>> Live from Orlando, Florida, it's theCUBE, covering .conf2018! Brought to you by Splunk. (techno music) >> Welcome back to Orlando, everybody. We're here with theCUBE covering Splunk.conf2018. I'm Dave Vellante with my co-host, Stu Miniman. Chris Crocco is here, he's the Lead Solutions Engineer at ViaSat. Great to see you, thanks for coming on theCUBE. >> Well, thanks for having me. I appreciate it. >> You're very welcome. Let's start with ViaSat. Tell us what you guys do and what your role is all about. >> So ViaSat is a global communications and technology company primarily focused on satellite-based technologies, anything from government services to commercial aviation and residential service. >> And what does a Lead Solutions Engineer do? >> My primary role is to help us kind of transition from a traditional operations state into more of a DevOps environment including monitoring, alerting, orchestration and remediation. >> Oh, we love this conversation, don't we? Okay. The basic question is, and I know it's hard, but it's subjective, it's kind of if you think about the majority of your organization in the context of DevOps, on a scale of one to five, five being nirvana, so let's assume you're not at five 'cause it never ends, right? You're constantly evolving. Where would you say you are? Are you just getting started? Are you more like a four, 4 1/2, what do you think? >> That's a good question. I would say we're probably three on our way to four. We've had a lot of growing pains, we've had a lot of learning opportunities. The processes of DevOps are getting pretty well-entrenched and right now, we're working on making sure that the culture sticks with the DevOps. >> That's critical, right? >> I mean, that's really where the rubber meets the road is that organizational and political. Without getting into the dirt of it, give us what it looked like before and where you are today. >> Sure. Prior to our shift to DevOps, which was mainly motivated by our latest spacecraft, ViaSat-2, we had a very traditional operational model where we had everything funneled through a Network Operations Center, we had a Technical Operations Team, and if they weren't able to triage and remediate issues, they kicked it over the fence to engineers and developers who would then throw something back. There wasn't a lot of communication between the two organizations, so when we did find recurring problems, recurring issues in our network and in our environment, it took a long time to get those resolved and we had to have a large volume of staff there just to kind of put out the fires. With the transition of DevOps, one of the things that we've been focusing on is making sure that our development teams, our engineering teams understand the customer experience and how it's impacted by what they do, and de-centralizing that operation structure so all of the triage work goes to the people who actually work on those services. So it's a pretty big paradigm shift but it's also helping us solve customer problems faster and get better education about what the customer experience is to the people who actually make it better. >> And roughly, what was the timeframe that it took to go from that really waterfall model to the structure that you have today? >> We've been going for about two or three years now in this transition. Like I said, the first year or so was kind of bumpy and we've really kind of ramped up over the past year in terms of the amount of teams that are practicing DevOps, the amount of teams that are in an agile and scrum model. So overall, two to three years to get to where we are today. >> So the problem with the traditional model is you have time to deployment is slower, that means time, the value is slower, a lot of re-work. Here, you take it. No, you take it. Hey, it worked when I gave it to you, a lot of back and forth, and not a lot of communication creates frustration, not a lot of collaboration and teamwork, then you're working through that now. How large is the team? >> My team is five people. We have 4,500 people roughly at ViaSat as a whole. I believe roughly 2,000 of them are in an engineering or technical role. >> Okay, but in the previous model, you had developers and you had operations folks, is that right? And your five are sort of split over those or was it a much, much larger corpus of folks? >> It was a very large distribution of people. It was very engineering and developer-centric. We still had a Core Operations Team of 60 to 100 people based in our Denver office. We're keeping our headcount relatively the same with respect to our operations and we're growing a lot in terms of those DevOps teams. So as those teams continue to grow, we're adding more operational resources to them and kind of inserting a lot of that knowledge into other parts of the organization. >> You're doing a lot more with the same. Are you coming from the ops side or the dev side? >> I come from the ops side. I actually started my career with ViaSat in our knock in Denver. From there, I transitioned into a ops analyst role and then we created the Solutions Engineering Team and I took the lead on that. >> Chris, can you tell us how Splunk plays into your DevOps? Did you start using it in the knock and kind of go from there? >> We did, actually. Splunk started out as just a tool for us to see how many modems were offline in the knock. It was up on the video wall and we would see spikes and know that there was a problem. And as we've made this transition at DevOps, a lot of teams that were using other solutions, other open-source and home-grown solutions were kind of organically pivoting to Splunk because it was a lot easier for them to use for alerting dashboards, deep-data analysis, a lot of the things they needed to do their job effectively. So as we've grown as a company, as we've grown in this organizational model, Splunk has kind of grown along with that in terms of use case. >> That growth is predominately in IT operations and security, correct? >> Well, it's actually pretty interesting. It's kind of all over the board in our organization. It started in IT operations and security, but we have people in our marketing department using it to make sales and campaign decisions. We have executive leadership looking at it to see the performance of our spacecraft, we have exploratory research being done with it in terms of what's effective and what's not for our new spacecraft that will be coming out, the ViaSat-3 Constellation. So it's really all over the board in our organization. >> That's interesting, Stu, you're not the first customer who's told us that no, it's not just confined to IT, it's actually seeping through the organization. Despite the fact that we heard a bunch of announcements today, I don't know if you saw the keynotes, making it simpler for lines of business folks to actually utilize Splunk, so given that a lot of your teams in the business are actually using it already, what do you think these announcements will do for them? Maybe you haven't had time to evaluate it, but essentially, it's making it easier for business people, you know, simplifying it. >> Yeah, you know, all of the announcements in the keynotes over the past two days have been really, really exciting. Everything that I was hoping for got checked off the list. So I think one of the big things that it's going to allow us to do is get our customer-facing teams and our customer care organizations more involved with the tool. And getting them the information that they need to better serve customers that are calling in, and potentially even prevent the situations that customers have to call in for in the first place. So giving them a lot of account information quickly, giving them the ability to access information that is PCI and PII-compliant but still allowing them to get the data they need to service an individual customer, all of those things I think are really going to be impacted by the announcements in this conf. >> So you were the keynote yesterday. >> I was! >> Were you shaking the phone? >> I was, yeah. >> Which group were you, were you orange? >> We were orange group, yeah. >> We were orange, too! But we were sitting in the media section and all the media guys were sitting on their hands but we had a lot of devs and ops guys shaking with us. It's like when you do the wave at Fenway Park when it gets behind home plate, everybody just kind of sits down, but we were plugging hard. Alright, Chris, what else has excited you about .conf2018? School stuff that you've seen, some innovations, things you've learned. >> Well, I'm really excited about the app for infrastructure. That's something that we've been trying to get for ITSI for a long time now in terms of NED-level monitoring and NED-level thresholding. I think that's going to complement our business really, really well. The advancements that they're doing with the metrics store, specifically with things like Syslog are really, really exciting. I think that that's going to allow us to accelerate our data and make it more performant. The S3 compliant storage is absolutely fantastic and it comes in black now and that's really, really fantastic. >> Oh right! The dark mode! >> Dark mode, yup. >> You mentioned the ITSI. Have you used the VictorOps pieces before or is that something you're looking to do? >> We haven't looked at VictorOps as of yet. We're an xMatters customer right now so we've been using their integration that they built out and it's on Splunk base. But VictorOps, it'll be interesting to see how that organization changes now that it's part of the Splunk. >> So dark mode actually, it's one of those things that it really got such a loud ovation. It was funny, I was actually talking to a couple Splunkers that are like, "We want that dark mode t-shirt." Which I think you have to be a user and you need to sign up for some research thing that they're doing, and they're giving out the black shirt that has like gray text on it. >> Awesome! >> Why does that resonate with you, the dark mode? >> Well, it was actually what they talked about in the keynote. If you have it up on a video wall, which we have in various parts of our company, or if you're sitting in a dark office, something like that, looking at a really white screen for a long period of time, it's not easy on your eyes, it's hard to look at for a long period of time. And generally speaking, a lot of our presentation layers go towards that visual format. So I think this is going to allow us to make it much more appealing to the people who are putting this up on screens in front of people. >> Your responsibility extends out into the field, I presume. The data that's in the field, is that true? >> It does. >> Okay, so I'm interested in your reaction to the industrial IoT announcements, how you see or if you see your organization taking advantage of that. >> Well, we're a very vertically integrated company so we actually manufacture a lot of the devices that we use and that we provide to our customers. I think a lot of our manufacturing capabilities would really benefit from that. Anything from building antennas for ground segment that actually talked to the spacecraft. It's the modems that we put in people's houses, that entire fabrication process I think would benefit a lot. I really loved the AR presentation that they did where they were actually showing the overlay of metrics on a manufacturing line. I think that's something that would be fantastic for us, particularly for sending somebody to an antenna or a ground station to replace a piece of equipment. We can overlay those metrics, we can overlay all of that, we can use the industrial analytics piece of that to actually show which piece of hardware is most affected and how best to replace that. So a lot of opportunities there for our company. >> So I wonder if you could help us understand what's, from your perspective, on Splunk's to-do list. We're going to have Doug Merritt on a little later. If you had Doug right here and he said, Chris, what can we do to make your life better? What would you tell him? >> You know, I think a couple of the things that would make it better, and it looks like they're heading this direction, is streaming in and streaming out. You know, streaming in is of course important, that's where a lot of your data lives, but you also have to be able to send that out to Kafka, to Kinesis, to other places, so other people can consume the output of what Splunk is doing. So I think that would be a really, really important thing for us to socialize the benefit of Splunk. And then vertically integrating the incident management chain, it looks like something that's on their roadmap and I'd be interested to see what their roadmap looks like in terms of pulling in Phantom, pulling in VictorOps, pulling in some of these other technologies that are now in the Splunk umbrella to really make that end-to-end process of detecting, directing and remediating issues a lot more efficient. >> Okay, and do you see at some point that the machine will actually do, the machine intelligence will do a lot of that remediation? >> I think so. >> Do you see the human still heavily involved? >> Well, I think one of the important things is for a lot of these remediation things, we shouldn't have a human involved, right? Particularly things that are well-known issues. Human beings are expensive and human beings are important, and there are a lot more important things that they can be doing with their time than putting out fires. So if we can have machines doing that for them, it frees them up to do a lot more cool stuff. >> You're right. Alright, Chris, well listen, thanks very much for coming on theCUBE. It was great to have you. >> Yeah! Appreciate it very much. >> Thanks for your insights. Alright, keep it right there, everybody. Stu and I will be back with our next guest. You're watching theCUBE from Orlando Splunk.conf2018. Be right back. (techno music)

>> Live from Orlando, Florida, it's theCUBE. Covering .conf18, brought to you by Splunk. >> Welcome back to Orlando everybody, home of Disney World, and this week, home of theCUBE. I'm Dave Vellante and he's Stu Miniman. Steven Hatch is here, he's the manager of Enterprise Logging Services at Cox Automotive. Steven, thanks for coming on theCUBE. >> Thank you. >> So, you've been with Splunk for a while, we're here at conf18. Logging services, enterprise logging services. When you think of Splunk, their roots, Splunk go back to, sort of, log files, analyzing log files, it's in your title. (laughs) You must be pretty intimately tied to, as a practitioner, to this capability, but talk about your role and what you do at Cox. >> Primarily, the role is to be the evangelist, the enabler, and the center of excellence when it comes down to getting those best practices propergated within the enterprise. >> So people come to you for advice, council, you play, sort of, internal consultant. What qualified you to do that? You were a practitioner prior to this, so you got your hands dirty and you kind of now, elevated to-- >> My prior role was a Site Operations, or Site Reliability Engineer, and then Manager. And so, having that background, I've been in IT since '96, so I'm a little old in the game, but basically, having that operational knowledge, and knowing how to think big picture when things are happening or transpiring, or the reverse and go back and find that root cause analysis. >> '96, just a pup, my friend, okay? (both laugh) So, talking to Stu, we were talking off camera, about the number of brands that Cox Automotive has, Cox at Kelley Blue Book and at numerous others, like dozens, each of these is kind of it's own data silo. How do you guys go about using Splunk? Are you able to break down some of those silos? Maybe you could share that with us. >> Yeah, so we have been successful on a lot of the big three really, at Kelley Blue Book, Manheim, as well as Auto Trader, to really break in. A lot of that was because of our, already previous, relationships with team members and leaders. On the other side of the coin is the newly acquired companies that are not in Atlanta, Georgia. That are in places like Groton, Connecticut, South Jordan, Utah, Upstate New York, as well as the Toronto area in Canada. And so, WebEx joined me, email just won't cut it. You actually have to sit down with these people and really showcase your business case, your model, and what you're trying to bring to the table. But of course, the approach is always important. >> And are you using Splunk to do that? As a collaboration tool as well? >> Yes sir, yep. >> Explain that a little bit if you would. >> So, a lot of times, as you mentioned, the silos, as a bigger brand now, it's no longer an excuse for you to only be responsible for your data and not showcase it, or share that data. Because we're thinking about the entire life-cycle of Cox Automotive, and this entity of Cox Automotive, that's important to us now. So for you to hold tight, or to hoard your data, or your metrics and not share them, that's not good business anymore. >> Yeah, so Steven, we talked to a lot of companies that do M&A, and it's usually like, well, this is the products we use, these are the structures that we have. One of the things we hear from Splunk is that you can get to your data, your way. How does the Splunk modeling, and how you look at the data, fit into that M&A? Is that an enabler for you to be able to get that in. >> Yeah, and so, when you can showcase the ability of how the data comes in and, quickly. Key word, right? To showcase how that data can be very valuable to them, especially to their stakeholders, that's when light bolts will go off. And, again, it's the stakeholders, and then champions, that we need to bring to the table to make sure that we can get full adoption. >> Yeah, we've also-- Dave's been to the show a few times, it's my first time, and what I've really heard a bunch of is the people that know how to use Splunk, they're super valuable inside of the company. They get training, people inside the company, they look to get hired, tell us a little about what you've seen, what it means to your role inside the company, and as you network with your peers here. >> It's a lot of exposure. A lot of people are very anxious to get some type of insights into their world, their infrastructure, their applications, their business tools. A lot of times, there are people out there that are very savvy from a business perspective, that have a bunch of KPIs in their head, but no one has actually extracted that information from them, and so, our job is to align with their KPIs. You know, over the last couple of years, that's what we've-- the journey that we've been on, is to now revisit the data that we've just ingested. That's the basic foundation. We want to elevate now and really get more mature, and to align with those business KPIs. >> Meaning they got this tribal knowledge in their head, and you want to codify that so that it can be shared. >> Correct. >> How do you go about doing that? Is it sitting in a whiteboard and understanding that? >> It can be a whiteboard, it can be over a coffee. If I need to get on a plane and go see them in person, and to really just listen and ask the questions when it's time but, again, listen and really understand what's important to them, what is important to their business, to their function, to their silos? Cox Automotive has five, of what we call, pillars, where there's international, finance, marketing, retail, or media, and each one of those owners, over time, wants the specific value. >> So if you go and have a chalkboard session, whiteboard session, with one of these folks, how do you operationalize it? You got to figure out where the data exists, so that you can align with what's in their head? Is that right? And then, how do you do that? How do you scale it? >> Well, so, again, you have to start from the top. If you start from the bottom, you'll be in the weeds until the end of time. So that the more efficient manner is to start from the top and realize those KPIs from those leaders, those stakeholders, and then from there, a tool like ITSI, which is basically built around services, entities, and aligning to their service decomposition model, and that right there allows you to stay consistent and efficient on getting that information. >> So you start top down, but ultimately, people are going to want granularity. So you start-- is it top down, bottom up, type of approach? Where you actually drill, drill, drill, drill, drill, and then get to the point where you can answer all those granule questions? And then, by doing that, if I understand it correctly, it sums to the top line, is that fair? >> Yeah, yeah, there's a point in time where you say, you know what? I could really now enhance or enrichen the data by a dataset that I know where it is. So the keypal will get you to a certain point, and then, to find that happy medium, or that common denominator from the data that you already have on premise, or from your apps, wherever they reside, that's where you can meet the gap. >> Otherwise you're never get it done. You'll end up boiling the ocean. >> That's correct, yes sir. >> All right, so, when we talked to you two years ago, you were using Splunk Cloud, you know? And when we talked to practitioners it's-- the things that they're managing, a lot of times now, most of it's not what they own, and so, how do I get the right information? How do I manage that environment? Talk to us a little bit about what you've seen in the maturation of Splunk and Splunk Cloud, if there's anything in 7.2, or Splunk Next, that's exciting you, to help you do your job even better. >> Oh man, so of course, the keynote today, the DSP, the processing layer that's in front of the Cloud, or in front of the indexes now. Where in real time, I can now route data, specifically from a security standpoint. If there's some type of event, without having to go through all the restarts and configuration management and everything else, I can simply put something in there, right there, and move the data, or mask the data. The ability with the infrastructure app, that's exciting to me, as well as all the feature updates for ITSI, enterprise security, as well as the Cloud itself. >> Can we do a little Splunk 101 for my benefit? So I heard today, from one of the product folks, that it used to be when you added another indexer, you had to add storage and compute simultaneously, whether or not you needed the storage, you had to add it, or vise versa. So an indexer is what, is it, essentially, a Splunk node? >> No, it can be a, basically, a Linux host, that actually has the agent running as an indexer with the attached disk. >> Right, okay, and it used to be you had to buy that in chunks, kind of like HCI, right? And you couldn't scale storage independent of compute? >> That's correct. >> What that meant is you were paying for stuff that you might not need. >> Right. >> So, with 7.2, I guess it is, you can split those and you get more granule, or what does that mean for you? >> Well, being a, now four year customer of Splunk Cloud, and anytime we went to the next version of, or license, the next step up, currently we're on about six terabytes. When we go up to eight, that the entailed more indexes being added to the cluster, which meant more time for the replication of search factors to be met, which can take however long, and then, or if there's any kind of issue with the indexer, where one had to be pulled out and another one introduced. How long does that take? Now, with the decoupling of the compute from the storage, it's minutes, and so it's a fraction of the time. >> And if I understand, I understood it real well when it's an appliance, but it's the same architecture if it's done in the Cloud, is that correct? >> It's, essentially, actually, it's a new architecture in my mind, where now it's able to scale more, and then there's-- I'm not sure how much they talked about it, but there's a potential of the elasticity of it. And so, now, I don't have to be so fixed, I can, on certain times, expand the cluster, you know, for search performance, or bring it back down when it's not needed. >> Some of the promise of Cloud. >> Yes, sir, Splunk Cloud. >> So it's like the Billy Dean, the five tool star. You've got the cost, you've got availability, you got speed, you got flexibility, and you've got business value, ultimately, which is what's driving here. So, I take it, I'm inferring here, you'd expect to use this capability in the near future? >> Very much so. >> Great. What else is on your horizon? What are the cool stuff you're working on? And things you want to share with us? >> Well, in addition to our leveraging Splunk Cloud for four years, next year we plan to move away from our current sim tool, into enterprise security. So it's very exciting to hear that they're continually updating that product, and so our security team has been knocking on my door for the last six months to really get that started. So, once we get there, we'll start the migration efforts and get Splunk Cloud now, enabled with the enterprise security, to really empower our security team, and stay ahead of our threats. >> So, I've been around a long time, and, ever since I can remember being in this business, customers have wanted to consolidate the number of vendors with whom they work. But the allure of best of breed always sucks them in to, oh, lets try this, or you get shadow IT. It sounds like, with Splunk, you're approaching this as a platform that you can use for a variety of different use cases. >> That is correct. >> Now, whether or not you reduce the number of vendors is, maybe a separate conversation, but I guess the question I have is, how are you using Splunk in new ways? It sounds like its permutating a line of business, SecOps, etc, is that an accurate picture? If you could describe it. >> Yeah, so Splunk itself, the core is the platform for so many different other functions within the business. You have security, you have the development group, DevOps, where, from a CICD perspective, now they can measure the metrics or the latency in between, when they create a car, say in rally, all the way to the very end of the line, what are all those metrics that are there, that they can leverage to increase their productivity? Obviously, infrastructure. As we consolidate all of our data centers down, wouldn't it be nice to know if these specific low bouncers or switchers are still having traffic to verse them? And to actually get a depiction of the consolidation effort. From a virtualization standpoint, isn't it powerful to know how many devices E6 hosts are actually fully being utilized, and how many are actually vacant? And how much money can be saved if we were actually to turn down those specifics blades or hosts? Or VMs that aren't being leveraged, but they're sitting there, taking up valuable resources. >> I remember when Splunk, right around the time they went public, I remember two instances, maybe three. There was a MPP database company, there was a large three letter firm, and there was an open-source specialist, and I heard the same thing from each of them, was we have the Splunk killer, this was like, five, six years ago. It seems like this Splunk killer was Splunk. And it really never happened. Why is it? Why is Splunk so effective? You obviously see, you know, you're independent, you want to use the best thing for Cox Automotive. What is it about Splunk that sets them apart, puts them in the lead? >> The scale capabilities, having this type of environment with the conferences and the sales group and the support groups, very intentional about listening. Having workshops where they come on premise to help us out on our use cases, to really educate their users, because the more their users are elevated from a knowledge standpoint, the more they will then exercise the application. If they all stay basic, why would I need another component of Splunk? Why would I need enterprise security? Why would I need to expand my subscription into the Cloud? The more I can exercise it, the more I'll need. >> So this is kind of a give, get. They come in knowing that if they expose you to other best practices, you'll going to be more effective in the use of Splunk and you might apply it in to other parts of your business. >> My appetite will grow and my users appetite will grow. >> And these are freebies that they're doing? Services freebies, or are they paid for services? >> Oh yeah, they have no problem coming in, supplying the necessary ammunition, or food, to entice, to have folks come in, but it's powerful to have all the engineers in there to really show us how things work. 'Cause, again, it's a win, win. >> And you're a football fan, I understand? >> Oh, yes, sir. >> Chiefs are your team, right? >> That's correct. >> Were you a football player? >> For a little while, yes. Now I coach, so that's my-- >> And you coach, what? >> Little girls. >> Kiddie football, huh, awesome. Is that Pop Warner these days, still? >> I guess you call it that. >> Flag football or tackle? >> Tackle football >> Really? >> Yep. >> Eight years old? >> Yes, my son is eight and he's playing full back right now, I'm very excited, happy father. >> Is he a big boy, like his dad? >> He's going to be bigger, I think, than his father, yes, sir. (both laugh) >> That's awesome. Well, listen, thanks very much, Steven, for coming on theCUBE, it's really a pleasure meeting you. >> That's appreciated, thank you very much. All right, keep it right there everybody. Stu and I will be back with our next guest. We're live from Splunk .conf18, you're watching theCUBE.

>> Narrator: Live, from Washington D.C., it's theCUBE. Covering .conf2017, brought to you by Splunk. >> Well, welcome back to .conf2017. Here we are at Splunk's annual get together, with Dave Vellante, I'm John Walls. We are live in the Walter Washington Convention Center, in beautiful Washington D.C. I say that, proud to be a native. Actually raised here, lived here, fly the flag here. >> Wow. >> This is my place, Dave. >> Listen, I love this city. >> I do too. >> I love coming down here. Lots to do, my son's down here, so. >> But if we weren't here, where should we be, maybe on the deck of a Carnival cruise line ship right now? >> That would be good. >> I would like that. >> I would love to have theCUBE on the deck of a Carnival >> Maybe, maybe Ruel Waite can swing that. What do you think? Ruel Waite joins us. He is the manager of delivery and support for Carnival. And you got room for two on the next ship out of Miami? >> Listen, man, for you guys anything. >> I love that. Alright, you're hired. >> I can make it happen. >> Outstanding. Alright Ruel, thanks for being here with us. >> No problem. >> On theCUBE, glad to have you, and here at the show as well. Alright, so let's talk about first off, Splunk. What are you doing? Let's back up, in terms of what you do. Your core responsibilities and then we'll get into Splunk story after that. >> Yeah, so I manage the support operation for our ecommerce platform, as well as for the guest facing ship board application. So the ecommerce platforms is where you go and purchase your cabin on the web. You would also be able to purchase your show excursions, your spa treatments, as well. Or we have an e-retail site where if you have a friend who's sailing you can buy a bottle of champagne and have it in their room for when they get there. So all those purchasing perks now that we support on the ecommerce platform. And then the guest facing application, Shipboard, we're talking 'about the mobile application where guests chat and interact with each other or plan their day. We're talking about the Pixels application where guests are purchase their photos that they take throughout their cruise. And their some facial recognition stuff there as well. And the iTV that's in your room. So we have a separate, many different sort of applications that fit under that portfolio. >> Let's talk about the data. >> Yes. >> A lot of data that you just created. >> Right? >> Yup. >> What's the data pipeline look like, where does Splunk fit? >> We Splunk as much as we can and we're continuing to build that as we go. Our application logs are Splunk, everything we produce from the application. Also our performance metrics from our servers and our data and our network, and all those systems, we Splunk that because that's critical for us to triage issues that occurring. Because our operation is about monitoring what's happening, it's about resolving issues as quickly as possible, and it's about communicating to our business. So those three things are data essential to all of that. So we need to get as much as we can and we need to be able to get insights into it. >> Can you talk about where you started, you had mentioned off camera about four years ago, and how you've been able to inject automation into your processes and just take us through your journey. >> Yeah, so we started a few years ago with Splunk, and it was primarily a triage tool for us. So an incident would occur, we'd try to get it, and look at some logs, figure out what's going on. And as we've evolved it's become more of a proactive alerting tool for us, it's become a communication tool, a collaborative tool, for us. You know, we leverage things like the ITSI, right. That allows us to understand the base line behavior of our system. Once we base line that then we can understand the spikes, we can understand when things are changing, and that allows us to react and quickly identify things, defects in our system, things that are occurring, and resolve them. So once we kind of got our legs around okay, we get how to use Splunk to find stuff, now let's figure out how to get Splunk to tell us stuff. >> Okay. >> Right? And now once Splunk is telling us stuff, let's figure out how we tell the business that stuff. So that's kind of how we the journey we've had with Splunk. >> And Splunk's in that thread the whole way? >> The whole way. >> So from, >> The whole. >> So, ultimately then, right now what are you putting into practice that you didn't have available >> Yeah, sure. >> two, three years ago? >> Yeah sure, so one of the challenges we had was, with a typical ecommerce site you have several layers of the application, right. You have your web server, you have caching infrastructure, you have a database server, yet we have a mainframe reservation system as well. So there are several things involved with supporting all those different platforms. Now when we have an incident, it's sometimes challenging to, you know you get somebody on the phone, you're like hey what are you seeing over there on the mainframe side? Well I see this error occurring. Oh and the database side they're telling you okay, we're seeing some sort of timeout here, but we're not sure if it's related to the same thing you're talking about. And we didn't have a way to tie it together. But by using Splunk Transactions what we decided to do was we decided to log the session ID, the web servers session ID across all our layers, right, and push that through, and that allows us to tie those transactions together across those layers. And now when we have an incident we're able to, when we're talking to the mainframe we're saying hey guy, hey go look at this. And he say here's what I'm seeing. >> You can isolate it? >> We can isolate it, we can pull it together, and it's really helpful. >> So will you get to the point, or you were trying to get to the point, where you can automate the remediation? Or is that something you don't want to do 'cause you want humans involved? >> You know, automation is good. And whatever we can automate we try to do that. At this point we're not automating the resolution through Splunk at this time, but what we are doing is we are providing the on call, or the engineer that are responding with as much information as we can in order to have them quickly flip that switch. So if we have an alert that we know, hey this issue requires a recycle of an application pool, or some kind of other action like that, we can put that in our Splunk alert. And we say hey we're seeing this issue occur. That email and that text message that goes out actually tells the engineer that these are the suggested actions that you can take in order to quickly resolve this issue. >> Ruel, what are you hearing from the business side? What are the business drivers and how is that effecting what you're doing in IT generally, and specifically with data and Splunk? >> Okay so from business side we're looking at most bookings is the one of the major metrics that we look at. And our guest experience. So and on the web that means the site needs to be available, it needs to perform, and it needs to work. So what we really are trying to do with Splunk is understand those issues that are impacting our guests on the booking side. What that means is we need to know how well we're converting. And if we're looking at homepage performance, and we can now tell hey if our homepage loads in five seconds verses three seconds, there are how many fewer people make it to our payment page, which is huge for us. So that's something that we really try to hone in on. And it really helps us to collaborate with the business and understand, really, what is the revenue impact of these IT metrics that we're spitting out. >> But there could be other factors involved in that too, >> Yes. >> other variables, right? >> There are. >> You can't just you know this is, but you have enough of a track record the are a couple reasons to say okay, five seconds means this, we get a 30% conversion rate. We get three seconds, man, we got 'em hello, and, now we have a 50%, whatever. >> Yeah, but that is where, what I'm excited about at the conference is the machine learning capabilities that we've been hearing about. 'Cause that will allow us to then model how those different factors that go into when someone goes from the homepage to payment, you're totally right. There's several things that go into that. And what we want to be able to model, hey, on a normal day here's our guest behavior, whether we have a sale, how do our guests behavior differently, or on a Monday night at eight PM what is the behavioral trend. So it's all important to us. And getting the data behind it and being able to model that is going to be really key for us. >> Connect the dots for me on >> Yes. >> how you use machine learning, and how will that affect the business? You'll make different offers at different times, or? >> So what I mean is if I understand how guests behave I will know if I'm having an issue on the site. If there's something happening that's impacting their ability to book. 'Cause sometimes you do a release, you do your quality control, and then you go home, everything looks good. And sometimes hours later, sometimes days later unfortunately, something pops up that you introduced during that release. And understanding what that baseline is, right. So what Splunk has allowed us to do is say okay, here's what normal behavior is. And we're trying to grow this more, but what we've been using ITSI to say here's what that behavior really is. Based on what we kind of know are the metrics around booking. Here's what that behavior is. And we do a release and we see a spike, a change, and now we're able to say wait a minute, we never saw this error before. This error never existed in our system at any point. That was definitely something that was introduced right here in this release, we need to go ahead and resolve this as well. And sometimes you get some false positives there, if your development team is doing change the way they log a little bit you might get a spike. But that's cool because you get to go in immediately and figure out what those changes are, and you get a comfort level that you kind of understand how your system works. >> Let me ask you another question. You got some experience with Splunk. >> Yes. >> Obviously, you were just working with them. What, in your mind, is on their to do list? What do you want to see out of them? Doug, if I'm Doug. Tell me, where should I go, what should I do. >> What do I want Splunk to do. >> Any gripes, give me the good, the bad, and the ugly. >> For me, it's performance, performance, performance. I want to see my queries run as quickly as possible. I want to see things fast. I want to hit the button and it happens right away. Now obviously that's not going to, that's not realistic. But I like what some of the things that Splunk are doing. You look at the new metrics index that they've been talking about the last two days. So they've now isolated your time serious data and they're able to optimize the searches on time serious data seperate from your application logs. So, you know, your CPUs, your memory consumption, that data is not the same as your logging an error, or logging that a booking was created, or something like that. Those are kind of two different things. So they have kind of decoupled that and they're saying anything that's time serious I'm going to put it over here. And I'm going to optimize that query, and then you can handle your other logs separately. But the additional benefit of that is then you can take your time serious and you can look at a CPU spike and then you can take your event data and overlay it on top. And then you can see, hey wait a minute, this event is what caused that spike. So that's where the cool is. >> I think they call that mstats. Is that right, mstats? >> Yes, it's mstats, yes. >> How 'about the stuff that you saw this week in the keynotes, particularly today was the product stuff. A lot of security obviously. Anything that you've seen here at the show that excites you, that you really said alright, I got to have that, I got to learn more? >> Yeah, so the ITSI event analytics really seems like something's going to be cool for us. As I've said before, we utilize ITSI internally. So we put together a glass table that's shows us here are all the different components and the hierarchy of things. And when this goes red it effects these other layers. And it's really cool. But what they've added in is the ability to click a button and drill in to those components and then you have a view of hey, here are the events associated with that. That's really cool because now you're triaging in one place, now you get to the problem really quick. And you can emote directly into your Splunk queries. It really allows what we're looking for is just to resolve issues as quickly as possible. >> And you're describing, if I understand this correctly, you can visualize the dependencies, and you can take remedial action or identify, inform the business what to expect. >> Exactly. >> Be much more proactive, that's what people are talking about. >> Yeah, yeah. And we found that one of the surprising things we found with Splunk is that our business are users of Splunk as well, right. So it's always an IT tool, it's something that only the geeks are going to look at. And then all of a sudden you present a dashboard to a business user and they go ah. That's pretty, right. And then all of a sudden they want it more than you do. So that's what makes it great right, 'cause you can present the data however you want and you can put it in a way that different audiences can consume. And so it becomes a platform that goes across the organization, which is really, really cool. >> John: But your bottom line's all speed right? >> Yes, yeah. >> Take care of my problems faster, get my customer faster, deliver faster, come on Splunk. >> Come on, let's go. >> We want to go. >> Brings the weekend faster. >> Right, right. >> Get more sleep, get more sleep. >> Ruel, thanks for being with us. >> Oh. >> We appreciate that. >> And, we'll talk about the cruise. Leonard Nelson, our producer over here already said book him for a massage, the presidential suite. He wants one night, and then the champagne buffet please. >> It's done. >> Fast internet, though. >> Yeah. >> Fast internet, yeah. It's done. >> Alright. We're simple people, we don't need all that, but we'll talk later. >> Alright man, appreciate it, thank you. >> Thank you for being with us. Ruel Waite joining us from Carnival. Back with more from Splunk, .conf2017. 2015, where did that come from? 2017, it's been a long day. (upbeat music)

>> Announcer: Live from Washington D. C., it's the CUBE. Covering .conf2017. Brought to you by Splunk. (electronic music) >> Welcome back to the nation's capitol everybody. This is the CUBE, the leader in live tech coverage. And we're here at day two covering Splunk's .conf user conference #splunkconf17, and my name is Dave Vellante, I'm here with with co-host, George Gilbert. As I say, this is day two. We just came off the keynotes. I'm over product orientation today. George, what I'd like to do is summarize the day and the quarter that we've had so far, and then bring you into the conversation and get your opinion on what you heard. You were at the analyst event yesterday. I've been sitting in keynotes. We've been interviewing folks all day long. So let me start, Splunk is all about machine data. They ingest machine data, they analyze machine data for a number of purposes. The two primary use cases that we've heard this week are really IT, what I would call operations management. Understanding the behavior of your systems. What's potentially going wrong, what needs to be remediated. to avoid an outage or remediate an outage. And of course the second major use case that we've heard here is security. Some of the Wall Street guys, I've read some of the work this morning. Particularly Barclays came out with a research note. They had concerns about that, and I really don't know what the concerns are. We're going to talk about it. I presume it's that they're looking for a TAM expansion strategy to support a ten billion dollar valuation, and potentially a much higher valuation. It's worth noting the conference this year is 7,000 attendees, up from 5,000 last year. That's a 40% increase, growing at, or above actually, the pace of revenue growth at Splunk. Pricing remains a concern for some of the users that I've talked to. And I want to talk to you about that. And then of course, there's a lot of product updates that I want to get into. Splunk Enterprise 7.0 which is really Splunk's core analytics platform ITSI which is what I would, their 3.0, which I would call their ITOM platform. UBA which is user behavior analytics 4.0. Updates to Splunk Cloud, which is a service for machine data in the cloud. We've heard about machine learning across the portfolio, really to address alert fatigue. And a new metrics engine called Mstats. And of course we heard today, enterprise content security updates and many several security-oriented solutions throughout the week on fraud detection, ransomware, they've got a deal with Booz Allen Hamilton on Cyber4Sight which is security as a service that involves human intelligence. And a lot of ecosystem partnerships. AWS, DellEMC was on yesterday, Atlassian, Gigamon, et cetera, growing out the ecosystem. That's a quick rundown, George. I want to start with the pricing. I was talking to some users last night before the party. You know, "What do you like about Splunk? "What don't you like about Splunk? "Are you a customer?" I talked to one prospective customer said, "Wow, I've been trying to do "this stuff on my own for years. "I can't wait to get my hands on this." Existing customers, though, only one complaint that I heard was your price is to high, essentially is what they were telling Splunk. Now my feeling on that, and Raymo from Barclays mentioned that in his research note this morning. Raymo Lencho, top securities analyst following software industry. And my feeling George is that historically, "Your price is too high," has never been a headwind for software companies. You look at Oracle, you look at ServiceNow, sometimes customers complain about pricing too high. Splunk, and those companies tend to do very well. What's your take on pricing as a headwind or tailwind indicator? >> Well the way, you always set up these questions in a way that makes answering them easy. Because it's a tailwind in the sense that the deal sizes feed an enterprise sales force. And you need an enterprise sales force ultimately to be pervasive in an organization. 'Cause you can't just throw up like an Amazon-style console and say, "Pick your poison and put it all together." There has to be an advisory, consultative approach to working with a customer to tell them how best to fit their portfolio. >> Right. >> And their architecture. So yes, the price helps you feed that what some people in the last era of enterprise software used to call the most expensive migratory workforce in the world., which is the sales, enterprise sales organization. >> Sure, right. >> But what's happened in the different, in the change from the last major enterprise applications, ERPCRM, and what we're getting into now, is that then the data was all generated and captured by humans. It was keyboard entry. And so there was no, the volumes of data just weren't that great. It was human, essentially business transactions. Now we're capturing data streaming off everything. And you could say Splunk was sort of like the first one out of the gate doing that. And so if you take the new types of data, customer interactions, there are about ten to a hundred customer interactions for every business transaction. Then the information coming out of the IT applications and infrastructure. It's about ten to a hundred times what the customer interactions were. >> Yeah. >> So you can't price the, Your pricing model, if it stays the same will choke you. >> So you're talking about multiple orders of magnitude >> Yes. >> Of more data. >> Yeah. >> And if you're pricing by the terabyte, >> Right. >> Then that's going to cross your customers. >> Right. But here's what I would argue though George. I mean, and you mentioned AWS. AWS is another one where complaints of high pricing. But if, to me, if the company is adding value, the clients will pay for it. And when you get to the point where it becomes a potential headwind, the company, Oracle is a classic at this, will always adjust its pricing to accommodate both its needs as a public organization and a company that has to make money and fund R & D, and the customers needs, and find that balance where the competition can't get in. And so it seems to me, and we heard this from Doug Merritt yesterday, that his challenge is staying ahead of the game. Staying, moving faster than the cloud guys. >> Yeah. >> In what they do well. And to the extent that they do that, I feel like their customers will reward them with their loyalty. And so I feel as though they can adjust their pricing mechanisms. Yeah, everybody's worried about 606, and of course the conversions to subscriptions. I feel as though a high growth, and adjustments to your pricing strategy, I think can address that. What do you think about that? >> It's... It sounds like one of those sayings where, the friends say, "Well it works in practice, "but does it work in theory?" >> No, no. But it has worked in practice in the industry hasn't it? So what's different now? >> Okay. So take Oracle, at list price for Oracle 12C, flagship database. The price per processor core, with all the features thrown in, is something like three hundred thousand, three hundred fifty thousand per core. So you take an average Intel high end server chip, that might have 24 cores, and then you have two sockets, so essentially one node server is 48 times 350. And then of course, Oracle will say, "But for a large customer, we'll knock 90% off that," or something like that. >> Yeah, well exactly. >> Which is exactly what the Splunk guys told me yesterday. But it's-- >> But that's what I'm saying. They'll do what they have to do to maintain the footprint in the customer, do right by the customer, and keep the competition out. >> But if it's multiple orders of magnitude different. If you take the open source guys where essentially the software's free and you're just paying for maintenance. >> (laughs) Yeah and humans. >> Yeah, yeah. >> Okay, that's the other advantage of Splunk, as you pointed out yesterday, they've got a much more integrated set of offerings and services that dramatically lower. I mean, we all know the biggest cost of IT is people. It's not the hardware and software but, all right, I don't want to rat hole on pricing, but that was a good discussion. What did you learn yesterday? You've sat through the analyst meeting. Give us the rundown on George Gilbert's analysis of .conf generally and Splunk as a company specifically. >> Okay, so for me it was a bit of an eye opener because I got to understand sort of, I've always had this feeling about where Splunk fits relative to the open source big data ecosystem. But now I got a sense for what their ambitions are, and what their tactical plan is. I've said for awhile, Splunk's the anti-Hadoop. You know, Hadoop is multiple, sort of dozens of animals with three zookeepers. And I mean literally. >> Yeah. >> And the upside of that is, those individual projects are advancing with a pace of innovation that's just unheard of. The problem is the customer bears the burden of putting it all together. Splunk takes a very different approach which is, they aspire apparently to be just like Hadoop in terms of platform for modern operational analytic applications, but they start much narrower. And it gets to what Ramie's point was in that Wall Street review, where if you take at face value what they're saying, or you've listened just to the keynote, it's like, "Geez, they're in this IT operations ghetto, "in security and that's a La Brea tar pit, "and how are they ever going to climb out of that, "to something really broad?" But what they're doing is, they're not claiming loudly that they're trying to topple the giants and take on the world. They're trying to grow in their corner where they have a defensible moat. And basically the-- >> Let me interrupt you. >> Yeah. >> But to get to five billion >> Yeah. >> Or beyond, they have to have an aggressive TAM expansion strategy, kind of beyond ITOM and security, don't they? >> Right. And so that's where they start generalizing their platform. The data store they had on the platform, the original one, is kind of like a data lake in the sense that it really was sort of the same searchable type index that you would put under a sort of a primitive search engine. They added a new data store this time that handles numbers really well and really fast. That's to support the metrics so they can have richer analytics on the dashboard. Then they'll have other data stores that they add over time. And for each one, you're able to now build with their integrated tool set, more and more advanced apps. >> So you can't use a general purpose data store. You've got to use the Splunk within data. It's kind of like Work Day. >> Yeah, well except that they're adding more over time, and then they're putting their development tools over these to shield them. Now how seamlessly they can shield them remains to be seen. >> Well, but so this is where it gets interesting. >> Yeah. >> Splunk as a platform, as an application development platform on which you can build big data apps, >> Yeah. >> It's certainly, conceptually, you can see how you could use Splunk to do that right? >> And so their approaches out of the box will help you with enterprise security, user, they call it user behavior analytics, because it's a term another research firm put on it, but it's really any abnormal behavior of an entity on the network. So they can go in and not sell this fuzzy concept of a big data platform. They said, they go in and sell, to security operations center, "We make your life much, much easier. "And we make your organization safer." And they call these curated experiences. And the reason this is important is, when Hadoop sells, typically they go in, and they say, "Well, we have this data lake. "which is so much cheaper and a better way "to collect all your data than a data warehouse." These guys go in and then they'll add what more and more of these curated experiences, which is what everyone else would call applications. And then the research Wikibon's done, depth first, or rather breadth first versus depth first. Breadth first gives you the end to end visibility across on prem, across multiple clouds, down to the edge. But then, when they put security apps on it, when they put dev ops or, some future big data analytics apps as their machine learning gets richer and richer, then all of a sudden, they're not selling the platform, because that's a much more time-intensive sale, and lots more of objectives, I'm sorry, objections. >> It's not only the solutions, those depth solutions. >> Yes, and then all of a sudden, the customer wakes up and he's got a dozen of these things, and all of a sudden this is a platform. >> Well, ServiceNow is similar in that it's a platform. And when Fred Luddy first came out with it, it's like, "Here." And everybody said, "Well, what do I do with it?" So he went back and wrote a IT service management app. And they said, "Oh okay, we get it." Splunk in a similar way has these depth apps, and as you say, they're not selling the platform, because they say, "Hey, you want to buy a platform?" people don't want to buy a platform, they want to buy a solution. >> Right. >> Having said that, that platform is intrinsic to their solutions when they deliver it. It's there for them to leverage. So the question is, do they have an application developer kit strategy, if you will. >> Yeah. >> Whether it's low code or even high code. >> Yeah. >> Where, and where they're cultivating a developer community. Is there anything like that going on here at .conf? >> Yeah, they're not making a big deal about the development tools, 'cause that makes it sound more like a platform. >> (laughs) But they could! >> But they could. And the tools, you know, so that you can build a user interface, you can build dashboards, you can build machine learning models. The reason those tools are simpler and more accessible to developers, is because they were designed to fit the pieces underneath, the foundation. Whereas if you look at some of the open source big data ecosystem, they've got these notebooks and other tools where you address one back end this way, another back end that way. It's sort of, you know, you can see how Frankenstein was stitched together, you know? >> Yeah so, I mean to your point, we saw fraud detection, we saw ransomware, we see this partnership with Booz Allen Hamilton on Cyber4Sight. We heard today about project Waytono, which is unified monitoring and troubleshooting. And so they have very specific solutions that they're delivering, that presumably many of them are for pay. And so, and bringing ML across the platform, which now open up a whole ton of opportunities. So the question is, are these incremental, defend the base and then grow the core solutions, or are they radical innovations in your view? >> I think they're trying to stay away from the notion of radical innovation, 'cause then that will create more pushback from organizations. So they started out with a google-search-like product for log analytics. And you can see that as their aspirations grow for a broader set of applications, they add in a richer foundation. There's more machine learning algorithms now. They added that new data store. And when we talked about this with the CEO, Doug Merritt yesterday at the analyst day, he's like, "Yes, you look out three to five years, "and the platform gets more and more broad. "and at some point customers wake up "and they realize they have a new strategic platform." >> Yeah, and platforms do beat products, and even though it's hard sell, if you have a platform like Splunk does, you're in a much better strategic position. All right, we got to wrap. George thanks for joining me for the intro. I know you're headed to New York City for Big Data NYC down there, which is the other coverage that we have this week. So thank you again for coming on. >> Okay. >> All right, keep it right there. We'll be back with our next guest, we're live. This is the CUBE from Splunk .conf2017 in the nation's capitol, be right back. (electronic music)

>> Announcer: Live from midtown Manhattan, it's theCUBE, covering BigData New York City 2017, brought to you by SiliconANGLE Media and its ecosystem sponsors. >> Hello everyone, welcome back to theCUBE's special BigData NYC coverage of theCUBE here in Manhattan in New York City, we're in Hell's Kitchen. I'm John Furrier, with my cohost Jim Kobielus, whose Wikibon analyst for BigData. In conjunction with Strata Data going on right around the corner, this is our annual event where we break down the big data, the AI, the cloud, all the goodness of what's going on in big data. Our next guest is Tendu Yogurtcu who's the Chief Technology Officer at Syncsort. Great to see you again, CUBE alumni, been on multiple times. Always great to have you on, get the perspective, a CTO perspective and the Syncsort update, so good to see you. >> Good seeing you John and Jim. It's a pleasure being here too. Again the pulse of big data is in New York, and it's a great week with a lot of happening. >> I always borrow the quote from Pat Gelsinger, who's the CEO of VMware, he said on theCUBE in I think 2011, before he joined VMware as CEO he was at EMC. He said if you're not out in front of that next wave, you're driftwood. And the key to being successful is to ride the waves, and the big waves are coming in now with AI, certainly big data has been rising tide for its own bubble but now the aperture of the scale of data's larger, Syncsort has been riding the wave with us, we've been having you guys on multiple times. And it was important to the mainframe in the early days, but now Syncsort just keeps on adding more and more capabilities, and you're riding the wave, the big wave, the big data wave. What's the update now with you guys, where are you guys now in context of today's emerging data landscape? >> Absolutely. As organizations progress with their modern data architectures and building the next generation analytics platforms, leveraging machine learning, leveraging cloud elasticity, we have observed that data quality and data governance have become more critical than ever. Couple of years we have been seeing this trend, I would like to create a data lake, data as a service, and enable bigger insights from the data, and this year, really every enterprise is trying to have that trusted data set created, because data lakes are turning into data swamps, as Dave Vellante refers often (John laughs) and collection of this diverse data sets, whether it's mainframe, whether it's messaging queues, whether it's relational data warehouse environments is challenging the customers, and we can take one simple use case like Customer 360, which we have been talking for decades now, right? Yet still it's a complex problem. Everybody is trying to get that trusted single view of their customers so that they can serve the customer needs in a better way, offer better solutions and products to customers, get better insights about the customer behavior, whether leveraging deep learning, machine learning, et cetera. However, in order to do that, the data has to be in a clean, trusted, valid format, and every business is going global. You have data sets coming from Asia, from Europe, from Latin America, and many different places, in different formats and it's becoming challenge. We acquired Trillium Software in December 2016, and our vision was really to bring that world leader enterprise grade data quality into the big data environments. So last week we announced our Trillium Quality for Big Data product. This product brings unmatched capabilities of data validation, cleansing, enrichment, and matching, fuzzy matching to the data lake. We are also leveraging our Intelligent eXecution engine that we developed for data integration product, the MX8. So we are enabling the organizations to take this data quality offering, whether it's in Hadoop, MapReduce or Apache Spark, whichever computer framework it's going to be in the future. So we are very excited about that now. >> Congratulations, you mentioned the data lake being a swamp, that Dave Vellante referred to. It's interesting, because how does it become a swamp if it's a silo, right? We've seen data silos being antithesis to governance, it challenges, certainly IoT. Then you've got the complication of geopolitical borders, you mentioned that earlier. So you still got to integrate the data, you need data quality, which has been around for a while but now it's more complex. What specifically about the cleansing and the quality of the data that's more important now in the landscape now? Is it those factors, are that the drivers of the challenges today and what's the opportunity for customers, how do they figure this out? >> Complexity is because of many different factors. Some of it from being global. Every business is trying to have global presence, and the data is originating from web, from mobile, from many different data sets, and if we just take a simple address, these address formats are different in every single country. Trillium Quality for Big Data, we support over 150 postal data from different countries, and data enrichment with this data. So it becomes really complex, because you have to deal with different types of data from different countries, and the matching also becomes very difficult, whether it's John Furrier, J Furrier, John Currier, you have to be >> All my handles on Twitter, knowing that's about. (Tendu laughs) >> All of the handles you have. Every business is trying to have a better targeting in terms of offering product and understanding the single and one and only John Furrier as a customer. That creates a complexity, and any data management and data processing challenge, the variety of data and the speed that data is really being populated is higher than ever we have observed. >> Hold on Jim, I want to get Jim involved in this one conversation, 'cause I want to just make sure those guys can get settled in on, and adjust your microphone there. Jim, she's bringing up a good point, I want you to weigh in just to kind of add to the conversation and take it in the direction of where the automation's happening. If you look at what Tendu's saying as to complexity is going to have an opportunity in software. Machine learning, root-level cleanliness can be automated, because Facebook and others have shown that you can apply machine learning and techniques to the volume of data. No human can get at all the nuances. How is that impacting the data platforms and some of the tooling out there, in your opinion? >> Yeah well, much of the issue, one of the core issues is where do you place the data matching and data cleansing logic or execution in this distributed infrastructure. At the source, in the cloud, at the consumer level in terms of rolling up the disparate versions of data into a common view. So by acquiring a very strong, well-established reputable brand in data cleansing, Trillium, as Syncsort has done, a great service to your portfolio, to your customers. You know, Trillium is well known for offering lots of options in terms of where to configure the logic, where to deploy it within distributed hybrid architectures. Give us a sense for going forward the range of options you're going to be providing with for customers on where to place the cleansing and matching logic. How you're going to support, Syncsort, a flexible workflows in terms of curation of the data and so forth, because the curation cycle for data is critically important, the stewardship. So how do you plan to address all of that going forward in your product portfolio, Tendu? >> Thank you for asking the question, Jim, because that's exactly the challenge that we hear from our customers, especially from larger enterprise and financial services, banking and insurance. So our plan is our actually next upcoming release end of the year, is targeting very flexible deployment. Flexible deployment in the sense that you might be creating, when you understand the data and create the business rules and said what kind of matching and enrichment that you'll be performing on the data sets, you can actually have those business rules executed in the source of the data or in the data lake or switch between the source and the enterprise data lake that you are creating. That flexibility is what we are targeting, that's one area. On the data creation side, we see these percentages, 80% of data stewards' time is spent on data prep, data creation and data cleansing, and it is actually really a very high percentage. From our customers we see this still being a challenge. One area that we started investing is using the machine learning to understand the data, and using that discovery of the data capabilities we currently have to make recommendations what those business rules can be, or what kind of data validation and cleansing and matching might be required. So that's an area that we will be investing. >> Are you contemplating in terms of incorporating in your product portfolio, using machine learning to drive a sort of, the term I like to use is recommendation engine, that presents recommendations to the data stewards, human beings, about different data schemas or different ways of matching the data, different ways of, the optimal way of reconciling different versions of customer data. So is there going to be like a recommendation engine of that sort >> It's going to be >> In line with your >> That's what our plan currently recommendations so the users can opt to apply or not, or to modify them, because sometimes when you go too far with automation you still need some human intervention in making these decisions because you might be operating on a sample of data versus the full data set, and you may actually have to infuse some human understanding and insight as well. So our plan is to make as a recommendation in the first phase at least, that's what we are planning. And when we look at the portfolio of the products and our CEO Josh is actually today was also in theCUBE, part of Splunk .conf. We have acquisitions happening, we have organic innovation that's happening, and we really try to stay focused in terms of how do we create more value from your data, and how do we increase the business serviceability, whether it's with our Ironstream product, we made an announcement this week, Ironstream transaction tracing to create more visibility to application performance and more visibility to IT operations, for example when you make a payment with your mobile, you might be having problem and you want to be able to trace back to the back end, which is usually a legacy mainframe environment, or whether you are populating the data lake and you want to keep the data in sync and fresh with the data source, and apply the change as a CDC, or whether you are making that data from raw data set to more consumable data by creating the trusted, high quality data set. We are very much focused on creating more value and bigger insights out of the data sets. >> And Josh'll be on tomorrow, so folks watching, we're going to get the business perspective. I have some pointed questions I'm going to ask him, but I'll take one of the questions I was going to ask him but I want to get your response from a technical perspective as CTO. As Syncsort continues your journey, you keep on adding more and more things, it's been quite impressive, you guys done a great job, >> Tendu: Thank you. >> We enjoy covering the success there, watching you guys really evolve. What is the value proposition for Syncsort today, technically? If you go in, talk to a customer, and prospective new customer, why Syncsort, what's the enabling value that you're providing under the hood, technically for customers? >> We are enabling our customers to access and integrate data sets in a trusted manner. So we are ultimately liberating the data from all of the enterprise data stores, and making that data consumable in a trusted manner. And everything we provide in that data management stack, is about making data available, making data accessible and integrated the modern data architecture, bridging the gap between those legacy environments and the modern data architecture. And it becomes really a big challenge because this is a cross-platform play. It is not a single environment that enterprises are working with. Hadoop is real now, right? Hadoop is in the center of data warehouse architecture, and whether it's on-premise or in the cloud, there is also a big trend about the cloud. >> And certainly batch, they own the batch thing. >> Yeah, and as part of that, it becomes very important to be able to leverage the existing data assets in the enterprise, and that requires an understanding of the legacy data stores, and existing infrastructure, and existing data warehouse attributes. >> John: And you guys say you provide that. >> We provide that and that's our baby and provide that in enterprise grade manner. >> Hold on Jim, one second, just let her finish the thought. Okay, so given that, okay, cool you got that out there. What's the problem that you're solving for customers today? What's the big problem in the enterprise and in the data world today that you address? >> I want to have a single view of my data, and whether that data is originating on the mobile or that data is originating on the mainframe, or in the legacy data warehouse, and we provide that single view in a trusted manner. >> When you mentioned Ironstream, that reminded me that one of the core things that we're seeing in Wikibon in terms of, IT operations is increasingly being automated through AI, some call it AI ops and whatnot, we're going deeper on the research there. Ironstream, by bringing mainframe and transactional data, like the use case you brought in was IT operations data, into a data lake alongside machine data that you might source from the internet of things and so forth. Seem to me that that's a great enabler potentially for Syncsort if it wished to play your solutions or position them into IT operations as an enabler, leveraging your machine learning investments to build more automated anomaly detection and remediation into your capabilities. What are your thoughts? Is that where you're going or do you see it as an opportunity, AI for IT ops, for Syncsort going forward? >> Absolutely. We target use cases around IT operations and application performance. We integrate with Splunk ITSI, and we also provide this data available in the big data analytics platforms. So those are really application performance and IT operations are the main uses cases we target, and as part of the advanced analytics platform, for example, we can correlate that data set with other machine data that's originating in other platforms in the enterprise. Nobody's looking at what's happening on mainframe or what's happening in my Hadoop cluster or what's happening on my VMware environment, right. They want to correlate the data that's closed platform, and that's one of the biggest values we bring, whether it's on the machine data, or on the application data. >> Yeah, that's quite a differentiator for you. >> Tendu, thanks for coming on theCUBE, great to see you. Congratulations on your success. Thanks for sharing. >> Thank you. >> Okay, CUBE coverage here in BigData NYC, exclusive coverage of our event, BigData NYC, in conjunction with Strata Hadoop right around the corner. This is our annual event for SiliconANGLE, and theCUBE and Wikibon. I'm John Furrier, with Jim Kobielus, who's our analyst at Wikibon on big data. Peter Burris has been on theCUBE, he's here as well. Big three days of wall-to-wall coverage on what's happening in the data world. This is theCUBE, thanks for watching, be right back with more after this short break.