviously how that comes into play with analytics, what that's all about. I know that's certainly near and dear to your mission. >> Sure. So as you mentioned, Cisco's network optimization service, it's a consulting-based service offer that we provide to hundreds of customers globally, where we're actually providing some experts in the field of Cisco products. These consultants know Cisco products in and out. Our span reaches globally in many different industries, and what we do is we really work with our customers first, our consultants work with our customers first to identify what sort of business outcomes that they're trying to achieve. These could be related to things like high availability, performance, and then really work from there to understand what types of things need to happen from an assessment standpoint, or architecture, or deployment standpoint, that they can optimize to make the most use of their network. Some of the key benefits of Cisco optimization service are increased productivity for our customers, better user experience, as well as customers who have made an investment in IT. Our consultants are able to work with them and devise a strategy on faster time to value of that investment. So those are some of the key tenets of-- >> Mr. Vellante: So this is a for-pay service, correct? >> Yes. >> Okay, and it starts presumably with an assessment, where you got to get the right people in the room, and maybe you have some automated tooling to help me do discovery, and things like that, and you're maybe looking at machine data and so forth. Take us through the life-cycle of an engagement. Where does it start? How do we engage? How does one engage with you? Where does it start and where does it go? >> Yeah, sure. So, it all starts with our consultants working with our customers first, as I said, to understand what types of business objectives are they trying to accomplish. We then essentially backtrack from there, and understand what things in the network can we control. For example, high availability, process of change management, improved performance on their network, and essentially devise KPIs and metrics that essentially back into the business outcome that they're trying to accomplish. And of course, we have a whole slew of capabilities around analytics, that our consultants bring to the table to essentially become proactive, and help the customer achieve those business outcomes. >> So it might be a customer comes to you and says hey, I'm having problems with my network. It's down too much, it's not performing the way I want. I think it's change management related, you know it probably is, but I don't know where to start. So you bring a tiger team in, and then what? You use all kinds of tooling and other expertise to surface the problem? >> Yeah, sure. So, your question actually delves into what types of KPI can our consultants provide to our customers, to show them how their network is doing, right? And so there's a couple of different ways to do this. One is, you can take a look at what data is available to you, and start to sift through that. And that can be a very cumbersome process that is lengthy. You're really looking for that needle in the haystack to try to figure out what types of insights you can find to make an impact to the business outcome. Another way to approach it is the way we do it from a process standpoint, is inwards from the customer's business outcome. What exactly are we trying to impact? Is it network performance? Is it high availability? And then, our consultants will actually come up with metrics and KPIs based on intellectual capital that our service offer has, and essentially create custom applications based on Splunk, to essentially provide those insights and views and visibility into the network, back to the customer. >> So is it fair to say that Splunk would be the primary ITOM tool, if I can use that term? Splunk doesn't really talk about ITOM, I guess, directly, but to me it's ITOM, IT operations management, but that is the primary platform that you guys would use and deploy? >> I would say that's one of the primary components. Splunk plays a very, very strategic role in how our consultants interact with our customers. So if you think about the premise behind and the value proposition behind network optimization service, is our leading-edge and world-class expertise in networking. And that's what we're known for. And so now when you think about analytics, especially proactive and predictive, you really need the right mixture in ingredients of things to come together, to provide meaningful analytics back to customers. And really, if you think about a trifecta of domain expertise, data science, as well as an understanding of potentially open-source technologies and platforms. But in this case, we're actually strategically using Splunk to play the piece of that last bit. And so what that means is we have consultants who are world-class, leading experts in networking, but we're also training them and asking them to walk a little bit in the shoes of data analysts. And, if you think about an audience or a constituent that is highly technical, quantitative-minded, Splunk is a pretty easy platform for them to learn and start to make an impact by creating custom applications, KPIs, and metrics, for their own customers, that they can use to be proactive and be preemptive, and provide those insights back to the customer. So that's the role that Splunk plays in our service. How much of your business is sort of Aspirin versus vitamin? In other words, how much is it, I got a pain point, I need a tactical solution to that pain point, versus you know what? I'm thinking about re-architecting my network, east west problem, right? Help me think that through, how I sort of transition from my legacy network to a more modernized network. How much is each of those? >> I would say they both play a pretty significant fare. Depending on where the customer is in the life cycle and what they're trying to accomplish, we certainly have a healthy dosage of customers who we work with transactionally, to architect new networks, to deploy new technology, to help them realize their IT spend in a quicker way. But then, a very significant part of our business also is, what do you do on the day two? You can build all this great stuff, right? But if you don't optimize it for peak performance, if you don't optimize it for high availability, or if it's not keeping up with your evolving needs and standards, then you might get in trouble. You're not using the most out of your network. So that's a healthy business as well. >> You mentioned KPIs. What are you tracking? And, what data matters? How do you determine what's relevant, what's not? You know, big problems, or big challenges at least. >> Yeah. That's a very important question, right? And to me, coming from a services background, it's very much rooted in knowing what your domain is about, because as I mentioned before, if you start with all the plethora of data that's available to you, and start to sift through it, you may or may not find something, right? But, our consultants work with the customer and identify what are specific things that we care to monitor, and what are specific KPI that we want to essentially do trending on, or to identify patterns around, so that we can accomplish some sort of business outcome. So for example, if you care about network performance, you're looking at metrics about capacity or bandwidth, or QOS. If you care about customer experience, you're probably, from a wifi standpoint, looking at signal strengths, looking at disassociations, how often and how quickly customers can connect to wifi networks. So really, it depends on what the customer is looking for. And our approach is that we have solid expertise in a number of networking disciplines ranging from routing, switching, wireless, data center, and others. So we have analytic service offers that go deep into each of those technology areas, and we can figure out what KPI to monitor to best achieve that business outcome, but then we also can bring all of that back together and provide that holistic network perspective, and one of the key things that we want to look at, to make sure network is operating optimally. >> Does your practice bleed into the security vector at all? Is that an adjacent area, or is that sort of a main area? >> Yeah. I would say security is paramount for our customers. For the network optimization service, it's actually an adjacent area, but it's definitely something that we work to include into all of our consultative guidance and recommendations to our customers. >> To whom do you sell, I mean, typically? When you initiate an engagement, is it a head of network? Is it a CIO level? And who do you get involved in the sort of initial meeting, and throughout the lifecycle of the project? >> Yeah. That's a really good question, and I would say that it varies depending on what types of analytics that they're also looking for. So let me give you a couple of different examples. So one example is the IT director or IT manager, who is really looking for a tool or analytics, visibility, insights, into how pieces of their network are performing so that they can achieve high availability, increase in network performance, or can better process their change management. So that's one type of buyer. But the other type of buyer is also at the CIO level, which is increasingly also more interested in using analytics to figure out where they are, and benchmark themselves against how others in their industry, or their peers, may be doing. So we've actually started to begun a lot of interesting conversations there, where some of the analytics that we can provide to our customers who opt in, is really rooted around benchmarking how they're doing in different areas such as performance, their software feature, their software or hardware or feature diversity compared to others in their own industry, and really can identify along with our consultative guidance which areas are really important for them to pay attention to, because they're doing something potentially different than everyone else in their industry. >> How about this challenge of IT networks, they're organic, they're constantly changing. So are you coming in, fixing a problem, and then I got to call you back? Or are you teaching me how to fish? >> I would say we're doing a little bit of both. So there's definitely reactive and remediation portions of our service offer. Unfortunately, that happens more than you would like, because you don't think about what to fix until something actually goes wrong. But, one of our flagship service offers, the network optimization services, is all about proactive and optimizing an existing network, so you make sure you're never getting to a place where you end up having to remediate something. And it's not just about remediation or fixing something that's broken, it's really about fine-tuning a well-oiled machine, to make sure that you're getting the most out of your IT investment. >> Yeah, but what kind of a, you talk about machine learning here, capabilities, what do you have in that vein? >> Yeah, so that's a really good question. When we start talking about proactive, and the predictive aspects of our consulting as well as our analytics, machine learning plays a pretty significant role, and I can only expect the contribution that will make to increase exponentially over time. A perfect example, one example of how we use machine learning is actually the machine learning tool kit inside of Splunk. So, if you think about our main premise behind network optimization, is to provide consulting, and provide recommendations on how to optimize the network. But when you think about what a network is, and it's a living and a breathing thing, each network is different, right? No network is the same. So, what machine learning, and especially the machine learning toolkit from Splunk, allows us to do is for a specific customer, it actually allows us to create a baseline of normalcy. What is normal for hundreds and thousands of KPIs and variables, for that specific customer? I think if we asked a human to do that, they'd probably still be going on-- (imitates gunshot) exactly, right? And so, that's an example of how we use machine learning toolkit from Splunk, and not only identifying what is normal for that customer, but then we can use supervised learning to start to identify anomalies and trends and patterns, and really begin to enable our consultants with the data and foresight around what types of things are happening on that network, so that they can in turn be proactive, and be predictive and preemptive in their exchanges with the customer. >> And these services are done on a T&M basis, or a fixed fee, or both? >> They're done both ways. We're pretty flexible, and there's a whole slew of offers outside of what I just talked about, that are available as well. >> What's typical of people? It just depends, right? >> I would say for pinpoint specific things that need to get done, they're more transactional in nature. And then when you're looking for entire lifecycle in a suite of services to help you optimize and be proactive and predictive and preemptive, that's where we have a subscription-based offer that is our optimization offer. >> Okay, and then you guys will actually, well you'll do this mostly remotely, I presume, but you go on site periodically to just impress the flesh and feel-out the culture? >> Absolutely. When we actually start an engagement with a customer, it's quite common for us to go on site, work to get to know the customer, the players, the network, understand what the business outcomes are, make sure that we're devising our deliverables in a way that actually impacts some sort of outcome, and they're not just rooted in some networking measures that don't necessarily make any impact there, right? So that's really important to us. So we definitely go on site. But of course, one of the value propositions of our offer is our intellectual capital. And when we talk about some of the analytics applications that engineers are building for a specific customer, now talk about that happening across hundreds of customers and engineers, devising new ways to create insights and visibilities in their own customer, and the sharing that happens between the engineers, so that they can bring those learning back to their own customer. >> Well, the door's open for business at Cisco, and Altaf Karim, we appreciate your time sharing with us why and how, and what you're doing, and wish you all the best of luck down the road too. Thanks for being with us here, first time on The Cube, right? >> First time on The Cube. >> Alright. >> Thank you for having me. >> You are now an alum. Welcome to the club. >> Great. >> Alright, Altaf Karim, joining us here on The Cube. We'll continue live from Washington D.C., right after this. (electronic theme music)

>> Announcer: Live, from Washington DC, it's theCube. Covering .conf2017 Brought to you by splunk. >> Welcome back inside the Walter Washington Convention Center. We're at .conf2017 in Washington DC, the nations capital, it is alive and well and thriving. A little warm out there, almost 90 degrees. But hot topic inside here, Dave. >> There's a lot of heat in this city. (laughter) >> A lot of hot air. >> Yeah, absolutely. >> We'll just leave it at that. Politics aside, of course. Joining us is Ben Miller, who is Director of High Thoughput Screening at Recursion Pharmaceuticals. Ben, thanks for being with us here on theCube. We appreciate the time. First off, I have many questions. First off let's talk about the company, what you do, and then what high throughput screening means, and how that operation comes into play when you have this great nexus of biology and engineering that you've brought together. >> Recursion Pharmaceuticals is treating drug discovery as a facial recognition problem. We're applying machine-learning concepts to biological images to help detect what types of drugs can rescue what types of diseases. We're one of the few companies that is both generating and analyzing our own data. As the director of the high throughput screening group, what I do is generate images for our data science teams to analyze, and that means growing human cells up in massive quantities, perturbing them with different types of disease reagents that cause their morphology to change, and then photographing them in the presence of compounds and in the absence of compounds. So we can see which compounds cause these disease states to revert more to a normal state for the cell. >> Okay, HTS then ... Walk us through that if you would. >> HTS is a general term that's used in the pharmaceutical industry to denote a assay that is executed in very large scale and in parallel. We tend to work on the order of multiples of 384 experiments per plate. We're looking at hundreds of thousands of images per plate, and we're looking at hundreds of plates per week. So when we say high throughput, we mean 6-10 terabytes of data per day. >> Just extraordinary amounts of data. And the mission, as we understand it, you're looking at very rare genetic diseases, your goal is to find cures for these over the next 15-20 years. Up to 100 of them, so that's why you're going through this multiple examinations of vast amounts of data. Human data. >> Yeah, there's been a trend in the pharmaceutical industry over the last years, where the number of dollars spent per drug developed is increasing. And it now takes over one billion dollars to bring a drug to market. And every year it costs more to bring a drug to market. We believe we can change that by operating at a massively parallel scale and also analyzing image data at a truly deep level. Looking at thousands of different features per image, instead of just a single feature in the image. >> That business is just like this vicious cycle going on, and you guys are trying to break it. >> Yes, exactly. >> So what's the state of facial recognition been? I've had mixed reviews about it. Because I rave about it, I go, "Oh my God, "Facebook tagged me again, it must be really good." And then other's have told me, "Well it's not really "as reliable as you might think." What is your experience been? >> The only experience I've had with facial recognition has been like yours, on Facebook and things like that. What we're doing is looking more at cellular recognition. Being able to see differences in these cellular morphologies. I think there are some unique challenges when you're looking at images of thousands of cells, versus images of a single person's face. >> Okay, so you've taken that concept down to the cell level and it's highly accurate, presumably. >> It's highly reproducible is what I would say, yeah. >> So it takes some work to be accurate, and once you get it there you can reproduce that, is that right? How does the sequence work? >> Yes, so there are two parts to the coin. One is how consistently we can produce these images and then how consistently those images represent the disease state. My focus is on making the images as consistent as they can be, while realizing that the disease states are all unique. So from our perspective, we're looking at thousands of different features in each image, and figuring out how consistent those features are from image to image. >> So paint a picture of your data stack, if you will. Infrastructure on up to the apps, and where splunk fits in. >> Sure. So I guess you could say that our data stack actually begins at hospitals around the world where human cells are collected from various medical waste samples. We culture those up, perturb them with different reagents, add different potential drugs back to them, and then photograph them. So at the beginning of our stack we've got biological agents that are mixed together and then photographs are generated. Those photographs are actually .tif files, and we have thousands and thousands of them. They're all uploaded in to Amazon Web Services, their S3 system. We spin up a near infinite number of virtual computers to process all of that image data within a couple of hours. And then produce a result. This drug makes this disease model look more like healthy and doesn't have other side effects. We're really reducing those thousands of dimensions in our image down to two. How much does it look like a healthy cell, and how much does it just look different then it should. >> And where does splunk fit into that stack? >> All of those instruments that are generating that data are equipped with splunk forwarders. So splunk is pulling all of our operational data from the laboratory together, and marrying it up with the image analysis that comes from our proprietary data analysis system. So by looking at the data that we're generating, how many cells we're counting, how bright the intensity of the image is, comparing that back to which dispenser we used, how long the plates sat at room temperature, et cetera. We can figure out how to optimize our production process so that we get reliable data. >> It's essentially storing machine data in the splunk data store. And then do you have an image database for ...? >> Yeah. And the image database is incredibly large. I wouldn't even guess at the current size. >> Dave: And what is it? Is it something on Amazon, an Amazon service? >> Yeah. So right now all of our image data is stored on AWS. >> This is one of those interviews Dave that the subject matter kind of trumps the technology because I want to know how it works. But you need the technology obviously to drive it. So I'm trying to figure out, "Alright, so you're taking "human cells and you're taking snapshots in time, "and then looking at how they react "to certain perturbed actions." But how does that picture of maybe one person's cell reacting to a reagent to another person's ... How does your data analysis provide you with some insight because Dave's DNA is different from my DNA, different from everybody in this building, so ultimately how are you combing through all of that data to make sense of it. >> That's true. Everybody has a unique genetic fingerprint, but everybody is susceptible to the same sets of major diseases. By looking at these images, and really that's the billion dollar question, is how representative are these individual cellular images, how representative are they of the general human population? And the effects that we see at a cellular level, will they translate in to human populations? We're very close to clinical trials on several compounds, but that's when we will really find out how much proof there is in this concept. >> Okay. You can't really predict ... Do you have a timeframe or is just sort of, "Keep going, keep getting funding until you reach the answer?" Is it like survive until you thrive? >> I personally don't maintain that kind of timeline. My role is within the laboratory producing the data as quickly as we can. We do have a goal of treating 100 different diseases in the next 10 years. And it's really early days, we're about 2 1/2 years in to that goal. It seems like we're on track, but there's still a lot of work to be done between now and then. >> So it's all cloud, right? And then splunk is throughout that stack, as we talked about. How do you envision, or do you envision, using it differently? Are you trying to get more out of the splunk platform? What do you want to see from splunk? >> That's a good question. I think right now we're using really the rudimentary basic features of splunk. Their database-connect app and their Machine Learning Toolkit are both pretty foundational to the work that we do. But right now a lot of our data models are one time use. We do a particular analysis to find the root cause of a particular problem, we learn that, and that's the last time we use that model. Continuous implementation of data models is something that is high on my list to do. As well as just ingesting more and more data. We're still fairly siloed. Our temperature and humidity data is separate from our machine data, and bringing that all into splunk is on the list. >> Why are your models disposable? It sounds like it's not done on purpose, it's more of some kind of infrastructure barrier? >> We're really at the cutting edge of technology right now, and we're learning a lot of things that people haven't learned, that in retrospect are obvious. To figure out the true cause of a particular situation, a data model or a machine-learning model is really valuable, but once you know that key salient fact, you don't need to keep track of it over time. You don't need to know that when your tire pressure is low your car gets less miles to the gallon. >> David: You have the answer. >> Right. But there are a lot of problems like that in our field that have not been discovered yet. >> I inferred from your answer you do see the potential to have some kind of ongoing model evolution. For new use cases? >> In the extreme situation we have a set of hundreds of operational parameters that are going into producing this image of cells. And then we have thousands of cellular features that are extracted from that image. There's a machine-learning problem there. What are the optimal parameters to extract the optimal information? And that whole process could be automated to the point where we're using machine-learning to optimize our assay. To me that's the future of what we want to do. >> Were you with Recursion when they brought in splunk? >> Yeah. >> You were. Did you look at alternatives? Did you look at maybe rolling your own with open source? Is that even feasible? Wonder if you could talk about that. >> I had already been introduced to splunk at my previous job, and at that previous company, before I heard of splunk, I was starting to roll my own. I was writing a ton of Perl scripts, and all of these regular expressions, and searching network drives to pull log files together. And I thought that maybe there would be a good business model behind that. >> You were building splunk. (laughter) >> And then I found splunk, and those guys were so far ahead of things I was trying to do on my own in a lab. So for me it was a no-brainer. But for our software engineering team, they are really dedicated to open source platforms whenever possible. They evaluated the ELK Stack. Some of us had used Sumo Logic and things like that. But for me, splunk had the right license model and I could get off the ground really really rapidly with it. >> What about the license model was attractive to you? >> Unlimited users, and only paying for the data that we ingest. The ability to democratize that data, so that everybody in the lab can go in and view it and I don't have to worry about how many accounts I'm creating. That was really powerful. >> Dave: So you like the pricing model. >> Yeah. >> Some users have chirped about the pricing, I saw some Wall Street concerns about the pricing. The guys that we've talked to on theCube today have said, "They like the pricing model, that there's value there." And you're sort of confirming that. >> Ben: Yeah. >> You're not concerned about the exponential growth of you data causing your license fees to go through the roof >> In the laboratory, the image data that we're generating is exponentially growing, but the operational parameter data is more linearly growing. >> Dave: So it's under control basically. >> Yeah, for our needs it is. >> Dave: You're not paying for the images, you're paying for the meta data around that. >> Yeah. >> Well it's a fascinating proposition, it really is. Very eager to keep up with this, keep track, and see the progress. Good luck with that. Look for having you back on theCube to monitor that progress, alright Ben? >> Great. Very good, thank you so much. Ben Miller joining us from Salt Lake City, good to have you here. Back with more on theCube in just a bit. You're watching our live coverage of .conf2017. (upbeat innovative music)

>> Narrator: Live, from Washington D.C., it's theCUBE. Covering .conf2017, brought to you by Splunk. >> Well, welcome back to .conf2017. Here we are at Splunk's annual get together, with Dave Vellante, I'm John Walls. We are live in the Walter Washington Convention Center, in beautiful Washington D.C. I say that, proud to be a native. Actually raised here, lived here, fly the flag here. >> Wow. >> This is my place, Dave. >> Listen, I love this city. >> I do too. >> I love coming down here. Lots to do, my son's down here, so. >> But if we weren't here, where should we be, maybe on the deck of a Carnival cruise line ship right now? >> That would be good. >> I would like that. >> I would love to have theCUBE on the deck of a Carnival >> Maybe, maybe Ruel Waite can swing that. What do you think? Ruel Waite joins us. He is the manager of delivery and support for Carnival. And you got room for two on the next ship out of Miami? >> Listen, man, for you guys anything. >> I love that. Alright, you're hired. >> I can make it happen. >> Outstanding. Alright Ruel, thanks for being here with us. >> No problem. >> On theCUBE, glad to have you, and here at the show as well. Alright, so let's talk about first off, Splunk. What are you doing? Let's back up, in terms of what you do. Your core responsibilities and then we'll get into Splunk story after that. >> Yeah, so I manage the support operation for our ecommerce platform, as well as for the guest facing ship board application. So the ecommerce platforms is where you go and purchase your cabin on the web. You would also be able to purchase your show excursions, your spa treatments, as well. Or we have an e-retail site where if you have a friend who's sailing you can buy a bottle of champagne and have it in their room for when they get there. So all those purchasing perks now that we support on the ecommerce platform. And then the guest facing application, Shipboard, we're talking 'about the mobile application where guests chat and interact with each other or plan their day. We're talking about the Pixels application where guests are purchase their photos that they take throughout their cruise. And their some facial recognition stuff there as well. And the iTV that's in your room. So we have a separate, many different sort of applications that fit under that portfolio. >> Let's talk about the data. >> Yes. >> A lot of data that you just created. >> Right? >> Yup. >> What's the data pipeline look like, where does Splunk fit? >> We Splunk as much as we can and we're continuing to build that as we go. Our application logs are Splunk, everything we produce from the application. Also our performance metrics from our servers and our data and our network, and all those systems, we Splunk that because that's critical for us to triage issues that occurring. Because our operation is about monitoring what's happening, it's about resolving issues as quickly as possible, and it's about communicating to our business. So those three things are data essential to all of that. So we need to get as much as we can and we need to be able to get insights into it. >> Can you talk about where you started, you had mentioned off camera about four years ago, and how you've been able to inject automation into your processes and just take us through your journey. >> Yeah, so we started a few years ago with Splunk, and it was primarily a triage tool for us. So an incident would occur, we'd try to get it, and look at some logs, figure out what's going on. And as we've evolved it's become more of a proactive alerting tool for us, it's become a communication tool, a collaborative tool, for us. You know, we leverage things like the ITSI, right. That allows us to understand the base line behavior of our system. Once we base line that then we can understand the spikes, we can understand when things are changing, and that allows us to react and quickly identify things, defects in our system, things that are occurring, and resolve them. So once we kind of got our legs around okay, we get how to use Splunk to find stuff, now let's figure out how to get Splunk to tell us stuff. >> Okay. >> Right? And now once Splunk is telling us stuff, let's figure out how we tell the business that stuff. So that's kind of how we the journey we've had with Splunk. >> And Splunk's in that thread the whole way? >> The whole way. >> So from, >> The whole. >> So, ultimately then, right now what are you putting into practice that you didn't have available >> Yeah, sure. >> two, three years ago? >> Yeah sure, so one of the challenges we had was, with a typical ecommerce site you have several layers of the application, right. You have your web server, you have caching infrastructure, you have a database server, yet we have a mainframe reservation system as well. So there are several things involved with supporting all those different platforms. Now when we have an incident, it's sometimes challenging to, you know you get somebody on the phone, you're like hey what are you seeing over there on the mainframe side? Well I see this error occurring. Oh and the database side they're telling you okay, we're seeing some sort of timeout here, but we're not sure if it's related to the same thing you're talking about. And we didn't have a way to tie it together. But by using Splunk Transactions what we decided to do was we decided to log the session ID, the web servers session ID across all our layers, right, and push that through, and that allows us to tie those transactions together across those layers. And now when we have an incident we're able to, when we're talking to the mainframe we're saying hey guy, hey go look at this. And he say here's what I'm seeing. >> You can isolate it? >> We can isolate it, we can pull it together, and it's really helpful. >> So will you get to the point, or you were trying to get to the point, where you can automate the remediation? Or is that something you don't want to do 'cause you want humans involved? >> You know, automation is good. And whatever we can automate we try to do that. At this point we're not automating the resolution through Splunk at this time, but what we are doing is we are providing the on call, or the engineer that are responding with as much information as we can in order to have them quickly flip that switch. So if we have an alert that we know, hey this issue requires a recycle of an application pool, or some kind of other action like that, we can put that in our Splunk alert. And we say hey we're seeing this issue occur. That email and that text message that goes out actually tells the engineer that these are the suggested actions that you can take in order to quickly resolve this issue. >> Ruel, what are you hearing from the business side? What are the business drivers and how is that effecting what you're doing in IT generally, and specifically with data and Splunk? >> Okay so from business side we're looking at most bookings is the one of the major metrics that we look at. And our guest experience. So and on the web that means the site needs to be available, it needs to perform, and it needs to work. So what we really are trying to do with Splunk is understand those issues that are impacting our guests on the booking side. What that means is we need to know how well we're converting. And if we're looking at homepage performance, and we can now tell hey if our homepage loads in five seconds verses three seconds, there are how many fewer people make it to our payment page, which is huge for us. So that's something that we really try to hone in on. And it really helps us to collaborate with the business and understand, really, what is the revenue impact of these IT metrics that we're spitting out. >> But there could be other factors involved in that too, >> Yes. >> other variables, right? >> There are. >> You can't just you know this is, but you have enough of a track record the are a couple reasons to say okay, five seconds means this, we get a 30% conversion rate. We get three seconds, man, we got 'em hello, and, now we have a 50%, whatever. >> Yeah, but that is where, what I'm excited about at the conference is the machine learning capabilities that we've been hearing about. 'Cause that will allow us to then model how those different factors that go into when someone goes from the homepage to payment, you're totally right. There's several things that go into that. And what we want to be able to model, hey, on a normal day here's our guest behavior, whether we have a sale, how do our guests behavior differently, or on a Monday night at eight PM what is the behavioral trend. So it's all important to us. And getting the data behind it and being able to model that is going to be really key for us. >> Connect the dots for me on >> Yes. >> how you use machine learning, and how will that affect the business? You'll make different offers at different times, or? >> So what I mean is if I understand how guests behave I will know if I'm having an issue on the site. If there's something happening that's impacting their ability to book. 'Cause sometimes you do a release, you do your quality control, and then you go home, everything looks good. And sometimes hours later, sometimes days later unfortunately, something pops up that you introduced during that release. And understanding what that baseline is, right. So what Splunk has allowed us to do is say okay, here's what normal behavior is. And we're trying to grow this more, but what we've been using ITSI to say here's what that behavior really is. Based on what we kind of know are the metrics around booking. Here's what that behavior is. And we do a release and we see a spike, a change, and now we're able to say wait a minute, we never saw this error before. This error never existed in our system at any point. That was definitely something that was introduced right here in this release, we need to go ahead and resolve this as well. And sometimes you get some false positives there, if your development team is doing change the way they log a little bit you might get a spike. But that's cool because you get to go in immediately and figure out what those changes are, and you get a comfort level that you kind of understand how your system works. >> Let me ask you another question. You got some experience with Splunk. >> Yes. >> Obviously, you were just working with them. What, in your mind, is on their to do list? What do you want to see out of them? Doug, if I'm Doug. Tell me, where should I go, what should I do. >> What do I want Splunk to do. >> Any gripes, give me the good, the bad, and the ugly. >> For me, it's performance, performance, performance. I want to see my queries run as quickly as possible. I want to see things fast. I want to hit the button and it happens right away. Now obviously that's not going to, that's not realistic. But I like what some of the things that Splunk are doing. You look at the new metrics index that they've been talking about the last two days. So they've now isolated your time serious data and they're able to optimize the searches on time serious data seperate from your application logs. So, you know, your CPUs, your memory consumption, that data is not the same as your logging an error, or logging that a booking was created, or something like that. Those are kind of two different things. So they have kind of decoupled that and they're saying anything that's time serious I'm going to put it over here. And I'm going to optimize that query, and then you can handle your other logs separately. But the additional benefit of that is then you can take your time serious and you can look at a CPU spike and then you can take your event data and overlay it on top. And then you can see, hey wait a minute, this event is what caused that spike. So that's where the cool is. >> I think they call that mstats. Is that right, mstats? >> Yes, it's mstats, yes. >> How 'about the stuff that you saw this week in the keynotes, particularly today was the product stuff. A lot of security obviously. Anything that you've seen here at the show that excites you, that you really said alright, I got to have that, I got to learn more? >> Yeah, so the ITSI event analytics really seems like something's going to be cool for us. As I've said before, we utilize ITSI internally. So we put together a glass table that's shows us here are all the different components and the hierarchy of things. And when this goes red it effects these other layers. And it's really cool. But what they've added in is the ability to click a button and drill in to those components and then you have a view of hey, here are the events associated with that. That's really cool because now you're triaging in one place, now you get to the problem really quick. And you can emote directly into your Splunk queries. It really allows what we're looking for is just to resolve issues as quickly as possible. >> And you're describing, if I understand this correctly, you can visualize the dependencies, and you can take remedial action or identify, inform the business what to expect. >> Exactly. >> Be much more proactive, that's what people are talking about. >> Yeah, yeah. And we found that one of the surprising things we found with Splunk is that our business are users of Splunk as well, right. So it's always an IT tool, it's something that only the geeks are going to look at. And then all of a sudden you present a dashboard to a business user and they go ah. That's pretty, right. And then all of a sudden they want it more than you do. So that's what makes it great right, 'cause you can present the data however you want and you can put it in a way that different audiences can consume. And so it becomes a platform that goes across the organization, which is really, really cool. >> John: But your bottom line's all speed right? >> Yes, yeah. >> Take care of my problems faster, get my customer faster, deliver faster, come on Splunk. >> Come on, let's go. >> We want to go. >> Brings the weekend faster. >> Right, right. >> Get more sleep, get more sleep. >> Ruel, thanks for being with us. >> Oh. >> We appreciate that. >> And, we'll talk about the cruise. Leonard Nelson, our producer over here already said book him for a massage, the presidential suite. He wants one night, and then the champagne buffet please. >> It's done. >> Fast internet, though. >> Yeah. >> Fast internet, yeah. It's done. >> Alright. We're simple people, we don't need all that, but we'll talk later. >> Alright man, appreciate it, thank you. >> Thank you for being with us. Ruel Waite joining us from Carnival. Back with more from Splunk, .conf2017. 2015, where did that come from? 2017, it's been a long day. (upbeat music)

>> Announcer: Live from Washington DC, it's theCUBE, covering .conf2017, brought to you by Splunk. >> Well good morning, welcome to day two, Splunk .conf2017 here in Washington DC, theCUBE very proud to be here again for the seventh time I believe this is. John Walls, Dave Vellante. Good morning, sir, how are you doing, David? >> I'm doing well thank you. >> Did you have a good night? >> Yeah, great night. >> DC, I know your son's here >> Walked round the district a little bit, yeah, it was good. >> It's good to have you here. >> At the party last night upstairs, (John laughs) talked to a few customers, trying to find out what they didn't like about Splunk, and it was not a lot of things. >> That would be a short conversation I think. We can do us, we got a couple of keynote rockstars with us this morning, Haiyan Song, who's the Senior Vice President of Security Markets at Splunk. Haiyan, good to see you again. >> Great to see you too. >> John: Thanks for coming back, Monzy Merza, who was the Head of Cybersecurity Research at Splunk. >> Thank you for having me. >> John: Monzy, commanding the stage with great acumen today, good job there. >> Monzy: Thank you. >> Yeah we'll get into that a little bit later. But first off, let's just kind of set the table here a little bit. I know this is a bit of transformational year for you in terms of security, in how you're building out your portfolio, and your services, and so kind of walk us through that. What are you doing, Haiyan, in terms of, I guess being available, right, for whomever, whenever, wherever they are in their security journey you might say. >> Journey is the keyword this year, and nerve center is another one that I highlighted at my super session yesterday. So when I reflect on, this is your seventh year, and when I reflect on the last three years, right, we came in and really talked about the enterprise security product on the first year. And second year we talked about, you know, how UBA adds to the capabilities for better detection and machine learning. We introduced different features. This year we didn't start the conversation on, "Here's a new feature". This year we started the conversation on you need to build a security nerve center. That's the new defense system. And there's a journey to get there, and our role is to enable you on that journey every step of the way. So it's portfolio message, and not only for the very advanced customers, who want machine learning, who want to customize the thread models. Also for people who just started, to say I have the data, and help me get more insight into this, or help me understand how leverage machine data across domains to really correlate and connect the dots, and do investigations. Or what are the important things to set up the basic operations. Very, very excited about the ability, transformational year, as you mentioned, that we can bring the full portfolio to our customer. >> So, Monzy, you've said in your keynote today, defenders can succeed. We talked off camera, you're an optimist. And all we need is this nerve center. So to date, has that nerve center been missing, has it been there and people haven't been able to take advantage of it, have the tools been too complicated? I wonder if you could unpack that a little bit? >> I think what's happened over the course of many years, as the security ecosystem matures and evolves, there are a lot of expert technologies in a variety of different areas, and it's a matter of bringing those expert technologies together, so that the operations teams can really take advantage of them. And you know, it's one thing to have a capability, but it's another to leverage that capability along with another capability and combine the forces together, and really that's the message, that's Haiyan's message, that's been there for the nerve center, that we can bring together. And so when I say the defender has an advantage, I mean that, because I feel that the operations teams, the IT teams, as well as the security teams, have laid out a path, and the attacker cannot escape that path. You have to walk down a certain path to get to something to achieve or to steal or to do whatever, or damage that you need to do. So when you have a nerve center, you can bring all the instrumentation that's been placed along those path to make use of it. So the attacker has to work within that terrain. They cannot escape that terrain. And that's what I mean, is the nerve center allows for that to occur. >> Now you guys have talked for a long time about bringing analytics and security, those worlds together. We've always been a big obviously proponent of that, but spending's just starting to shift, right. They're still spending a lot of money on the perimeter. I guess you have to. We all see the numbers, security investments continue to increase. But where are we today with regard to analytics and being able to proactively both identify and remediate? >> So I just echo what you just said. I'm so pleased to see the industry started the shifts. I think being analytics-driven is really top of mind for people, and using machine learning automation to help really speed up the detection and even response are top of mind. We just did a CISO Customer Advisory Report on Monday, and we always ask when we start the meetings, "Tell us your top of mind challenges, "tell us your top of, you know two investment, and what's the recommendation for Splunk?" And better, faster response, better faster detection and automation and analytics is top of mind for everybody. So for us, this year, extremely, extremely happy to talk about how we're completing that narrative for analytics-driven security. >> Well on that point, you talk about analytics stories, and filling gaps, putting an entire narrative together so that somebody could loosen up the nuts, and they can see exactly where intrusions occur, what steps could be taken, and so on and so forth. So, I mean, dig a little deeper on that for us, maybe Monzy, you can jump on that, about what this concept of analytics stories, and then how you're translating that into your workplace. >> We thought about this for quite some time in terms of drilling down and saying, as analysts and practitioners, what is it that we desire? The security research team at Splunk is composed of people who spend many, many years in the trenches. So what do we want, what did we always want, and what was hard? And instead of trying to approach it from the perspective of, you know, let's just connect the dots, really take an adversarial model approach to say, "What does an adversary actually do?" and then as a defender, what do I do when I see certain things happening? And I see things on the network, I see things on the end point, and that's good, and a lot of people talk about that. But what do I do next? As the analyst, where do I go, and what would be helpful to me? So we took this concept of saying, let's not call them anything else, we actually fought over this for quite some time. These are not use cases, because use case has a very different connotation. We wanted stories because an adversary starts somewhere, adversary takes some action. The defender may see some of that action, but then the defender carries on and does other things, so we really had this notion of a day in the life, and we wanted to capture that day in the life of the prospective of what's important to their business, and really encapsulate that as a narrative, so that when the analysts and security operations teams get their hands on this stuff, they're not bootstrapping their way through the process. They have a whole story that they can play through, and they can say, and if it doesn't make sense to them, that's okay, they can modify the story, and then have a complete narrative to understand the threat, and to understand their own actions. >> So we hear the stat a lot about how long it takes for organizations to identify an intrusion. It ranges I've been seeing, you know, service now flashing 191, I've seen it as high as 320. I'm not sure there's clear evidence that that number's compressing. I think it's early days there, but presumably analytics can help compress that number, but when I think about things like, you know, zero day signatures, and other very high tech factors that are decades old now. Can analytics help us solve those problems? Can the technology, which kind of got us into this mess, get us out of the mess? (Monzy and Haiyan laugh) >> That's such a great point. It is the technology that just made our lives so much easier, as you know, living, and then it complicate it so much for security people. I'll give you a definitive yes, right. Analytics are there to help detect early warning signs, and it will help us, may not be able to just change the stats right now for the whole industry, I'm sure it's changing stats for a lot of the customers, especially when it comes to remediation. The more readily available the data is for you when you are sort of facing an incident, the faster you can get to the root cause and start remediate. That we have seen many of our customers talk about how it was going from weeks to days, days to hours, and that includes not just technology, but also process, right? Process streamline and automating some of the things, and freeing up the people to do the things that they're great at, versus the mundane things, trying to collect the information. So I'm also a glass half full person, optimist, that's why we work together so well, that we really think being data driven, being analytics driven, is changing the game. >> What about the technology of the malware? I think it was at a .conf, I think it was 2013, one of your guest speakers gave us an inside look at Stuxnet. Of course by then it was seven, eight years old, right? But it was fascinating, and you know you read more about it, and you learn more about it, and it's insidious. Has the technology on the defender side, I guess was my real question, accelerated to keep up with that pace? Where are we at with the bad technology and the good technology? Are they at a balance now, an equilibrium? >> I think it's going to be a constant evolutionary process. It's like anything else, you know, whether you look at thieves or whether you look at people who are trying to create new innovative solutions for themselves. I think the key that, this is the reason why I said this morning, is that defenders can have, I think I said unfair advantage, not just an advantage. And the reason for that is, some of the things Haiyan talked about, with analytics, and with the availability of technology that can create a nerve center. It's not so much so that someone can detect a certain type of threat. It's that we know the low fidelity sort of perturbations that cause us to fire an alarm, but there's so many of those that we get desensitized. The thing that's missing is, how do I connect something that is very low threshold, to another thing that's very low threshold, and sequence those things together, and then say, you know, combined all of this is a bad thing. And one of my colleagues uses as example, you know, I go to the doctor and I say you know, "I've got this headache for a long time", and the doctor says, "Don't worry, you don't have a tumor." And it's like, "Okay, great, thank you very much," (Dave laughs) but I still have the headache >> Still have the headache. >> And so this is why even in the analytics stories we use, and even in UBA and in enterprise security, we don't use the concept of a false positive. We use the concept of confidence, and we want to raise confidence in a particular situation, which is why the analytics story concept makes sense, is because within that story, the confidence keeps raising as you go farther and farther down the chain. >> So it's a confidence, but also married, presumably through analytics, with a degree of risk, right? So I can understand whether that asset is a high value asset or John's football pool or something like that. >> John: Which is going very well right now by the way. (all laugh) Bring it on, very happy. >> Now you guys have come out with some solutions for ransomware. I tweeted out this morning that I was pleased at .conf that we're talking about analytics, analytic-driven solutions to ransomware, and not just the typical, when we go these conferences, the air gap yap. Somebody tweeted back to me, said, "Dave, until we see 100% certainty with analytics-driven solutions, we better still have air gaps." So I guess I wanted, if you guys could weigh in on what should people be thinking about in terms of ransomware, in terms of an end to end solution. Can you comment? >> I will add and... So for us, right, even to follow on the last question you had, the advancement in technology is not just algorithms, it's actually the awareness and the mindset to instrument your enterprise, and the biggest information gap in an incident response is, I don't have the data, I don't know what happened. So I think there's lot of advancement happened. We did a war game, you know, tabletop exercise, that was one of the biggest takeaways. Oh we better go back and instrument our enterprise, or agency, so when something does happen, we can trace back, right? So that's number one. So ransomware's the same thing. If you have instrumented your infrastructure, your applications stack, and your cloud visibility, you can actually detect some of the anomalies early. It's never going to solve 100%. So security is all about layered defense, right. Adapting and adding more layers, because nobody is really claiming I can be 100%, so you just want to put different layers and hoping that as they sift through, you catch them along the way. >> I think it's a question of ecosystem, and really goes back to this notion that different people have instrumented their environments in different ways, they deploy different technologies. How much value can they get out of them? I think that's one vector. The other vector is, what is your risk threshold? Somebody may have absolutely zero tolerance for air gaps. But I would, as a research person, I would like to challenge even that premise. I've been privileged to work in certain environments, and there are some people who have incredible resources, and so it's just a question of what is your adversary model that you're trying to protect yourself against, what is your business model for which you're willing to take over that risk? So I don't think there is a too high endpoint, there isn't a single solution for any of these number of things. It really just has to match with your business operation or business risk posture that you want to accommodate. >> You know what, you're almost touching on a point that I did want to hit you up on before you left, about choice, and you know, it's almost like personal, how much risk am I willing to take on? It's about customization, and providing people different tools. So how much leash do you give people? I mean do you worry that if we allow you to do too much tinkering you actually do more harm than good? But how do you factor all that in to the kind of services that you're offering? >> I think that ultimately it's up to the customer to decide what's valuable and what's critical for their business. If somebody wants a complete solution from Splunk, we're going to serve those customers. You heard a number of announcements this week from ES Content updates, to opening up the SDK, you know, with UBA, to the security essentials app releases, and all of those different kinds of capabilities. On the top end of it, we have the machine learning toolkit. If you have experts that want to tinker and learn something more, and want to exert their own intuition and energy on a compute problem, we want to provide those capabilities. So it's not about us, it's about the ability for our customers to exert what is important to them, and get a significant advantage in the marketplace for their business. >> I think it's important to point out too for our audience, it's not just a technology problem. The security regimes in organizations for years has fallen on IT and security practitioners, and we wrote a piece several years ago on Wikibon Research, that bad user behavior is going to trump good security every time. And so it's everybody's responsibility. I mean it sounds like a bromide, but it's so true, and it's really part of the complete solution. You know, I mean, I presume you agree. >> Totally. Going back to the CISO Advisory Board, one of the challenges they pointed out is user accountability. That's one of the CISO's biggest challenges. It's not just technology. It's how can they train the users and make them responsible and somehow hold them accountable. I thought that was a really very interesting insight we didn't talk about before. >> Yeah, you don't want to hear my bad, but unfortunately you do. Well, we were kind of kidding before we got started, we said, "We've got an hour to chat." It seems like it was just a matter of minutes and so thank you for taking time. We could talk an hour, I think. >> Monzy: Oh easy. >> Fascinating subject. And we thank you both for your time here today, and great show. >> [Haiyan And Monzy] Thank you for having us. >> Haiyan: It's always a pleasure to be here. >> You bet, all right, thank you Haiyan and Monzy. Back with more of theCUBE here covering .conf2017 live in Washington DC.

>> Announcer: Live from Washington D.C., it's the Cube. Covering .conf2017. Brought to you by Splunk. >> Welcome back, here on the Cube along with Dave Vellante, I am John Walls. We're live at .conf2017, as Splunk continues with day two of its get together here the nation's capital, Washington D.C. Home game for me, I love it. Dave's up the road in Boston, so, hey, you had to hit the road a little bit, but not as bad as it can be sometimes for you. >> No, I'll take D.C. over Vegas. Sorry, Vegas. >> Yeah, but you travel a lot, man, you do, you're on the road. Chris Kurtz travels a lot, too. He's come with us from Arizona State University, he's a systems architect out there. Chris, always good to see you, we had a chance to visit last year for the first time. >> Yep. >> A member of the Splunk trust. And a gentleman with quite a diverse background, I mean. You supported Mars missions. As far as the... >> The Spirit and Opportunity. >> Facilitated out in Phoenix. Working now, as you said, at Arizona State, but also the Trust. Let's talk about that a little bit, because there was some conversation yesterday from the keynote stage about expanding that group? >> Absolutely. >> Adding 14 new members. And for a lot of people at home, who might not be familiar with the Splunk trust, talk about the concept and how you put it into practice. >> Absolutely, so, the Splunk trust is the organization that Splunk set up as a community leader, as a community activist. Our, kind of, watch word is, is that, "We're not the smartest people in the room, "but we'll be the most helpful." and, so, our purpose is... >> John: I'm not sure about that first part, too, by the way. >> Thank you, very much. >> John: I think you're short-changing yourself. >> So, our organization preface is we act as members of the community to help direct community people who have issues and help them externally, but also, to help Splunk and what direction they should go. "Hey, we see this pain point from a lot of the customers, "this is something that maybe Splunk should concentrate on." We're often given access to betas or even earlier, or, you know, even potential products. It's, "How should we build this, is this something that "you would use? "Is this something that you would like?" Table data sets was a feature that I worked on for a year, that was released last year. You know, "Is this something that you would use, "is this something that you would want?" and, sometimes, you know, users fall through the cracks in the support system and they don't know how to get support help, or they don't know where to get directed, and we can volunteer and say, you know, "Show them where the Splunk answers group is very powerful." There's an app for that, we can show them Splunkbase and help them when those things fall through the cracks. So, we provide community enrichment and support, but we're not an official representative of Splunk, even though we're appointed by Splunk on a year-to-year basis. >> John: There aren't that many of ya, right? >> Well, there's a couple, 42 this time. And, you serve for a year and it can be renewed each year, you reapply. Or you can be volunteered, you know, somebody else can... >> Nominate you. >> Can nominate for us. And there's no guarantee. We, the members of the trust vote and then that goes to Splunk and Splunk makes the final decision. Some companies allow that, some don't, it depends. ASU is very generous and let's me participate and give them my time to the organization. >> And I said ASU, Arizona State University. >> That's what I was thinking. >> I never fully introduced that, I'm sorry. >> What do you have to do to qualify and what's the hurdle? >> So, be the most helpful person in the room, that's what you need to do to qualify. So you need to be a part... You can't work for Splunk, you have to be a partner or a customer, and you need to give to the community in some way. So, you need to give back to the community. You participate on Answers, which is the online, kind of, self-support forum. You need to speak in the community, maybe run a user group, a lot of us do run the user groups. I run the user group in Arizona. And, you need to be respected amongst the community and, people go, you know, "I want to go to them, "they'll help me or at least get me to the right person." >> Is it predominantly or exclusively technical practitioners, or not necessarily? >> This year, they divided us in to, kind of, organizational units, so there's architects, and practitioner, and developer. So, we're all technical, but, this year we're going to have the ability to focus a little more on a specific area. You know, "What do you do for a living, "what do you do with Splunk? "Do you architect with Splunk internally, "do you just provide Splunk practice? "Are you a Splunk developer that makes apps? "How do you use Splunk on a daily basis?" And, again, there are partners as well. So, Aplura and Defense Point, I think, are both tied with four members a piece. So that's one of those things that, you know, they're going out to individual customers and helping them everyday. >> So, it's really taking this notion of a customer advisory board to a whole another level. I mean, it's not a passive, you know, group of people that, maybe, meets once a year. >> Right. >> It's an ongoing, active, organic institution essentially. >> Absolutely, we have quarterly meetings online and at those meetings a different Splunk, sometimes executives, sometimes product managers or engineering managers, you know, come and speak to us. And it can be anything from, "Hey, we're developing this "internal product and are we interested, you know, "is that useful to you?" Or, "What enhancements do you feel the product need?" Or, you know, "This is a new feature we're working on "to look and feel." I was consulted about the conf logo. "Hey, Chris, you're an average customer, "which of these four logos do you think really, you know, "kind of helps set the mood?" And, you know, did they take my advice? Does it really matter, no, but they were willing to just... I'm not associated, I'm not in the bowels of the company. >> So this isn't your logo over here? >> That is actually the one that I chose. >> Oh, excellent, I would assume so, right. >> Who organizes the quarterly meetings? >> So, the quarterly meetings are organized by Splunk in the community. There's a community group that's underneath Brian Goldfarb, who's the Chief Marketing Officer. So, he organizes the quarterly meetings. He gets to herd all the cats, because we're all across the world. You know, you have to figure out a time zone, you have to figure out where, you have to figure out when. But, most of the time, there's some suggestions. "Hey, you know, the engineering manager "for section x would like to speak." But, sometimes it's like, "Yeah, we would like to talk "to the person in charge of Search Head Clustering," for example. "We see some pain points in the community," or something like that, so, it's wide-ranging. But, you know, we're not just a group to rubber stamp anything that Splunk does, but we're also not a group to just sit there and complain about things we don't like. It's really very much a give and take. Splunk is generous and open enough to give us that access, and we take that very seriously. To be able to help guide Splunk in making their product the best it can be. It's an amazing product, I'm an evangelist, have been since I started using it. But, also, to help the customers. If the customers are having a pain point, we're probably going to hear about that first. >> Dave: When did you start using? >> I've been using Splunk for about five years. And when I started using Splunk at ASU, it had been a 50GB license and they'd just bought another 100GB, and it needed re-working, it needed architecting. So, when I came in, our chief information security officer and our VP for operations are the ones who directed me. And I said, "What do you want to grow for?" And they said, "Architect it for a terabyte, "assume it's going to take us several years to get there." So, I rebuilt the current environment and we architected it for a terabyte and here we are, four-and-a-half, five years later, we're at a terabyte. And, we're still growing and we're looking at Cloud, you know, we're looking at other use-cases. I think the biggest ship for us is that, we talked about this briefly last year, is that I work for John Rome, who's the Deputy CIO for Arizona State, and he's in charge of business intelligence and analytics. So, it is an enterprise application for data at ASU. It is not part of the security office, it's not part of operations, it's not part of depth. Those are all customers. And, so, internally those are customers and I think that's an amazing opportunity to say that, "Those are customers of mine." So, I'm not beholden to, you know, building the system so it's only useful for security, or building it so it's only useful for operations. They're my customers, and we avoid any appearance of, "Oh, I don't want to put my data in a security product. "I don't want to put my data in an operations product." Nobody questions putting their data in the data warehouse, that's the appropriate place for the data to go. So, that's the beauty of the system that we've developed, is they're both customers of mine. >> All right, so let's talk about your work at Arizona State, little bit. I don't know the size now, I'm trying to think of it, a huge... >> Chris: We're the largest single university in the United States. >> Probably what, 60,000-70,000? >> Total enrollment 104-110,000. A lot of that's online, I think we have about 78,000 or more at the main campus. But, we're the single largest university in the U.S. There are groups like the University of California that's larger overall, but not single institution. >> So, you know... >> Massive. >> Big project, yeah. Where are you now, then? What have you been using Splunk for that maybe you weren't last year when you and I had a chance to visit? >> Yeah, so, we started using it as a security product. It was brought in to make security more agile in getting that information from the operations and the networking groups, firewalls was the first thing we were brought in for. Now, we're starting to look at other use-cases, we're starting to look at edge cases. "Are we using it for academic integrity?" So, the very beginning so that we're looking at, "If a student is taking a test, are they the person "taking the test?" We're looking at it to make sure the students' accounts are safe and not compromised. We're looking at rolling out multi-factor to the university and being able to protect that. And, we're taking a lot of those functions and pushing them down to our help desk, so the help desk has all of the tools they need to be able to support the student and take care of their issue on the first call. That's really important, we have an amazing help desk organization, amazing care organization. And that's the goal is, it doesn't matter how long the call takes, you do that on the first call. And Splunk is a key portion of that to be able to provide them with the right information. And they don't have to go and try to get somebody from network engineering just to solve the student problem, they can see what the problem is from the beginning. >> Academic integrity, explain that. >> Yeah, so, you know, I don't think that there's any student who doesn't want to do their own work and do the best possible thing they can. But, sometimes, students get in a position where they need some help and, maybe, that isn't always exactly what they should do. So, you need to make sure that the student is taking the test that they're signed up for, that they didn't have any assistance, especially in online classes. We need to keep our degree important and valid, and, obviously, none of our students want to, but occasionally you find somebody who hasn't done exactly what they're supposed to. And we need to be able to validate that. So, we need to be able to validate that someone did what they said they did or did the work that they said they did. It's just like, nobody wants to plagiarize, but, occasionally it does happen and we need to protect ourselves and protect the students. >> And you can do that with data? >> We can absolutely do. >> You can ensure that integrity, how? Explain that a little bit. >> A little bit, yeah. So, we look at where the student logs in from. If the login routinely from Tempe, Arizona and then, suddenly there's a login from someplace else. Oftentimes, that has nothing to do with academic integrity, that has to do with there is an account compromise. We need to protect the students' personal information, both HIPAA and FIRPA. We need to protect their privacy information, just generally available PII. So we look at when they logged in, where they logged in, how they logged in. Did the how-to factor worked? I think academic integrity is really a much smaller portion of that, I think the more thing is we need to protect those students. So, we look at how they logged in, when they logged in, what type of machine they logged in from. I mean, if you're using a Surface and you've been using a Surface to login for months and then, all of a sudden, you login from an iPhone, you might have gotten a new iPhone, but, you know, you might not have. So, we put all those pieces of information, all those launch together to build a case that, "Do we need to reset this user's password for safety?" >> But I think academic integrity's important from the brand as well, because the consumers of your students, the employers out there, they may be leery of online courses. So, to the extent that you can say, "Hey, we've got this covered, we actually can ensure "that academic integrity through data." That enhances the value of the degree and the ASU brand, right? >> Absolutely, we don't think that any student wants to do anything that they're not supposed to. It does happen, you know. >> But even if it's one, right, or even if it's the perception of the employer that it can happen? >> John: The possibility. >> Yeah, and I think that's a really good point, is that we need to protect that brand and we need to protect the students. I think protecting students is the number one thing, protecting employees is the number one thing. Everything else falls from that. >> Okay, what about other student behaviors? I mean, you're sort of trafficking around campus, maybe, food consumption, dorm living, I mean, all these kinds of things that with sensors or, what have you, you could extract reams of data? >> We're doing a lot of that. We're partnering with Amazon to look at the Amazon Echo and using them in dorms to provide them voice interface. "Echo, where is my next class?" Or, "What time does the Memorial Union open?" Or, "How late can I get a pizza," and that type of thing. We want to build an environment that's not only fun for the students, but very powerful, and uses the latest technology. >> Pricing, I want to talk pricing, all right? I dig for the one little wart in Splunk and it's hard to find. But, I've heard some chirping about pricing because pricing is a function of the volume of data. The data curve is growing, it's reshaping. What are your thoughts? What do you tell Splunk about pricing? >> So, a lot of people say, "Man, Splunk is expensive." And, I don't think Splunk is expensive. Once you've achieved a volume, it's got a good pricing structure. I think that anything that Splunk tries to do to change the pricing model is a bad direction. >> Dave: So you like it the way it is? >> I like it the way it is. I believe that we've made an investment in a perpetual-licensed product and I certainly don't think that what we're spending on it, for a maintenance year is a bad thing. And i think that we get a good value for the product. And we're going to continue to use it for years to come. >> I've always felt, like, "Your price is too high," has never been a deal-breaker for software companies. They've generally navigated through that criticism. And it's been, you know, ultimately an indicator of success more than anything else. But, your point is if the values there, you pay for it. Are you able to find ways to save money using Splunk that essentially pay for that premium? >> Absolutely, so one of the very first things we did with Splunk, is we looked at our employee direct deposit, we talked about this briefly last year. We looked at employee direct deposit and we were being targeted by a Malaysian hacking group who was using phishing emails to phish credentials from us. You know, you send an email that looks very much like a university login and says, "You need to login "and change your password or you're not going to be able "to work in an hour." A lot of employees, especially employees in areas that aren't high tech, you know, in the psychology department, they may fill-in that information and then the hackers login and change their direct deposit. And then the university ends up paying the employee again and eating those costs. Our original use-case was on-the-fly, we saved $30,000 in a single payroll run. Pretty easy to pay for Splunk when you do that. And so, that was our very original use-case. And that came from just looking at the data. "Is this useful, where are these people logging in from?" There's a change, you know, and I think that that's very important. The thing I love about Splunk is, because it's schema on demand, because there's no hard schema, and that it's use-case on demand. Is that, every single good use-case in the very beginning was standing around the water cooler, having a drink and saying, "I wonder if combine data set A, "we combine data set B, we come up with something that "nobody was asking about." And now when we something that we can help fix, we can help grow, we can make more efficient. To the question of how you deal with all that data is, you tune, you decide what data is important, you decide what data is unimportant, you clean up the logs that you don't care about. And we spent a year, we didn't buy Splunk for one year, we didn't buy a new license, or didn't buy an expansion license, because we took a year to compact and say, "Okay, all the data we're getting "from this firewall, is that all necessary, "is there anything redundant?" "Does it have redundant dates, does it have redundant "time stamps, et cetera." >> Right. >> And I pulled that information out and that just gave us a little bit of breathing room, and then we're going to turn around and take another chunk. >> Help. >> No schema on right sounds icky but it's profound. >> You mentioned the word, help, again, big word, key word. Chris Kurtz, one of the most helpful guys in the community of the Splunk. >> Thank you very much. >> Thanks for being with us, Chris Kurtz. Back with more, Dave and I are going to take a short break, about a half-hour, we'll continue our coverage here live at .conf2017. (upbeat music)

>> Announcer: Live from Washington D. C., it's the CUBE. Covering .conf2017. Brought to you by Splunk. (electronic music) >> Welcome back to the nation's capitol everybody. This is the CUBE, the leader in live tech coverage. And we're here at day two covering Splunk's .conf user conference #splunkconf17, and my name is Dave Vellante, I'm here with with co-host, George Gilbert. As I say, this is day two. We just came off the keynotes. I'm over product orientation today. George, what I'd like to do is summarize the day and the quarter that we've had so far, and then bring you into the conversation and get your opinion on what you heard. You were at the analyst event yesterday. I've been sitting in keynotes. We've been interviewing folks all day long. So let me start, Splunk is all about machine data. They ingest machine data, they analyze machine data for a number of purposes. The two primary use cases that we've heard this week are really IT, what I would call operations management. Understanding the behavior of your systems. What's potentially going wrong, what needs to be remediated. to avoid an outage or remediate an outage. And of course the second major use case that we've heard here is security. Some of the Wall Street guys, I've read some of the work this morning. Particularly Barclays came out with a research note. They had concerns about that, and I really don't know what the concerns are. We're going to talk about it. I presume it's that they're looking for a TAM expansion strategy to support a ten billion dollar valuation, and potentially a much higher valuation. It's worth noting the conference this year is 7,000 attendees, up from 5,000 last year. That's a 40% increase, growing at, or above actually, the pace of revenue growth at Splunk. Pricing remains a concern for some of the users that I've talked to. And I want to talk to you about that. And then of course, there's a lot of product updates that I want to get into. Splunk Enterprise 7.0 which is really Splunk's core analytics platform ITSI which is what I would, their 3.0, which I would call their ITOM platform. UBA which is user behavior analytics 4.0. Updates to Splunk Cloud, which is a service for machine data in the cloud. We've heard about machine learning across the portfolio, really to address alert fatigue. And a new metrics engine called Mstats. And of course we heard today, enterprise content security updates and many several security-oriented solutions throughout the week on fraud detection, ransomware, they've got a deal with Booz Allen Hamilton on Cyber4Sight which is security as a service that involves human intelligence. And a lot of ecosystem partnerships. AWS, DellEMC was on yesterday, Atlassian, Gigamon, et cetera, growing out the ecosystem. That's a quick rundown, George. I want to start with the pricing. I was talking to some users last night before the party. You know, "What do you like about Splunk? "What don't you like about Splunk? "Are you a customer?" I talked to one prospective customer said, "Wow, I've been trying to do "this stuff on my own for years. "I can't wait to get my hands on this." Existing customers, though, only one complaint that I heard was your price is to high, essentially is what they were telling Splunk. Now my feeling on that, and Raymo from Barclays mentioned that in his research note this morning. Raymo Lencho, top securities analyst following software industry. And my feeling George is that historically, "Your price is too high," has never been a headwind for software companies. You look at Oracle, you look at ServiceNow, sometimes customers complain about pricing too high. Splunk, and those companies tend to do very well. What's your take on pricing as a headwind or tailwind indicator? >> Well the way, you always set up these questions in a way that makes answering them easy. Because it's a tailwind in the sense that the deal sizes feed an enterprise sales force. And you need an enterprise sales force ultimately to be pervasive in an organization. 'Cause you can't just throw up like an Amazon-style console and say, "Pick your poison and put it all together." There has to be an advisory, consultative approach to working with a customer to tell them how best to fit their portfolio. >> Right. >> And their architecture. So yes, the price helps you feed that what some people in the last era of enterprise software used to call the most expensive migratory workforce in the world., which is the sales, enterprise sales organization. >> Sure, right. >> But what's happened in the different, in the change from the last major enterprise applications, ERPCRM, and what we're getting into now, is that then the data was all generated and captured by humans. It was keyboard entry. And so there was no, the volumes of data just weren't that great. It was human, essentially business transactions. Now we're capturing data streaming off everything. And you could say Splunk was sort of like the first one out of the gate doing that. And so if you take the new types of data, customer interactions, there are about ten to a hundred customer interactions for every business transaction. Then the information coming out of the IT applications and infrastructure. It's about ten to a hundred times what the customer interactions were. >> Yeah. >> So you can't price the, Your pricing model, if it stays the same will choke you. >> So you're talking about multiple orders of magnitude >> Yes. >> Of more data. >> Yeah. >> And if you're pricing by the terabyte, >> Right. >> Then that's going to cross your customers. >> Right. But here's what I would argue though George. I mean, and you mentioned AWS. AWS is another one where complaints of high pricing. But if, to me, if the company is adding value, the clients will pay for it. And when you get to the point where it becomes a potential headwind, the company, Oracle is a classic at this, will always adjust its pricing to accommodate both its needs as a public organization and a company that has to make money and fund R & D, and the customers needs, and find that balance where the competition can't get in. And so it seems to me, and we heard this from Doug Merritt yesterday, that his challenge is staying ahead of the game. Staying, moving faster than the cloud guys. >> Yeah. >> In what they do well. And to the extent that they do that, I feel like their customers will reward them with their loyalty. And so I feel as though they can adjust their pricing mechanisms. Yeah, everybody's worried about 606, and of course the conversions to subscriptions. I feel as though a high growth, and adjustments to your pricing strategy, I think can address that. What do you think about that? >> It's... It sounds like one of those sayings where, the friends say, "Well it works in practice, "but does it work in theory?" >> No, no. But it has worked in practice in the industry hasn't it? So what's different now? >> Okay. So take Oracle, at list price for Oracle 12C, flagship database. The price per processor core, with all the features thrown in, is something like three hundred thousand, three hundred fifty thousand per core. So you take an average Intel high end server chip, that might have 24 cores, and then you have two sockets, so essentially one node server is 48 times 350. And then of course, Oracle will say, "But for a large customer, we'll knock 90% off that," or something like that. >> Yeah, well exactly. >> Which is exactly what the Splunk guys told me yesterday. But it's-- >> But that's what I'm saying. They'll do what they have to do to maintain the footprint in the customer, do right by the customer, and keep the competition out. >> But if it's multiple orders of magnitude different. If you take the open source guys where essentially the software's free and you're just paying for maintenance. >> (laughs) Yeah and humans. >> Yeah, yeah. >> Okay, that's the other advantage of Splunk, as you pointed out yesterday, they've got a much more integrated set of offerings and services that dramatically lower. I mean, we all know the biggest cost of IT is people. It's not the hardware and software but, all right, I don't want to rat hole on pricing, but that was a good discussion. What did you learn yesterday? You've sat through the analyst meeting. Give us the rundown on George Gilbert's analysis of .conf generally and Splunk as a company specifically. >> Okay, so for me it was a bit of an eye opener because I got to understand sort of, I've always had this feeling about where Splunk fits relative to the open source big data ecosystem. But now I got a sense for what their ambitions are, and what their tactical plan is. I've said for awhile, Splunk's the anti-Hadoop. You know, Hadoop is multiple, sort of dozens of animals with three zookeepers. And I mean literally. >> Yeah. >> And the upside of that is, those individual projects are advancing with a pace of innovation that's just unheard of. The problem is the customer bears the burden of putting it all together. Splunk takes a very different approach which is, they aspire apparently to be just like Hadoop in terms of platform for modern operational analytic applications, but they start much narrower. And it gets to what Ramie's point was in that Wall Street review, where if you take at face value what they're saying, or you've listened just to the keynote, it's like, "Geez, they're in this IT operations ghetto, "in security and that's a La Brea tar pit, "and how are they ever going to climb out of that, "to something really broad?" But what they're doing is, they're not claiming loudly that they're trying to topple the giants and take on the world. They're trying to grow in their corner where they have a defensible moat. And basically the-- >> Let me interrupt you. >> Yeah. >> But to get to five billion >> Yeah. >> Or beyond, they have to have an aggressive TAM expansion strategy, kind of beyond ITOM and security, don't they? >> Right. And so that's where they start generalizing their platform. The data store they had on the platform, the original one, is kind of like a data lake in the sense that it really was sort of the same searchable type index that you would put under a sort of a primitive search engine. They added a new data store this time that handles numbers really well and really fast. That's to support the metrics so they can have richer analytics on the dashboard. Then they'll have other data stores that they add over time. And for each one, you're able to now build with their integrated tool set, more and more advanced apps. >> So you can't use a general purpose data store. You've got to use the Splunk within data. It's kind of like Work Day. >> Yeah, well except that they're adding more over time, and then they're putting their development tools over these to shield them. Now how seamlessly they can shield them remains to be seen. >> Well, but so this is where it gets interesting. >> Yeah. >> Splunk as a platform, as an application development platform on which you can build big data apps, >> Yeah. >> It's certainly, conceptually, you can see how you could use Splunk to do that right? >> And so their approaches out of the box will help you with enterprise security, user, they call it user behavior analytics, because it's a term another research firm put on it, but it's really any abnormal behavior of an entity on the network. So they can go in and not sell this fuzzy concept of a big data platform. They said, they go in and sell, to security operations center, "We make your life much, much easier. "And we make your organization safer." And they call these curated experiences. And the reason this is important is, when Hadoop sells, typically they go in, and they say, "Well, we have this data lake. "which is so much cheaper and a better way "to collect all your data than a data warehouse." These guys go in and then they'll add what more and more of these curated experiences, which is what everyone else would call applications. And then the research Wikibon's done, depth first, or rather breadth first versus depth first. Breadth first gives you the end to end visibility across on prem, across multiple clouds, down to the edge. But then, when they put security apps on it, when they put dev ops or, some future big data analytics apps as their machine learning gets richer and richer, then all of a sudden, they're not selling the platform, because that's a much more time-intensive sale, and lots more of objectives, I'm sorry, objections. >> It's not only the solutions, those depth solutions. >> Yes, and then all of a sudden, the customer wakes up and he's got a dozen of these things, and all of a sudden this is a platform. >> Well, ServiceNow is similar in that it's a platform. And when Fred Luddy first came out with it, it's like, "Here." And everybody said, "Well, what do I do with it?" So he went back and wrote a IT service management app. And they said, "Oh okay, we get it." Splunk in a similar way has these depth apps, and as you say, they're not selling the platform, because they say, "Hey, you want to buy a platform?" people don't want to buy a platform, they want to buy a solution. >> Right. >> Having said that, that platform is intrinsic to their solutions when they deliver it. It's there for them to leverage. So the question is, do they have an application developer kit strategy, if you will. >> Yeah. >> Whether it's low code or even high code. >> Yeah. >> Where, and where they're cultivating a developer community. Is there anything like that going on here at .conf? >> Yeah, they're not making a big deal about the development tools, 'cause that makes it sound more like a platform. >> (laughs) But they could! >> But they could. And the tools, you know, so that you can build a user interface, you can build dashboards, you can build machine learning models. The reason those tools are simpler and more accessible to developers, is because they were designed to fit the pieces underneath, the foundation. Whereas if you look at some of the open source big data ecosystem, they've got these notebooks and other tools where you address one back end this way, another back end that way. It's sort of, you know, you can see how Frankenstein was stitched together, you know? >> Yeah so, I mean to your point, we saw fraud detection, we saw ransomware, we see this partnership with Booz Allen Hamilton on Cyber4Sight. We heard today about project Waytono, which is unified monitoring and troubleshooting. And so they have very specific solutions that they're delivering, that presumably many of them are for pay. And so, and bringing ML across the platform, which now open up a whole ton of opportunities. So the question is, are these incremental, defend the base and then grow the core solutions, or are they radical innovations in your view? >> I think they're trying to stay away from the notion of radical innovation, 'cause then that will create more pushback from organizations. So they started out with a google-search-like product for log analytics. And you can see that as their aspirations grow for a broader set of applications, they add in a richer foundation. There's more machine learning algorithms now. They added that new data store. And when we talked about this with the CEO, Doug Merritt yesterday at the analyst day, he's like, "Yes, you look out three to five years, "and the platform gets more and more broad. "and at some point customers wake up "and they realize they have a new strategic platform." >> Yeah, and platforms do beat products, and even though it's hard sell, if you have a platform like Splunk does, you're in a much better strategic position. All right, we got to wrap. George thanks for joining me for the intro. I know you're headed to New York City for Big Data NYC down there, which is the other coverage that we have this week. So thank you again for coming on. >> Okay. >> All right, keep it right there. We'll be back with our next guest, we're live. This is the CUBE from Splunk .conf2017 in the nation's capitol, be right back. (electronic music)

>> Announcer: Live from Washington, DC it's theCUBE. Covering .conf2017. Brought to you by Splunk. >> Welcome back here on theCUBE continuing our coverage of .conf2017 sponsored by Get Together in your nations capitol, we are live here at the Walter Washington Convention Center in Washington, DC. Along with Dave Vellante I'm John Walls Joined now by a couple CUBE alums, actually, you guys were here about a year ago. Yeah, Robert Herjavec, with the Herjavec Group of course you all know him from Shark Tank fame answer Atif Ghauri who is the VP of Customer Service Success at the Herjavec Group. I love that title, Atif we're going to get into that in just a little bit. Welcome. >> Thank you. >> Good to see you all. >> We're more like CUBE groupies We're more like CUBE groupies. >> Alums. >> Alums, okay, yeah. >> If we had a promo reel. >> Yeah, we love it here. We get free mugs with the beautiful Splunk. >> That doesn't happen all the time does it. >> Where did you get those? >> They're everywhere. >> Dave, I'll share. >> So again for folks who don't, what brings you here what, what's the focus here for the Herjavec Group in in terms of what you're seeing in the Splunk community and I assume it's very security driven. >> Yeah, well we've been part of the Splunk community for many years going on gosh, eight, nine years. We're Splunkers and we use Splunk as our core technology to provide our managed service and we manage a lot of customer environments with Splunk and we've been really forefront of Splunk as a SIM technology for a long time. >> Atif, excuse me, David, just the title, VP of Customer Service Success, what's under that umbrella? >> Yeah, it's actually pretty simple and straightforward given especially that Splunk's aligned the same way. Christmas success is King, right. If our customers aren't successful then how are we successful? So what we're trying to do there is putting the customer first and help in growing accounts and growing our services starting with our customers that we have today. >> It was actually Doug Maris, I have to give him full credit him and I were on a flight, and I said to him what's really critical to you growing revenue, efficiency, innovation and he said, number one for us is customer success. So we're very happy to steal other people's ideas if they're better. >> So security's changing so fast. You mentioned SIM, Splunk's narrative is that things are shifting from a traditional SIM world to one of an analytic driven remediation world. I wonder if you could talk about what you're seeing in the customer base, are people actually shifting their spending and how fast and where do you see it all going? >> Yeah, so the days of chasing IOC's is a dead end. Because that's just a nonstop effort. What's really happening now is technique detection. Defining, looking at how hackers are doing their trade craft and then parroting that. So Splunk has ideas and other vendors have ideas on how to go about trying to detect pattern recognition of attacker trade craft. And so what definitely was driving what's next when it comes to security automation, security detection, for our customers today. >> You know, we always tell people and it's just dead on but the challenge is people want to buy the, sexy, exciting thing and why I always try to say to customers is you're a dad and you have three kids, and you have a minivan. You don't really want to own a minivan, you want a really nice Ferrari or Corvette but at the end of the day, you have three kids and you got to get to the store. And in the security world it's a little bit like that. People talk about artificial intelligence and better threat metrics and analytics but the core, foundational basis still is logs. You have to manage your log infrastructure. And the beauty of Splunk is, it does it better than anyone and gives you an upstream in fact to be able to do the analytics and all those other things. But you still got to do the foundation. You still got to get three kids into the minivan and bring back groceries. >> So there's been a lot of focus, obviously security's become a Board level topic. You hear that all the time, you used to not hear it all the time, used to be IT problem. >> Absolutely, the only way I could get a meeting with the CEO or CIO was because I was on Shark Tank. But as a security guy, I would never meet any executives. Oh yeah I spend 80% of my time meeting with CEO, not just CIO's, but CEO's and Boards and that kind of stuff, absolutely. >> How should the CIO be communicating the Board about security, how often, what should be the narrative you know, transparency, I wonder if you could give us your thoughts. >> It's a great question. There's a new financial regulation that's coming out where CISO's and CIO's actually have to sign off on financial statements related to cyber security. And there's a clause in there that says if they knowingly are negligent, it carries criminal charges. So the regulations coming into cyber security are very similar to what we're seeing and Sarbanes Oxley like if a CEO signs an audit statement that he suspects might have some level of negligence to it I'm not talking about outright criminal fraud but just some level of negligence, it carries a criminal offense. If you look at the latest Equifax breach, a lot of the media around it was that there should be criminal charges around it. And so as soon as as you use words like criminal, compliance, audit, CEO's, executives really care. So the message from the CIO has to be we're doing everything in our power, based on industry standards, to be as secure as we can number one. And number two we have the systems in place that if we are breached, we can detect it as quickly as possible. >> So I was watching CNBC the other day and what you don't want to see as a Board member, every Board members picture from Equifax up there, with the term breach. >> Is that true? >> Yeah, yeah. >> See, but, isn't that different. Like you never, like if we think back on all the big breaches, Target and Sony they were all seminal in their own way. Target was seminal because the CEO got fired. And that was the first time it happened. I think we're going to remember Equifax, I didn't know that about the Board. >> For 50 seconds it was up there. I the sound off. >> You don't want to be a Board member. >> I mean, I hate to say it, but it's got to be great for your business, first of all it's another reason not to be a public company is one more hurdle. But if you are they need help. >> They absolutely need help. And on point I don't want to lose is that what we're seeing with CISO's, Chief Information Security Officers, Is that that role's transcending, that role is actually reporting directly to in to CEO's now. Directly into CFO's now, away from the CIO, because there's some organizational dynamics that keep the CISO from telling, what's really going on. >> Fox in henhouse. >> Exactly. >> You want to separate those roles. You're you're seeing that more often. What percent of the CISO's and CIO's are separate in your experience? >> Organizations that have a mature security program. That have evolved to where it's really a risk-based decision, and then the security function becomes more like risk management, right. Just what you they've been doing for decades. But now you have a choice security person leading that charge. >> So what we really always saying theCUBE, it's not a matter of if, it's when you're going to get infiltrated. Do you feel as though that the Boards and CIO's are transparent about that? Do Boards understand that that it's really the remediation and the response that's most important now, or there's still some education that has to go on there? >> You know, Robert speaks to Boards are the time he can comment on that, but they really want to know two things, how bad is it and how much money do you need. And those are the key questions that's driving from a Board perspective what's going to happen next. >> What's worse that Equifax got breached or that Equifax was breached for months and didn't know about it. I mean, as a Board member the latter is much worse. There's an acceptance like I have a beautiful house and I have big windows a lots of alarms and a dog, not a big dog, but still, I have a dog. >> A yipper. >> Yeah, I have a yipper. It's worse to me if somebody broke into my house, was there for a while and my wife came home at night and the person was still there. That to me is fundamentally worse than getting an alarm and saying, somebody broke the window, went in, stole a picture frame. You're going to get breached, it's how quickly you respond and what the assets are. >> And is it all shapes and sizes, too I mean, we talk about big companies here you've mentioned three but is it the mid-level guys and do smaller companies have the same concerns or same threats and risks right now? >> See these are the you heard about. What about all the breaches you don't know. >> That's the point, how big of a problem are we talking about? >> It's a wide scaling problem right and to the previous question, the value now in 2017, is what is the quality of your intelligence? Like what actions can I take, with the software that you're giving me, or with the service that you're giving me because you could detect all day but what are you going to do about it? And you're going to be held accountable for that. >> I'm watching the service now screen over here and I've seen them flash the stat 191 days to detect an infiltration. >> That sounds optimistic to me. I think most people would be happy with that if they could guarantee that. >> I would think the number's 250 to 300 so that now maybe they're claiming they can squeeze that down but, are you seeing any compression in that number? I mean it's early days I know. >> I think that the industry continues to be extremely complicated. There's a lot of vendors, there's a lot of products. The average Fortune 500 company has 72 security products. There's a stat that RSA this year that there's 1500 new security start ups every year. Every single year. How are they going to survive? And which ones do you have to buy because they're critical and provide valuable insights. And which ones are going to be around for a year or two and you're never going to hear about again. So it's a extremely challenging complex environment. >> From the bad guys are so much more sophisticated going from hacktivists to whatever State sponsored or criminal. >> That's the bottom line, I mean the bad guys are better, the bad guys are winning. The white hats fought their way out to the black hats, right. The white hats are trying, trying hard, we're trying to get organized, we're trying to win battles but the war is clearly won by the by the black hats. And that's something that as an industry we're getting better at working towards. >> Robert, as an investor what's your sentiment around valuations right now and do you feel as though. >> Not high enough. >> Oh boy. >> Managed security companies should be trading way higher value. >> Do you feel like they're somewhat insulated? >> Its a really good question, we're in that space you know we're we're about a $200 million private company. We're the largest privately held, managed security company in the world actually. And so I always think every time we're worth more I think wow, we couldn't be worth more, the market can't get bigger. Because your values always based for potential size. Nobody values you for what you're worth today. Because an investor doesn't buy history an investor doesn't buy present state, an investor buys future state. So if the valuations are increasing, it's a direct correlation because the macro factors are getting bigger. And so the answer to your question is values are going to go up because the market is just going to be fundamentally bigger. Is everybody going to survive? No, but I think you're going to see valuations continue to increase. >> Well in digital business everybody talks about digital business. We look at digital business as how well you leverage data. We think the value of data is going through the roof but I'm not sure customers understand the intrinsic value of the data or have a method to actually value their data. If they did, we feel like they would find it's way more valuable and they need to protect it better. What are you seeing in that regard with customers? >> There's an explosion of data in that with IoT, internet of things, and the amount of additional data that's come now. But, to your point, how do you sequence and label data? That's been a multi-decade old question more organizations struggle with. Many have gone to say that, it's all important so let's protect it all, right. And verses having layers of approach. So, it's a challenging problem, I don't think across all our customer base. That's something that each wrestling with to try to solve individually for their companies. >> Well, I think you also have the reality though of money. So, it's easy to say all the data is important, Structured unstructured, but you look at a lot of the software and tools that you need around this floor are sold to you on a per user or per ingestion model. So, even though all your data is critical. You can't protect all your data. It's like your house, you can't protect every single component of it, you try, and every year gets better maybe get a better alarm maybe I'll get rid the yappy dog and get a Doberman you know you're constantly upgrading. But you can't protect everything, because reality is you still live in an unstructured, unsafe world. >> So is that the complexity then, because the a simple question is why does it take so long to find out if there's something wrong with your house? >> I think it's highly complex because we're dealing with people who are manipulating what we know to their benefit in ways we've never done it. The Wannacry breach was done in a way that had not been done before. If it had done before we could have created some analytics around it, we could created some, you know, metrics around it but these are attacks that are happening in a way we've never seen before and so it's this element of risk and data and then you always have human nature. Gary Moore was that the Council this morning. The writer of Crossing the Chasm, legendary book, and he said something very interesting which was Why do people always get on a flight and say, good luck with the flight, hope you fly safe. But they don't think twice about hopping in their car and driving to the grocery store. Whereas statistically, your odds of dying in that car are fundamentally greater, and it's human nature, it's how we perceive risk. So it's the same with security and data in cyber security. >> As security experts I'm curious and we're here in DC, how much time you think about and what your thoughts might be in the geopolitical implications of security, cyber war, you know it's Stuxnet, fast forward, whatever, ten years. What are you thoughts as security practitioners in that regard? >> The longest and most heated battles in the next World War, will not be on Earth, they'll be in cyberspace. It's accepted as a given. That's the way this Country is moving. That's the way our financial systems are tied together and that's the way we're moving forward. >> It's interesting we had Robert Gates on last year and he was saying you know we have to be really careful because while we have the United States has the best security technologies, we also have the most to lose with our infrastructure and it's a whole new you know gamification or game theory balance we have to play. >> I would agree with him that we have some of the best security technology in the world but I would say that our barometer and our limiter is the freedom of our society. By nature what we love about our country and Canada is that we love freedom. And we love giving people access to information and data and free speech. By nature we have countries that may not have as good a security, but have the ability to limit access to outsiders, and I'm not saying that's good by any means but it does make security a little bit easier from that perspective. Whereas in our system, we're never going to go to that, we shouldn't go to that. So now we have to have better security just to stay even. >> To Dave's point talking about the geopolitical pressures, the regulatory environment being what it is, you know legislators, if they smell blood right, it in terms of compliance and what have you, what are you seeing in terms of that shift focus from the Hill. >> Great question. I did a speech to about two thousand CIO's, CISO's not long ago and I said, how many people in this room buy security to be more secure and how many people buy because you have to be compliant. 50/50, even the security ones admitted that how they got budget was leveraging the compliance guys. It was easier to walk into CEO's office and say look, we have to buy this to meet some kind of a political, compliance, Board issue. Than it was to say this will make us better. Better is a hard sell. So that, has to go to the head to pull the trigger to do some of that. >> You know, I think in this geopolitical environment it's look at the elections, look at all the rhetoric. It's just there is going to be more of that stuff. >> A lot's changed in crypto and its potential applications in security. More money poured into ICO's in the first half than venture backed crypto opportunities. >> There are practical applications of blockchain technology all across the board, right, but as you mentioned is fundamentally built on pathology. On core gut security work and making a community of people decide whether something's authentic or not. It's a game changer, as far what what we could do from a platform standpoint to secure our financial systems and short answer it's volatile. As you saw with the fluctuation of Bitcoin and then the currency of Bitcoin, how it's gone up and down. It's quite volatile right now because there's a lot of risk So I say what's the next Bitcoin in six months or eighteen months and what's going to happen to the old Bitcoin and then all the money that into there, where is that going to go? So that's a discuss the pivot point I think for the financial services industry and more and more their larger institutions are just trying to get involved with that whole network of blockchain. >> Crypto currencies really interesting. In some ways it's the fuel that's funding the cyber security ransomeware. I mean it's one of the easiest ways to send money and be completely anonymous. If you didn't have crypto currency, how would you pay for ransomware? You give them your checking account? You deposit into their checking account? So, I think that you're seeing a big surge of it but if you look at the history of money or even checks, checks were developed by company called Deluxe here in the United States 104 years ago. They're a customer of ours, that's why I know this, but the basis of it is that somebody, a real institution with bricks and mortar and people in suits is backing that check, or that currency. Who's backing crypto currency today? So you have, by nature, you have this element of volatility and I don't know if it's going to make it or it's not going to make it. But inevitably has to cross from a purely electronic crypto form to some element of a note or a tender that I can take from that world and get backing on it. >> That's kind of what Warren Buffet has said about it. I mean I would respond that it's the community, whatever that means, that's backing it. I mean, what backs the greenback, it's the US Government and the US military. It's an interesting. >> Right like, at the end of the day I would still rather take a US dollar than even a Canadian dollar or a UK dollar. >> Gentlemen thanks for being with us. >> Great to see you. >> Thank you for the coffee mug. >> This is incredible. >> There's actually stuff in it too so be careful. >> I drank it is that okay? >> Can I go to the hospital. >> Atif, thanks for the time and Robert good luck with that new dog. (all laughing) >> Don't tell my wife I got rid of her dog. >> In time. >> In time. All things a time, theCUBE continues live here Washington DC at .conf2017 right after this.

(upbeat electronic music) >> Narrator: Live from Washington, D.C., it's theCUBE. Covering .conf2017. Brought to you by Splunk. >> Welcome back to the nation's capital, everybody. This is theCUBE, the leader in live tech coverage, and we're here at .conf2017. Splunk's customer event. This is the seventh year that we're covering .conf with theCUBE here in the nation's capital, in the district. I'm Dave Vellante with George Gilbert. For the wrap of day one, we'll be here for two days. George, good day overall. At Splunk, the Splunk ecosystem continues to grow. Splunk evolves as a company. We're talking about a company. We didn't really have time this morning to run this down, but it's about a 1.2 billion dollar company, growing at about 30% a year. It's got a 10 billion dollar market cap, thanks in some part to the Symantec CEO, who'd found that, hey, Splunk might be a good acquisition target. And the stock shot up there for a little bit. Fifteen thousand customers. They've got a billion dollars in cash. Zero debt. So, nice balance sheet. Good growth. Small, but meaningful positive free-cash flow. So, from a financial perspective, this Splunk's looking pretty good right now. New CEO. They had some bumps in the road in the past. Some kind of, you know, guidance issues. But all seems to be pretty good right now. From your financial analyst, put your financial analyst hat on for a second. How's the company look to you? >> I actually think the numbers look better than the, sort of, high level optics, because it's mostly subscription revenue. And, so, you're rather than get, say, one hundred dollars up front from a perpetual license, they're getting, say, 20 to 25 dollars over a period of, you know, x-many years. So that actually depresses your operating margins. >> Dave: Sure >> And so their revenue impact, and their profitability, is better than it looks. >> Dave: Am I mistaken, I thought the vast majority of their revenue was still perpetual license, right? >> George: I think they've been converting to where you pay on the throughput. How much data you ingest per day. And I think that that's, you don't pay for it all up front. >> So they're migrating to a rateable model. >> George: Yeah. >> Which is, often times, crushes companies, but they seem to be managing through that. So, anyway, that's one thing that I wanted to talk about a little bit. Some of the themes that you and I talked about this morning. There were six that you and I kind of laid out. The expansion of the total available market. Really, from a monitoring, log data, into more of an application platform. Part of that is the shift from sim, from a security standpoint, into more analytic oriented >> George: Yeah. >> activities. >> The second one was the whole cloud and hybrid cloud play. Another theme we looked at was admin and dev complexity, and Splunk's recipe for simplifying that. Machine learning. Where does that fit in? Obviously, with some of their ITOM stuff they're trying to be more proactive and anticipatory. Breadth or depth. Meaning, do they go deep within sort of an application silo. Or use case. Or do they sort of more broadly based platform. And then, the last one, number six, is sort of IoT at edge processing. George, that's not something that we were able to spend much time on this morning, or any time. So, I'd like to start there. Everyone talks about IoT. We all know that, at least in concept, all this data is going to be generated. A lot of it is stateless. We talked about that on the wikibon research meeting a couple weeks ago. With serverless. Question. Where does Splunk fit in IoT. If the strategy is to, sort of, send it all back to the cloud, is that a viable approach? And is that their strategy? >> It's not their strategy, it's what their architecture allows today. But they know that doesn't work because in a world of sort of, industrial assets, and, sort of, consumer devices, you're producing so many more devices per year and so many more data elements per device, per time period, that the amount of data is exploding, exponentially. You cannot, for latency and bandwidth reasons, send that all to the cloud, to get an answer and then send it back. So, part of what's happening, and part of what Splunk is building, is the ability to capture that data. Perform low latency analytics, drive an answer to a local device, and then, what they do is, what other IoT platforms do, send up the interesting data. The stuff that doesn't fit. The stuff that you want to make sense out of, where you have to rethink your model. Your predictive model. And then that sort of research and refinement happens in the cloud. And when you think you have a good new model, you push it back out to the edge. This is, again, all theoretical. They haven't talked about it yet other than directionally. But, it's worth saying, as our distinguished CTO reminds us, that something David Floyer, 95% perhaps of the data and analytics, will happen, really the data processing will happen at the edge. More interesting, though, is the division of labor up in the cloud. It's not just retraining a model but we'll have very rich simulations. So, rather than just saying, training a self driving car to, you know, in the snow, to avoid sunlight that obscures it's view of the hazards in the road, you actually might have a simulation where you go through a whole bunch of different essentially, edge conditions >> Dave: Mmm-hmm. >> So the models get very, very rich. And then, those get pushed down to the edge for local processing. >> David: End-end learning is iterative >> George: Yes, yes. >> And that continues >> George: Yes. >> And, OK, so that's cool. That sort of leads to the discussion of cloud and hybrid cloud. We heard even from AWS that much of the processing and analysis can occur on-prem and their model. It's not something that just has to get done in the AWS cloud. Interesting to hear AWS acknowledge that. Whereas, five, six years ago, their dogma was everything goes into the cloud. So they're learning and evolving along with their partners. But what about Splunk's cloud play. Years ago, they announced, you know, cloud offering. We talked earlier much more of their revenue coming from routable models. I think 50% of their new business is cloud only. >> Mmm-hmm. >> Which makes sense. A lot of data analysis is going on in the cloud. What's your sense of their cloud strategy? Is it working? Are you sanguine toward their approach? >> So, we've had, since the dawn of the Pleistocene era in computing we've had multiple platforms. And there has always been a desire to have a common development and runtime environment across different platforms. So that developers are not locked in, or so that they can have a common platform for building apps across platforms >> David: Mmm-hmm. >> And for running them. The same, so like that you had, part of Cisco's success and Oracle's success was that you had the same admin experience no matter what you were running on. >> Dave: So, Linux, obviously. >> Yes >> Dave: Addressed what UNIX never could. >> Yes, yes >> Was the promise of UNIX. Obviously some of Microsoft's ascendancy was given that, you know, binary compatibility with Windows. >> George: Yes. >> OK, so, will we achieve that with cloud. It looks like we're further away from that than ever. >> George: There's choices here. Where, with Splunk, they will have this self contained environment that can run on many platforms. They're run on-prem. They'll have some subset that runs on the edge. They'll have something that runs compatably on Azure and Amazon and Google. But, once they're on the cloud they're these really powerful centrifugal forces that are pulling apart the compatibility of that singular platform. Because you'll have very specialized services. For instance, if you're doing IoT with Amazon, you have the kinesis firehose service, that's pumping data into Splunk or into S3 where other services might be operating on it. Whereas, with Azure you might have different edge services pumping data into could be Splunk, could be Splunk plus other services. For instance, Splunk doesn't have really strong scale-out SQL database. Where you might want to do some advanced analytics as part of your predictions. >> Dave: OK, so I could leverage DynamoDB as an example, or something like that. >> Yes. Yeah. >> Dave: OK. >> Or Redshift on Amazon. Or snowflake as cross platform. That sort of thing. >> Dave: OK, good. Are you here? You're here tomorrow? Yes? >> Yeah. >> At least in the morning? >> Yeah >> OK, homework assignment tonight. Were you participating in the analyst event today? >> Yeah >> OK, so you've got some other inside >> Yeah >> So bring all the NDA stuff. Tonight, like I say, homework assignment, try to distill that down. Would love to have you back if you have the time at the open tomorrow. >> If I have the time. Dave, I flew across the country to sit next to you. >> That's awesome. >> Ha ha ha. >> Great. Alright. Good. So boil it down for us. Tomorrow, why don't you come on and take us through what you learned yesterday Maybe some of the product announcements. And give us your the George Gilbert, kind of, wikibon view of the future for Splunk and this industry, OK? >> OK >> Alright, great. Thank you George for helping me wrap. That is a wrap of day one today. This is theCUBE. We're live all day tomorrow. Watch the replays at siliconangle.tv. Check out siliconangle.com for all the news. Check out wikibon.com for all the research. And go to Twitter. The hashtag of this event is #splunkconf17 and also checkout hashtag #cubegems and you'll see the snippits of today's show. This is theCUBE. The leader in live tech coverage. We're out day one. From the District. See you tomorrow. (upbeat electronic music)

>> Announcer: Live from Washington, D.C., it's theCUBE, covering .conf2017. Brought to you by Splunk. >> Welcome back. Here on theCUBE, we continue our coverage of .conf2017, Splunk's get together here with some 7,000 plus attendees, 65 countries, we're right on the showfloor. A lot of buzz happening down here and it's all good. Along with Dave Vellante, I'm John Walls. We are live, as I said, in our nation's capital, and we're joined by a guest who represents her organization that is a member of the Splunk4Good program. We're going to explain that in just a little bit, but Sherrie Caltagirone is the founder and executive director of the Global Emancipation Network, and Sherry, thanks for being with us. We appreciate your time. >> Thanks so much for having me on, John. >> So your organization has to do with countering and combating global trafficking, human trafficking. >> That's right. >> We think about sex trafficking, labor trafficking, but you're a participant in the Splunk4Good program, which is their ten year pledge to support organizations such as yours to the tune of up to $100 million over that ten years to all kinds of organizations. So first off, let's just talk about that process, how you got involved, and then we want to get into how you're actually using this data that you're mining right now for your work. So first off, how'd you get involved with Splunk? >> Absolutely. It was really organic in that it's a really small community. There are a lot of people in the tech space who I found really want to use their skills for good, and they're very happy to make connections between people. We had a mutual friend actually introduce me to Monzy Merza, who's the head of security here at Splunk, and he said, "I'm really passionate about trafficking, I want to help "fight trafficking, let me connect you with Corey Marshall "at Splunk4Good." The rest is really history, and I have to tell you, yes, they have pledged up to $100 million to help, and in products and services, but what's more is they really individually care about our projects and that they are helping me build things, I call them up all the time and say, "Hey let's brainstorm an idea, "let's solve a problem, "let's figure out how we can do this together, and they really are, they're part of my family. They're part of GEN and Global Emancipation Network. >> That's outstanding. The size of the problem struck me today at the keynote when we talked about, first off, the various forms of trafficking that are going on; you said up to two dozen different subsets of trafficking, and then the size and the scale of 25 to 40-some million people around the globe are suffering. >> Yeah. >> Because of trafficking conditions. That puts it all in a really different perspective. >> You're right. Those weren't even numbers that we can really fathom what that means, can we? We don't know what 20 million looks like, and you're right, there's such a wide discrepancy between the numbers. 20 million, 46 million, maybe somewhere in between, and that is exactly part of the problem that we have is that there is no reliable data. Everyone silos their individual parts of the data that they have for trafficking, all the the different stakeholders. That's government, NGOs, law enforcement, academia, it's all kinds. It runs the gamut, really, and so it's really difficult to figure out exactly what the truth is. There's no reliable, repeatable way to count trafficking, so right now it's mostly anecdotal. It's NGOs reporting up to governments that say, "We've impacted this many victims," or, "We've encountered so-and-so who said that the "trafficking ring that they escaped from had 20 other people "in it," things like that, so it's really just an estimate, and it's the best that we have right now, but with a datalet approach, hopefully we'll get closer to a real accurate number. >> So talk more about the problem and the root of the problem, how it's manifesting itself, and we'll get into sort of what we can do about it. >> Yeah. It's really interesting in that a lot of the things that cause poverty are the same things that cause trafficking. It really is, you know, people become very vulnerable if they don't have a solid source of income or employment, things like that, so they are more willing to do whatever's necessary in order to do that, so it's easy to be lured into a situation where you can be exploited, for example, the refugee crisis right now that's happening across Europe and the Middle East is a major player for trafficking. It's a situation completely ripe for this, so people who are refugees who perhaps are willing to be smuggled out of the country, illegally, of course, but then at that point they are in the mercy and the hands of the people who smuggled them and it's very easy for them to become trafficked. Things like poverty, other ways that you're marginalized, the LGBTQ community is particularly vulnerable, homeless population, a lot of the same issues that you see in other problems come up, creates a situation of vulnerability to be exploited, and that's all trafficking really is: the exploitation of one individual through force, coercion, fraud, position of authority, to benefit another person. >> These individuals are essentially what, enslaved? >> Yeah. It's modern day slavery. There's lots of different forms, as you mentioned. There's labor trafficking, and that's several different forms; it can be that you're in a brick factory, or maybe you're forced into a fishing boat for years and years. Usually they take away your passport if you are from another country. There's usually some threats. They know where your family lives. If you go tell anyone or you run away, they're going to kill your family, those sorts of things. It is, it's modern day slavery, but on a much, much bigger scale, so it's no longer legal, but it still happens. >> How does data help solve the problem? You, as an executive director, what kind of data, when you set the North Star for the organization from a data perspective, what did that look like, and how is it coming into play? >> Well, one of the benefits that we have as an organization that's countering trafficking is that we are able to turn the tables on traffickers. They are using the internet in much the way that other private enterprises are. They know that that's how they move their product, which in this case is sadly human beings. They advertise for victims online. They recruit people online. They're using social media apps and things like Facebook and Kick and Whatsapp and whatnot. Then they are advertising openly for the people that they have recruited into trafficking, and then they are trying to sell their services, so for example, everyone knows about Backpage. There's hundreds of websites like that. It runs the gamut. They're recruiting people through false job advertisements, so we find where those sites are through lots of human intelligence and we're talking to lots of people all the time, and we gather those, and we try to look for patterns to identify who are the victims, who are the traffickers, what can we do about it? The data, to get back to your original question, is really what is going to inform policy to have a real change. >> So you can, in terms of I guess the forensics that you're doing, or whatever you're doing with that data, you're looking at not only the websites, but also the communications that are being spawned by those sites and looking to where those networks are branching off to? >> Yeah. That's one of the things that we really like to try to do. Instead of getting a low-level person, we like to try to build up an entire network so we can take down an entire ring instead of just the low fish. We do, we extract all the data from the website that we can to pull out names, email addresses, physical addresses, phone numbers, things like that, and then begin to make correlations; where else have we seen those phone numbers and those addresses on these other websites that we're collecting from, or did this person make a mistake, which we love to exploit mistakes with traffickers, and are they using the same user handle on their personal Flickr page, so then we can begin to get an attribution. >> John: That happens? >> Absolutely. >> It does, yeah. >> Sherrie: Without giving away all my secrets, exactly. >> Yeah, I don't to, don't give away the store, here. How much, then, are you looking internationally as opposed to domestically, then? >> We collect right now from 22 different countries, I think 77 individual cities, so a lot of these websites are usually very jurisdictionally specific, so, you know, like Craigslist; you go into Washington state and click on Seattle, something like that. We harvest from the main trafficking points that we can. We're collecting in six different languages right now. A lot of the data that we have right now is from the U.S. because that's the easier way to start is the low-hanging fish. >> What does your partner ecosystem look like? It comprises law enforcement, local agencies, federal agencies, presumably, NGOs. Will you describe that? >> Yeah. We do, we partner with attorneys general, we partner with law enforcement, those are the sort of operational partners we look for when we have built out intelligence. Who do we give it to now, because data is useless unless we do something with it, right? So we we build out these target packages and intelligence and give it to people who can do something with it, so those are really easy people to do something with. >> How hard is that, because you've got different jurisdictions and different policies, and it's got to be like herding cats to get guys working with you. >> It is, and it's actually something that they're begging for, and so, it's a good tool that they can use to deconflict with each other, 'cause they are running different trafficking-related operations all the time, and jurisdictions, they overlap in many cases, especially when you're talking about moving people, and they're going from one state to another state, so you have several jurisdictions and you need to deconflict your programs. >> Okay, so they're very receptive to you guys coming to them with they data. >> They are; they really want help, and they're strapped for resources. These are for the most part, not technically savvy people, and this is one of the good things about our nonprofit is that it is a staff of people who are very tech-savvy and who are very patient in explaining it and making it easy and usable and consumable by our customers. >> So if I'm an NGO out there, I'm a non-profit out there, and I'm very interested in having this kind of service, what would you say to them about what they can pursue, what kind of relationship you have with Splunk and the value they're providing, and what your experience has been so far. >> It's been wonderful. I've been over at the Splunk4Good booth all day helping out and it's been wonderful to see not only just the non-profits who have come up and said, "Hey, I run a church, "I'm trying to start a homeless shelter for drug-addicted "individuals, how can you help me," and it's wonderful when you start to see the light bulbs go off between the non-profit sector and the tech sector, between the philanthropic organizations like Splunk4Good, the non-profits, and then, we can't forget the third major important part here, which is, those are the tech volunteers, these are the people who are here at the conference and who are Splunk employees and whatnot and teaching them that they can use their skills for good in the non-profit sector. >> Has cryptocurrency, where people can conduct anonymous transactions, made your job a lot more difficult? >> No, it hasn't, and there's been a lot of research that has gone into block chain analysis, so for example, Backpage, all the adds are purchased with Bitcoin, and so there's been a wonderful amount of research then, trying to time the post to when the Bitcoin was purchased, and when the transactions happen, so they've done that, and it's really successful. There are a couple of other companies who do just that, like Chainalysis, that we partner with. >> You can use data to deanonymize? >> That's correct. It's not as anonymous as people think it is. >> Love it. >> Yeah, exactly. We love to exploit those little things like that. A lot of the websites, they put their wallets out there, and then we use that. >> Dave: You're like reverse hackers. >> That's right. It's interesting that you say that, because a lot of our volunteers actually are, they're hacker hunters. They're threat and intel analysts and whatnot, and so, they've learned that they can apply the exact same methods and techniques into our field, so it's brilliant to see the ways in which they do that. >> Dave: That's a judo move on the bad guys. >> Exactly. How long does this go on for you? Is this a year-to-year that you renew, or is it a multi-year commitment, how does that work? >> It's a year-to-year that we renew our pledge, but they're in it for the long haul with us, so they know that they're not getting rid of me and nor do they want me to, which is wonderful. It's so good, because they help, they sit at the table with me, always brainstorming, so it's year-to-year technically, but I know that we're in it together for the long haul. >> How about fundraising? A big part of your job is, you know. >> Of course it is. >> Fundraising. You spend a lot of time there. Maybe talk about that a little bit. >> Yeah, absolutely. Some of our goals right now, for example, is we're really looking to hire a full-time developer, we want a full-time intelligence analyst, so we're always looking to raise donations, so you could donate on our website. >> John: Which is? >> Which is globalemancipation.ngo. Globalemancipation.ngo. We're also always looking for people who are willing to help donate their time and their skills and whatnot. We have a couple of fundraising goals right now. We're always looking for that. We receive a lot of product donations from companies all over the world, mostly from the tech sector. We're really blessed in that we aren't spending a lot of money on that, but we do need to hire a couple of people so that's our next big goal. >> I should have asked you this off the top. Among your titles, executive director and founder, what was the founder part? What motivated you to get involved in this, because it's, I mean, there are a lot of opportunities to do non-profit work, but this one found you, or you found it. >> That's right. It's a happy circumstance. I've always done anti-human trafficking, since my college days, actually. I started volunteering, or I started to intern at the Protection Project at Johns Hopkins University, which was a legislative-based program, so it was really fantastic, traveling the world, helping countries draft legislation on trafficking, but I really wanted to get closer and begin to measure my impact, so that's when I started thinking about data anyways, to be able to put our thumb, is what we're doing. Working. How are we going to be able to measure success and what does that look like? Then I started volunteering for a rescue operations organization; the sort of knock down the doors, go rescue people group, and so, I really liked having the closer impact and being able to feel like hey, I can do something about this problem that I know is terrible and that's why it spread. A lot of the people I worked with, including my husband, come from the cyberthreat intelligence world, so I feel like those ideas and values have been steeped in me, slowly and surely, over the last decade, so that just ages myself a little bit maybe, but yes, so those ideas have been percolating over time, so it just kind of happened that way. >> Well, you want to feel young, hang around with us. (laughing) I should speak for myself, John, I'm sorry. >> No, no, you're right on, believe me. I was nodding my head right there with you. >> Can you comment on the media coverage? Is it adequate in your view? Does there need to be more? >> On trafficking itself? You know, it's really good that it's starting to come into the forefront a lot more. I'm hearing about it. Five years ago, most of the time, if I told people that there are still people in slavery, it didn't end with the Civil War, they would stand at me slackjawed. There have been a few big media pushes. There's been some films, like Taken, Liam Neeson's film, so that's always the image I use, and that's just one type of trafficking, but I'm hearing more and more. Ashton Kutcher runs a foundation called Thorn that's really fantastic and they do a similar mission to what I do. He has been able to raise the spotlight a lot. Currently there's a debate on the floor of the Senate right now, too, talking about section 230 of the CDA, which is sort of centered around the Backpage debate anyway. Where do we draw the line between the freedom of speech on the internet, with ESPs in particular, but being able to still catch bad guys exactly. The Backpage sort of founder idea. It's really hot and present in the news right now. I would love to see the media start to ask questions, drill down into the data, to be able to ask and answer those real questions, so we're hoping that Global Emancipation Network will do that for the media and for policy makers around the world. >> Well it is extraordinary work being done by an extraordinary person. It's a privilege to have you on with us, here on theCUBE. We thank you, not only for the time, but for the work you're doing, and good luck with that. >> Thank you very much for having me on. I really appreciate it. >> You bet. That's the Global Emancipation Network. Globalemancipation.ngo right? Fundraising, always helpful. Back with more here on theCUBE in Washington D.C., right after this. (electronic beats)

(techno music) >> Announcer: Live, from Washington, D.C., it's the Cube. Covering .conf2017 brought to you by Splunk. >> Well, welcome inside the Walter Washington Convention Center here. We're at Splunk .conf2017, Washington, D.C. the nation's capital rolling out its red carpet. For Splunk, first time ever the show's been here and certainly I know from the 7000 plus who are here, so far it's a big thumbs up. John Walls and Dave Velante, and we're joined as well by Brian Goldfarb, who is the Chief Marketing officer of Splunk. And Brian, good to see you this morning sir. >> Great to be here, thanks for having me. >> Yeah, I just, Dave and I were talking about the vibe here, it's always so positive right? Anytime you're around a Splunk event. But coming here, Washington, you've got great attendance I mean your take so far on what you're feeling and what you're seeing. >> It's been unbelievable, we're so blessed with customers and users that really love our products. And helping each other and bringing them all together creates an environment that's unlike anything I've ever seen in my entire career, and I've been in this industry for a long time, I've done a lot of shows. There's an electricity, the information sharing, the conversation, and you kind of see it everywhere you go. >> Well I mean you've, came from the biggest of all shows, right? With Sales Force but, whole different vibe here, I mean really intimate. I was saying off camera this is our seventh year with the Cube. And we were following Splunk, pre IPO. >> Brian: Right. >> Now you're a you know, 1.2 plus billion dollar company, so you have to change in a lot of ways, but you're trying to keep that culture of intimacy. How do you do that as a CMO and as an organization? >> I mean ultimately that's the biggest challenge, is when you grow from a show that's 500 people to a show that's over 7000, how do you keep the roots that, about what makes it great? And intimacy is exactly the right word. How do you capture that, how do you make that real? And for us, there's a couple things. You know, one is just information sharing. It's intimate when people are talking to other people about the great use cases and things they've done with our products. Because Splunk lets you do anything, and so, when customer A says, "Oh I used to, I do it this way." And customer B sees that, it's incredible and you see that through the sessions, we talked about this before. Like so much user generated content. The second thing is all these cool kind of off the beaten paths activities. We have a thing called Boss of the Sock, and Boss of the Knock, which are curated games effectively. Big massive multi-player games, where everyone gets in the room, it started yesterday evening at 7:30 pm, it wrapped just after midnight, and you walked in, and people were glued to their screens trying to win, it's capture the flag style. It was unbelievable. And things like that help us keep it intimate. >> Well there's a lot- there's a culture of fun too, I was saying, we were talking about in the open. You know the t-shirts, take the SH out of IT, (chuckles) Me-trics, getting rid of me-trics. I mean really a lot of fun going on people dropping ping-pong balls in the one that they like the best. >> Brian: Yeah! >> So you've maintained that flavor, which is fantastic. So, what do you see as sort of the next wave of Splunk? I mean, what should we as an audience be thinking about and watching for Splunk? >> I mean for me this is the best conf ever. This is our eighth one, it's the biggest one, it's the best one. We've been able to land so many great partners. We have 71 partners here, telling there stories. We have all the different customer sessions, we just completed the keynote, which I think was absolutely fantastic, the office space parody was I think, bring-the-house-down funny. And I think that's the beginning of the future, how do we take, all the wonderful things that we see our customers doing and bring them to light, and bring them to life, in more inspirational and more personal ways? I'll give you one really great example, we talked about GEN, the Global Emancipation Network. And they're working to help, you know, help human trafficking and human slavery as much as they possibly can, which is a very large problem, and we were able to work with them and help them through our Splunk for good efforts, to give them access to software, which has contributed to the work that they're doing. And we're just honored to have been a part of that, and they're here on site and they told their story in the keynote. And I can, there's example after example after example of the good we're doing for the world, in addition to the work we're doing for companies. And I think that's where we're moving forward. How do you keep those things in lock step so you're actually contributing to the betterment of our global society. At the same time making our user's lives better. >> You know I think, an example at least that really struck me when I was listening to the keynotes, we talked about the Boss of the Sock event, you talk about your community, and the spirit you're trying to create, and continue to perpetuate, was that, the winning team was thrown together right at the last minute. And these were people from different parts, different communities, different sectors if you will. And yet they bound together, they came up with a game plan, they win and so now you've created like a sub-culture as part of the greater community, but that seems to be kind of the embodiment of your philosophy is no boundaries, no limits and let's see how big we can make our tribe, if you will. >> I think tribe is another great word, community. You know, it's a skill set, you want a language you can communicate with each other. You learn how to use Splunk, and all of the sudden you have a common language and a common bond. And team "Last Minute," which won Boss of the Knock, you can't beat, you cannot plan for those kinds of things. People came together with a common understanding of how to accomplish a task, formed instantaneous comradery, and then were able to solve difficult problems. And if you bridge that to a conversation about business, we're all trying to solve problems. Technology they say is hard, we all know it's the culture and the people that's the most difficult thing to do and if we can be something that provides technology that helps drive culture change and people change, that's critical in transformation, and that's one of the things, and I've only been at Splunk 10 months, that I've seen we can do with our customers and that's pretty incredible. >> That's a key part of your messaging, I wanted to make an observation, when we followed Splunk early on, during the ascendancy of the so called big data memes, Splunk never really talked about big data you just sort of did it. You know you solve problems. Now big data is sort of passe, actually you guys talk about big data, it's very interesting to me, I wonder if you could talk about that a little bit. >> You know, lots of people like to throw buzz words. Industry terminology, we try really hard to avoid really getting into it like digital transformation being one, no don't ever say that. Because it doesn't help anyone. Right, at the end of the day you have to find the problems that our customers have, build solutions to help them solve that, and it turns out when big data was the hype, that wasn't the problem that customers have. But with the explosion in data over the last decade that continues to grow, we are actually now seeing true big data style problems. And that's why in the keynote we talked about scale, and how today's scale and tomorrow's scale is just table stakes, because you have to continue to grow to meet that. And so as the machine data company, really trying to make sure people get value out of this machine data, and turn those, that data into answers and get the insights they need to take action, that's the future. And with big data, because it's no longer buzzy, there's new buzz words we can avoid. >> Dave: It just is. >> It just is, everyone has a ton of data. >> I think the point you're making about digital transformation is interesting. We do over a hundred of these a year and every, the vast majority of digital transformation with no meat on the bone. And to us, a digital business is, is one that leverages it's data. So when you think about the evolution of Splunk, it's all about leveraging data and we're seeing, do you envision a Splunk where Splunk actually becomes that development platform for applications which has been the nirvana of so-called big data for years, it appears that Splunk is becoming just that. >> I think that's part of our long-term strategy, in that, the beginning of that already exists. Splunk base has over 1200 apps that extend the Splunk platform already, and those apps do anything from make it easier to ingest data from different data sources, to visualize data through interesting dash boards, to customized searches. A great example, ransomware, we talked about it in the keynote, super hot topic in the industry. Something that's affecting the world at large and something we want to make sure we're helping people deal with, we launched a new product called Splunk Insights for Ransomware, which is just an app built on top of Splunk, that gives you better dash boarding, better searching and better licensing for customers to get in, pay per user, get started really fast and solve that particular problem. And we see that as really really critical, as we evolve our strategy to address these transformative types of things, and the application ecosystem that comes with them. >> We saw this in the demos, another buzz word of course machine learning, but we saw an application of machine learning to dramatically learning to simplify the number of events I have to look through as a security professional and map those to you know, actual problems that I can solve. Again, another application, practical application of Splunk at play. >> Meat on the bone, you said it. So at the end of the day, this is a user conference, and our users use the product every day, and if we're not giving them real value, they're going to let us know. We put tons of energy into that. >> How about the ecosystem, the message to the ecosystem. What is the message to those guys, what are the sort of swim lanes you guys will develop applications versus their opportunities? >> I think that's emerging, I think we're still learning how to work with our ecosystem. We're so blessed with an amazing ecosystem, a huge community of participants. We talked about the Splunk trust. This core group of 42 people, we inducted 14 new ones today who really embody everything that is so great about our company and our customers and what they do for their constituents. And they are helping us think through you know, where can you build, how do you build and who should build, and getting that real time feedback. And all the partners that are here right, are adding value. And that's our goal, create the platform so that we can solve everyone's machine data challenges at scale so they can provide better answers and ultimately more value to their company. >> So getting a little personal then, you mentioned first show, >> First show. >> You coming into this, so you inherit this seven year machine right? Growing, expanding and so your perspective coming into that, what have you brought, you think or you're seen as an outsider who's now an insider, and maybe leverage the culture that was being created to take us to where we are here this year here in D.C.? >> One of the main reasons I came to Splunk, was my extremely positive impression of the product, and the brand, and the customer community around it. My entire history, at Microsoft and Google, Cloud Platform and Sales Force, was predicated on customers who love the products. You can't create that, right, you earn that through amazing work, and amazing technology. And being able to walk in here at Splunk and already have that, was the gift that really got me excited. And so you talk about coming in, and what you already have I got handed the best thing ever. Hundreds of thousands, millions of users that are excited about our product. And so what I wanted to bring was not a lot of change in the culture, it's more how do you maintain that intimacy, how do you keep the what makes Splunk, Splunk and then do that on a grander scale? And I think if you look at .conf this year, this embodies the vision that I've had with my team and with the company on how to bring .conf, I'm sorry, bring Splunk to life in a massive way. And this is, you know you can see around us, all the activity going on, it's pretty amazing. >> How about the choice of the district? You know, love the venue, love being in D.C. always, of course east-coast guys, your backyard. >> John: It's a home game for me, yeah love that. >> Brian: I'm 20 minutes away, I love it. >> But so obviously a lot of government clients, they you know, don't go to Vegas or can't go to Vegas, it's a strong community here, very advanced. Talk about that choice. >> Yeah, very thoughtful choice. We do a lot of business with the federal government. We do a lot of business with state and local officials. We do a lot of business with education and universities. And so we thought coming to D.C. was the perfect place to really embrace the public sector in America. But also an amazing venue, weather's cooperated for the most part, all the things you would want. And what we've seen with the program, is we've had more public sector attendance which is great to be able to give them more skills. The work we do with veterans, we talked about giving free training to our service men and women. And veterans service men and women which is super important to us as a company, that was a big honor to be able to do it here in D.C. Kind of a no-brainer for us, and also seeing how the rest of the community has come, it's a lot of west-coast American folks, we have people from 65 countries from all over the world that have all descended here, and it's been really really incredible. So it's been really good for us, and as we think through next venues and future years, I think there's a lot really exciting things to come. But being in D.C. is an honor for the company, and it's been great to see the turnout. >> Hey my last question, several years ago Gartner came up with the stats, said CMO was going to spend more than the CIO on technology. I don't know if that ever came to fruition but it was an interesting prediction. As a CMO, somebody who's obviously using data, for marketing, at a data company, what's the state of that what's your philosophy around data, the intersection of data and marketing? >> Yeah, I've read those Gartner articles too. The Chief Marketing Technology Officer, and you know my background is deeply technical, I was an engineer by training. And our CIO Deckland and I have an incredibly tight relationship, and I actually think that's the future. Marketing is data, and that's the big change that's happening in the marketing landscape. There's old-school marketing, advertising and things like that, that make sense and maybe be to see kind of opportunities. But if you're in a business to business universe, working with larger enterprises and governments like we are at Splunk, there's a new age of marketing that's evolved over the last decade that is predicated with operational data, that helps you make better decisions, invest more, make more personalized engagements. This doesn't have to be throw a big thing and hope someone sees it. I can engage with you and you in a personal and intimate way which aligns incredibly well with our culture and who we want to be. And so I agree it doesn't matter how you calculate the dollars or the spend or the budget, but technology is an enormous driver of modern marketing, and being at a data company makes it incredibly easy. I Splunk everything, we have dash boards, you come by my office and we have a wall of TVs with Splunk dash boards showing our social status, and we're using LinkedIn Elevate, and we see what's coming out of sales force data on sales and pipeline, all the different things so we have this real time, operational dash board that Splunk is giving us from the business side. >> I love that answer, it's not an either or with marketing and IT it's an and. >> It has to be. You just put such a sharp point on that pencil right now as you said with metrics you have all the data you need, continued success, we with you all that. >> Brian: Thank you. >> Good job getting the plane off the ground here today, and happy landing for the rest of the week. >> Brian: Thank you so much, it's an honor to be here. Thank you for joining us for your seventh year, look forward to your eighth. >> Dale: Alright, thanks for having us. >> Absolutely, thanks Brian. Brian Goldfarb, the CMO at Splunk. We're back with more here on the Cube from Washington D.C. at .conf2017, right after this. (techno music)

>> Announcer: Live from Santa Clara, in the heart of Silicon Valley, it's theCUBE. Covering Cloud Foundry Summit 2017. Brought to you by the Cloud Foundry Foundation and Pivotal. >> Welcome back. I'm Stu Miniman, joined by my cohost John Troyer. Happy to welcome back to the program, friend of theCUBE, James Watters SVP of Product at Pivotal. James, great to see you, and thanks for helping to get theCUBE to Cloud Foundry Summit. >> Yeah, I was just saying, this is the first time theCUBE is at CF Summit, so we're official now. We're all grown up. We're out in the daylight and you know you made it when theCUBE shows up, so excited to have you here. >> Absolutely. So a lot of things going on. We had Chip on talking about some of the big announcements. >> James: Yeah. >> From Pivotal's standpoint, what's some of the important milestones in releases happening. >> Yeah, I think in the simplest terms, the big new thing came out of our collaboration with Google is called Kubo, which is Kubernetes on BOSH. And I think that was a big move that got a lot of applause in the keynote when it was announced yesterday. And I think it shows two things. One is that Cloud Foundry really is going to embrace multiple ways of deploying artifacts and managing things, and that we're really the cloud native platform and willing to embrace container abstractions, app abstractions, data abstractions pretty uniquely, which is, there hasn't been another platform out there that embraces those with specialized ways of doing them. And I'm really excited about the customer response to that approach. >> Yeah, James, help us unpack that a little bit. So we look at the term seems this year, everybody, it's multi-cloud, we're all talking back-- >> James: Yeah. >> I think back to the days when we talked about platform as a service. One of the pieces was, oh, well, I should be able to have my application and move lots of places. That's what I heard when I talked about Cloud Foundry. When Docker came out everybody was like, oh PAS's dead, Docker's going to do this. When Kubernetes came out, oh wait, this takes the core value of what platform as a service has done. And today you're saying Kubo, Cloud Foundry, and Kubernetes with some BOSH, pulling it all together. Walk us through, 'cause it's nuanced. And there's pieces of that. So help us understand. >> Yeah, I like to say that even though sometimes you have open source communities have their own sense of identity, there's really not a god abstraction in cloud programming. Like there's not one abstraction that does it all. The simplest way you can see that is that people are interested in function as a service today. They're also interested in container as a service. Well, those two are not, they're not compatible. Right, like you don't deploy your whole Docker image to Amazon Lambda, but people are interested in both of those. And then, at the same time, there's this hyper growth of Spring Boot, which is, I think, the most efficient way of doing Java programming in the cloud, which is really at the core of our app abstraction. And so we see people, there's hyper growth, and function as a service, app as a service, especially with Spring Boot, and then also container. And I think the approach that we've had is beause there's not one god abstraction, that our platform needs to embrace all of those. And that actually, it's pretty intuitive, once you start using them, and you get beyond the slides and the buzz words. When to use one versus the other. And I think that's what users have been really excited about, is that Pivotal and Cloud Foundry communities embraced kind of that breadth, in terms of, different approaches to cloud native. Does that make sense to you, John? >> Yeah it's starting to, right? A lot of people like to do all or nothing about everything, right? >> James: Yeah. >> It's all going to be, we're going to be serverless by next year. And that doesn't make any sense at all. >> James: That's right. >> And so you have multiple programming models, like you said, multiple different kinds of abstractions, so when would somebody want to use, say containers, as a service, or container orchestration, versus some of the other application models. >> Yeah, it's a really, really great question. And I just had a really productive customer meeting this morning, where we went through that. They had some no-JS developers, that they said, look, these developers just want to get their code to production. They don't want to think about systems, they don't want to think about operating systems, they don't want to think about clusters. They're just like, here's my app, run it for me. And that's the core trick that Cloud Foundry's done the best of any platform in the world, which is CF Push, and so, for a no-JS developer, here's my app, run it for me, load balance it, health management, log aggregate it, give me quotas on my memory usage, everything. That's a good example of that. Then, they also had a team that was deploying Elasticsearch and some packaged applications. And they needed the level of control that Kubernetes in terms of pods, co-location, full control of a system image, the ability to do networking in certain ways, the ability to control storage. And you don't just take Elasticsearch and say here's my Elasticsearch tarball, run it for me. You actually start to set up a system, and that's where Kubernetes container as a service is perfect. Then the other question is how do you stitch those together, and you've seen the Kubernetes community adopt the Service broker API, the open Service Broker API out of Cloud Foundry, as a common way of saying, oh, I have an Elasticsearch over here, but I want to bind it to an application. Well, they use the CF services API. I think it's early days, but there's actually a coherent fabric forming across these different approaches, and it's also immediately intuitive. Like we didn't know, when we first conceived of adding Kubo to the mix, we didn't know what the educational level of education we have to provide, but it's been intuitive to every client I've talked so far, so that's fun for me to watch you say a few words like, oh, we get it. Yeah, we use that for this and this for this. >> All right, James, I have to up-level it a little bit, there. >> James: Little deep? >> You travel way more than I do. We kind of watch on social media. Prove me wrong, but i can't imagine when you're talking in the C-suite of a Fortune 100, pick your financial, or insurance company, that they are immersed in the languages and platform discussions that the hoodie crowd is. So where are you having those discussions? >> James: Yeah. >> One of the things, I come into the show and say Pivotal and Cloud Foundry are helping customers with that whole digital transformation. >> James: We are. >> And making that reality. So help us with that disconnect of, I'm down in the weeds trying to build this very complex stack, and the C-suite says, I want to be faster. >> I'll tell you what the C-suite has to solve. They've got to solve two things. One is they've got to deliver faster and more efficiently than ever before. That's their language, and our core app abstraction has been killer for digital transformation. Deliver apps faster, find your value line, and approach problems that way. They get that. That's why we've been succeeding economically, that's been a bit hit. But they also have another problem is, they want to retain talent, and when they're trying to retain talent some of those times, those folks are saying, well, we want little bit more control. We want to be able to use a container if we want, or think about something like Spring Cloud Data Flow to do high-end pipelines. And so they do care about having a partner in Pivotal and in Cloud Foundry, they can embrace those new trends. Because they've got to be able to not be completely top down in how they're enabling their organizations, while also encouraging efficiency. And so that's where the message of multiple abstractions really hits home for them, because they don't always want to referee some of the emerging trends and tech, and telling their team what they have to use. So by providing function, app, container, and data service, we can be the one partner that doesn't force that a priori in the discussion. Does that make sense? >> Is there friction ever, when saying, okay here, we've got this platform that actually is rather opinionated versus, hey, go choose everything open source and do whatever you want. I think that there's political boundaries between different parts of organization, this is a lot of what DevOps, I think, as a movement has been so important. Which is saying actually, you need to blur the political boundaries in the organization to get to faster end-to-end throughput and collaboration. So I think that's definitely a reality. At the same time, the ability that we've had to embrace these different approaches allows the level of empowerment that I think is appropriate. Like I think what we've been trying to do is not necessarily cater to a free-for-all, we've been saying, what are the right tools in the tool chest that people need to get their job done. So I think that's been very warmly received. So I guess I'd say that hasn't been a big problem for us. >> I want to ask you about the ecosystem. I think back when the ecosystem started, IBM, HPE, Cisco were big players. I come in this week, and it's Google Cloud, Microsoft Cloud, and Pivotal still is, last time I checked it was what, 70% of the code base created by Pivotal. >> James: I think it's 60 or 55 now. >> The change in the ecosystem what that means, and what that means to kind of open source, open core. >> Yeah, so I think in addition to the Kubo work that we've done, the other big news this week is that Microsoft joined the Cloud Foundry Foundation. So, essentially the largest software company in the world-- >> Wait, wait, Microsoft loves open source, I hear. Did you hear that one? >> They do. >> I know, it's still shocking for a lot of us that have known Microsoft for a long time, don't you think? And I'm not trying to be facetious, they totally are involved, I've talked to lots of Microsoft people. Kudos to them, they're doing a really good job. Even if I look at the big cloud guys and throw in VMware in there, Microsoft is one of the leaders in participating and embracing open source. >> They are and I think Corey Sanders, who got on stage, announced this, he leads the Azure virtual machine service, and a lot of the other Azure services for them, I think that their strategy is they want to run every workload. Like if you talk to Corey about it, he's like, you got workload, we want to be your partner. And I think that's been the change at Microsoft, is once you go into cloud, it's sort of like Pivotal embracing multiple program abstractions, right, once you have a platform you want as much critical mass on it as you can. And I think that's really helped Microsoft embrace the open source community in a very pragmatic way. Because they are a business, a company, right? And I think open source is required to do business in software these days, right, like in a way that it wasn't 10 years ago. As you look at your customer set and multi-cloud, right? From the very beginning multi-cloud was baked into the concept of Cloud Foundry. Like you said, just push, right? >> James: Yeah. >> So what do you see as common patterns? We've talked to folks already who, on-prem. Obviously, you all are running your CF service in partnership, your main one, your partnership with Google, You work with Amazon, what do you see in customer base, right? >> Yeah, so, let me just share a little bit from a good customer. This is a prospect conversation more, like someone who's starting the journey. They were currently running on-prem, on an OpenStack environment, which had some cost of maintenance for them. They were considering also using their vServer environment, to maybe not have to do as much customization of OpenStack. But there were certain geographies that they wanted to get into. They didn't want to build data centers. And what they were confronting was, they'd have to go learn networking and app management on a couple different clouds they wanted to use. And what they liked about our CF Fabric, across that, was that they said, oh, this is one operating model for any of those clouds. And that's the pattern that we see is that companies want to have one cloud operating model while there's five major cloud players today. So like how do those two forces in the market combine? And I think that's where multi-cloud becomes powerful. It's not necessarily multi-cloud for it's own sake, but it is the idea that you can engage and use multiple resources from these different data center providers without having to completely change your whole organization around it. Because taking on, how you run vServer versus OpenStack is different, as you know, right? >> Right, right, and talking about change, right? You and I were together at VMware when you launched this thing. >> James: Yeah. >> And there was a profound kind of conceptual chasm to leap for the VMware operators to figure out what was going on here. >> James: Yeah. >> So in this new world of services operation in multi-cloud, how are you seeing people, how's the adoption going, you just launched, or the foundation's launched its new certification stuff, can you talk a little bit about the new skill set needed, or how you're seeing people, the people formerly known as sys admins are now actually doing cloud operations. >> Well, I'm not sure if you saw Pat Gelsinger's announcement at Dell World, Dell EMC World, about developer-ready infrastructure. And I think this is a critical evolution that our partnership with VMware is more important than ever. Which is they're now saying all of these people that have been doing traditional system administration, you need to now offer developer-ready infrastructure. And this is an infrastructure that all the networking and network micro segmentation rules need to be there, all of the great things that the VMware admins have provided before needs to be there, but it needs to be turnkey for a developer. That developer shouldn't just get what we had and 2009, when you and I were working there together, which is like, here's a virtual machine, go build the rest of the environment. It should look more like, here's my application, run it for me. Here's my container, run it for me. And so what we're seeing is a lot of people upping their game now. To say, oh, the new thing is providing these services for developers 'cause that ties into digital transformation, ties into what the business is doing, ties into productivity. So I'm seeing a Renaissance of sys admins having a whole new set of tools. So that makes me excited. And one of the cool things we're seeing, I'd love to get your opinion on this is, this cool operating ratio of, we've had our clients present. Their administers of Cloud Foundry instances are able to run tens of thousands of apps in containers with two to four to five people. And so now they've got this super power, which is like, hey bring as many of the applications as the business needs to me. I can go run 10,000 app containers with a small team of people with a good lifestyle. To me, that's actually kind of incredible to see that leverage. >> Yeah, I think it's a huge shift, right? 'Cause you aren't setting up the VLANs and the micro segmentation and the rest of the stuff. >> Yeah, it's not all by hand, and so now the idea with our NSX partnership, is I'm really excited about, fun to talk to you about it. We used to work in Building E and have lunch out there, is that when you provision a CF app, we're working with the NSX team that all the segmentation will align with the app permissions. And this is a big deal, because it used to be that the network team and the app team didn't really have a good conduit of communication. So now it's like, okay I'm going to bind my app to this data service. I want NSX to make sure that permission is followed. To me, that's going to be a revolution of getting the app, and the DevOps teams and the networking teams to work together, clearly. So I'm pumped about that. >> Running low on time. A couple of quick questions about Pivotal. Number one is, now that you're doing Kubo, could we expect to see Pivotal join the CNCF? So EMC is is joining the CNCF. We have friendly relations with the CNCF, I don't think that's at all out of the cards. I just know current, I don't have any news on that today. But we've been very friendly with them, and we started working with Google on that, so no immediate plans there, but we'd be open to that, I believe. >> Okay, and secondly, my understanding, the last announcement on revenue, you can't speak to the IPO or anything, James, above your pay grade, but $275 million in billing on PCF, did I get that right? What do you see is kind of the mix of how you're revenued, are you a software company, a services company? The big data versus the cloud piece. How do we look at Pivotal going forward? >> Yeah, what'd I say is I primarily oversee the Cloud Foundry portion of what we do. And services are an incredibly important part of our mix, Pivotal labs. When you think about this developer-ready infrastructure tend, like a lot of the way you organize your developers can change too. So we talked about how the sys admins jobs change. They gets this platform scale, well the developer's job has changed now, too. They have to learn how to do CICD, they've got to learn how to potentially turn around agile requirements from the business on a weekly basis versus every six months. So Pivotal labs has certainly been critical to that mix for us. But PCF in and of itself, has been a very successful software business. And I think, I believe can grow into the billions of dollars a year in software, and that's what kind of keeps me excited about every day. >> All right, James, I want to give you the final word. You speak to so many customers. >> James: A few. >> The whole digital transformation thing, what are you seeing? How do we help customers along that moving faster. >> That's a, it's a big topic. And the thing that's really interesting about what PCF does is, that it helps people change their organizations, not just their technology. And this has certainly happened in the vServer environment, right? Like it would change your organization, but we're even going higher, which is like, how are your developers organized? How operating teams organize. How you think about security. How you think about patching. Like the reason why I agree that it's transformative, is that it's not just a change of technology, it's these new technologies allow you to rebuild your organization end-to-end, of how it delivers business results. And that makes it both a humbling and an exciting time to be in the industry, because I personally, don't have all the answers every time. People ask about organizations and what to do there. Those are complex issues, but I think we've tried to partner with them to go on that journey together. >> Unfortunately, James, we're going to have to leave it there. We will definitely catch up with you at many more events later this year. And we'll be back with more coverage here from the Cloud Foundry Summit 2017. You're watching theCUBE. (techno music)

>> Narrator: Live from San Jose, in the heart of Silicon Valley, it's theCUBE! Covering Data Works Summit 2017. Brought to you by Hortonworks. >> Welcome back to theCUBE. I'm Lisa Martin with my co-host George Gilbert. We are live on day one of the Data Works Summit in San Jose in the heart of Silicon Valley. Great buzz in the event, I'm sure you can see and hear behind us. We're very excited to be joined by a couple of fellows from IBM. A very longstanding Hortonworks partner that announced a phenomenal suite of four new levels of that partnership today. Please welcome Asad Mahmood, Analytics Cloud Solutions Specialist at IBM, and medical doctor, and Linton Ward, Distinguished Engineer, Power Systems OpenPOWER Solutions from IBM. Welcome guys, great to have you both on the queue for the first time. So, Linton, software has been changing, companies, enterprises all around are really looking for more open solutions, really moving away from proprietary. Talk to us about the OpenPOWER Foundation before we get into the announcements today, what was the genesis of that? >> Okay sure, we recognized the need for innovation beyond a single chip, to build out an ecosystem, an innovation collaboration with our system partners. So, ranging from Google to Mellanox for networking, to Hortonworks for software, we believe that system-level optimization and innovation is what's going to bring the price performance advantage in the future. That traditional seamless scaling doesn't really bring us there by itself but that partnership does. >> So, from today's announcements, a number of announcements that Hortonworks is adopting IBM's data science platforms, so really the theme this morning of the keynote was data science, right, it's the next leg in really transforming an enterprise to be very much data driven and digitalized. We also saw the announcement about Atlas for data governance, what does that mean from your perspective on the engineering side? >> Very exciting you know, in terms of building out solutions of hardware and software the ability to really harden the Hortonworks data platform with servers, and storage and networking I think is going to bring simplification to on-premises, like people are seeing with the Cloud, I think the ability to create the analyst workbench, or the cognitive workbench, using the data science experience to create a pipeline of data flow and analytic flow, I think it's going to be very strong for innovation. Around that, most notable for me is the fact that they're all built on open technologies leveraging communities that universities can pick up, contribute to, I think we're going to see the pace of innovation really pick up. >> And on that front, on pace of innovation, you talked about universities, one of the things I thought was really a great highlight in the customer panel this morning that Raj Verma hosted was you had health care, insurance companies, financial services, there was Duke Energy there, and they all talked about one of the great benefits of open source is that kids in universities have access to the software for free. So from a talent attraction perspective, they're really kind of fostering that next generation who will be able to take this to the next level, which I think is a really important point as we look at data science being kind of the next big driver or transformer and also going, you know, there's not a lot of really skilled data scientists, how can that change over time? And this is is one, the open source community that Hortonworks has been very dedicated to since the beginning, it's a great it's really a great outcome of that. >> Definitely, I think the ability to take the risk out of a new analytical project is one benefit, and the other benefit is there's a tremendous, not just from young people, a tremendous amount of interest among programmers, developers of all types, to create data science skills, data engineering and data science skills. >> If we leave aside the skills for a moment and focus on the, sort of, the operationalization of the models once they're built, how should we think about a trained model, or, I should break it into two pieces. How should we think about training the models, where the data comes from and who does it? And then, the orchestration and deployment of them, Cloud, Edge Gateway, Edge device, that sort of thing. >> I think it all comes down to exactly what your use case is. You have to identify what use case you're trying to tackle, whether that's applicable to clinical medicine, whether that's applicable to finance, to banking, to retail or transportation, first you have to have that use case in mind, then you can go about training that model, developing that model, and for that you need to have a good, potent, robust data set to allow you to carry out that analysis and whether you want to do exploratory analysis or you want to do predictive analysis, that needs to be very well defined in your training stage. Once you have that model developed, then we have certain services, such as Watson Machine Learning, within data science experience that will allow you to take that model that you just developed, just moments ago, and just deploy that as a restful API that you can then embed into an application and to your solution, and in that solution you can basically use across industry. >> Are there some use cases where you have almost like a tiering of models where, you know, there're some that are right at the edge like, you know, a big device like a car and then, you know, there's sort of the fog level which is the, say, cell towers or other buildings nearby and then there's something in the Cloud that's sort of like, master model or an ensemble of models, I don't assume that's like, Evel Knievel would say you know, "Don't try that at home," but sort-of, is the tooling being built to enable that? >> So the tooling is already in existence right now. You can actually go ahead right now and be able to build out prototypes, even full-level, full-range applications right on the Cloud, and you can do that, you can do that thanks to Data Science Experience, you can do that thanks to IBM Bluemix, you can go ahead and do that type of analysis right there and not only that, you can allow that analysis to actually guide you along the path from building a model to building a full-range application and this is all happening on the Cloud level. We can talk more about it happening on on-premise level but on the Cloud level specifically, you can have those applications built on the fly, on the Cloud and have them deployed for web apps, for moblie apps, et cetera. >> One of the things that you talked about is use cases in certain verticals, IBM has been very strong and vertically focused for a very long time, but you kind of almost answered the question that I'd like to maybe explore a little bit more about building these models, training the models, in say, health care or telco and being able to deploy them, where's the horizontal benefits there that IBM would be able to deliver faster to other industries? >> Definitely, I think the main thing is that IBM, first of all, gives you that opportunity, that platform to say that hey, you have a data set, you have a use case, let's give you the tooling, let's give you the methodology to take you from data, to a model, to ultimately that full range application and specifically, I've built some applications specific to federal health care, specifically to address clinical medicine and behavioral medicine and that's allowed me to actually use IBM tools and some open source technologies as well to actually go out and build these applications on the fly as a prototype to show, not only the realm, the art of the possible when it comes to these technologies, but also to solve problems, because ultimately, that's what we're trying to accomplish here. We're trying to find real-world solutions to real-world problems. >> Linton, let me re-direct something towards you about, a lot of people are talking about how Moore's law slowing down or even ending, well at least in terms of speed of processors, but if you look at the, not just the CPU but FPGA or Asic or the tensor processing unit, which, I assume is an Asic, and you have the high speed interconnects, if we don't look at just, you know what can you fit on one chip, but you look at, you know 3D what's the density of transistors in a rack or in a data center, is that still growing as fast or faster, and what does it mean for the types of models that we can build? >> That's a great question. One of the key things that we did with the OpenPOWER Foundation, is to open up the interfaces to the chip, so with NVIDIA we have NVLink, which gives us a substantial increase in bandwidth, we have created something called OpenCAPI, which is a coherent protocol, to get to other types of accelerators, so we believe that hybrid computing in that form, you saw NVIDIDA on-stage this morning, and we believe especially for deploring the acceleration provided for GPUs is going to continue to drive substantial growth, it's a very exciting time. >> Would it be fair to say that we're on the same curve, if we look at it, not from the point of view of, you know what can we fit on a little square, but if we look at what can we fit in a data center or the power available to model things, you know Jeff Dean at Google said, "If Android users "talk into their phones for two to three minutes a day, "we need two to three times the data centers we have." Can we grow that price performance faster and enable sort of things that we did not expect? >> I think the innovation that you're describing will, in fact, put pressure on data centers. The ability to collect data from autonomous vehicles or other N points is really going up. So, we're okay for the near-term but at some point we will have to start looking at other technologies to continue that growth. Right now we're in the throws of what I call fast data versus slow data, so keeping the slow data cheaply and getting the fast data closer to the compute is a very big deal for us, so NAND flash and other non-volatile technologies for the fast data are where the innovation is happening right now, but you're right, over time we will continue to collect more and more data and it will put pressure on the overall technologies. >> Last question as we get ready to wrap here, Asad, your background is fascinating to me. Having a medical degree and working in federal healthcare for IBM, you talked about some of the clinical work that you're doing and the models that you're helping to build. What are some of the mission critical needs that you're seeing in health care today that are really kind of driving, not just health care organizations to do big data right, but to do data science right? >> Exactly, so I think one of the biggest questions that we get and one of the biggest needs that we get from the healthcare arena is patient-centric solutions. There are a lot of solutions that are hoping to address problems that are being faced by physicians on a day-to-day level, but there are not enough applications that are addressing the concerns that are the pain points that patients are facing on a daily basis. So the applications that I've started building out at IBM are all patient-centric applications that basically put the level of their data, their symptoms, their diagnosis, in their hands alone and allows them to actually find out more or less what's going wrong with my body at any particular time during the day and then find the right healthcare professional or the right doctor that is best suited to treating that condition, treating that diagnosis. So I think that's the big thing that we've seen from the healthcare market right now. The big need that we have, that we're currently addressing with our Cloud analytics technology which is just becoming more and more advanced and sophisticated and is trending towards some of the other health trends or technology trends that we have currently right now on the market, including the Blockchain, which is tending towards more of a de-centralized focus on these applications. So it's actually they're putting more of the data in the hands of the consumer, of the hands of the patient, and even in the hands of the doctor. >> Wow, fantastic. Well you guys, thank you so much for joining us on theCUBE. Congratulations on your first time being on the show, Asad Mahmood and Linton Ward from IBM, we appreciate your time. >> Thank you very much. >> Thank you. >> And for my co-host George Gilbert, I'm Lisa Martin, you're watching theCUBE live on day one of the Data Works Summit from Silicon Valley but stick around, we've got great guests coming up so we'll be right back.

>> Narrator: Live from The Wigwam in Phoenix, Arizona, it's the CUBE. Covering Data Platforms 2017. Brought to you by Qubole. (techno music) >> Hey, welcome back everybody. Jeff Frick here with the CUBE. We are in The Wigwam Resort, historic Wigwam Resort, just outside of Phoenix, Arizona at Data Platforms 2017. It's a new Big Data event. You might say, god there's already a lot of Big Data events, but Qubole's taken a different approach to Big Data. Cloud-first, cloud-native, you're integrated with all the big public clouds and they all come from Big Data backgrounds, practitioner backgrounds. So it's a really cool thing and we're really excited to have our next guest, Colin Ridell, he's a Big Data architect from Epic Games, was up on a panel earlier today. Colin, Welcome. >> Thank you, thank you for having me. >> Absolutely, so, enjoyed your panel, a lot of topics that you guys covered. One of the ones we hear over and over again is get early wins. How do you drive adoption, change people's behaviors, it's not really a technology story. It's a human factors and behaviors story. So I wonder if you can share some of your experience, some best practices, some stories. >> So I don't know if there's really a rule book on best practices for that. Every environment is different, every company is different. But one thing that seems to be constant is resistance to change in a lot of the places, so... >> Jeff: That is consistent. >> We had some challenges when I came in. We were running a system that was on it's last legs basically, and we had to replace it. There was really no choice. There was no fixing it. And so, I did actually encounter a fair bit of resistance with regards to that when I started at Epic. >> Now it's interesting, you said a fair amount of resistance. Another one of your lessons was start slow, find some early wins, but you said, that you were thrown into a big project right off the bat. >> Colin: So, we were, yeah. >> I'm curious, how did the big project go, but when you do start slow, how small does it need to be where you can start to get these wins to break down the resistance. >> I think what we, the way we approached it was we looked at what was the most crucial process, or the most crucial set of processes. And that's where we started. So that was what we tried to convert first and then make that data available to people via an alternative method, which was Hive. And once people started using it and learned how to interact with it properly the barriers start to fall. >> What were some of the difficult change management issues? Where did you come from in terms of the technology platform and what resistance did you hit? >> So it was really a user interface was the main factor of resistance. So we were running a Hadoop cluster. It was fixed sized, it wasn't on PRaM, but it was in a private cloud. It was basically, simply being overloaded. We had to do constant maintenance on it. We had to prop it up. And it was, the performance was degrading and degrading and degrading. The idea behind the replacement was really to give us something that was scalable, that would grow in the future, that wouldn't run into these performance blockers that we were having. But again, like I said, the hardest factor was the user interface differences. People were used to the tool set that they were working with, they liked the way it worked. >> What was the tool set? >> I would rather not actually say that on camera, >> Jeff: That's fine. >> Does it source itself in Redmond or something? >> No, no it doesn't, they're not from Redmond. I just don't want to cast aspersions. >> No, you don't need to cast aspersions. The conflict was really just around familiarity with the tool, it wasn't really about a wholesale change in behavior and becoming more data-centric. >> No, because the tool that we replaced was an effort to become more data-centric to begin with. There definitely was a corporate culture of we want to be more data-informed. So that was not one of the factors that we had to overcome. It was really tool-based. >> But the games market is so competitive, right? You guys have to be on your game all the time and you got to keep an eye on what everybody else is doing in their games, and make course corrections as I understand, something becomes hot, or new, so you guys have to be super nimble on your feet. How does taking this approach help you be more nimble in the way that you guys get new code out, new functionality? >> It's really, really very easy for us now to inject new events into the game, we basically can break those events out and report on them or analyze what's going on in the game for free with the architecture that we have now. >> Does that mean it's the equivalent of, in IT operations, we instrument everything from the applications, to the middleware, down to the hardware. Are you essentially doing the same to the game so you can follow the pathway of a gamer, or the hotspots of all the gamers, that sort of thing? >> I'm not sure I fully understand your question. >> When you're running analytics on a massively multi-player game, what questions are you seeking to answer? >> Really what we are seeking to answer at the moment is what brings people back? What behaviors can we foster in-- >> Engagement. >> in our players. Yeah, engagement, exactly. >> And that's how you measure engagement, it's just as simple as, do they come back or time on game? >> That's the most simple measure that we use for it, yeah. >> So Colin, we're short on time, want to give you the last word. When you come to a conference like this, there's a lot of peer interaction, there's some great questions coming out of the panel, around specifically, how do you measure success? It wasn't technical at all. It's, what are the things that you're using to measure whether stuff is working. I wonder if you can talk to the power of being in an ecosystem of peers here. Any surprises or great insights that you've got. I know we've only been here for a couple days. >> I would say that one of the biggest values, obviously the sessions and the breakouts are great, but I think one of the greatest values of here is simply the networking aspect of it. The being able to speak to people who are facing similar challenges, or doing similar things. Even although they're in a completely different domain, the problems are constant. Or common at least. How do you do machine learning to categorize player behaviors in our case and in other cases it's categorization of feedback that people get from websites, stuff like that. I really think the networking aspect is the most valuable thing to conferences like this. >> Alright, awesome. Well, Colin Ridell, Epic Games, thanks for taking a few minutes to stop by the CUBE. >> You're welcome, more than welcome, thank you very much. >> Absolutely, alright, George Gilbert, I'm Jeff Frick, you're watching the CUBE from Data Platforms 2017 at the historic Wigwam Resort. Thanks for watching. (upbeat techno music)