>> Narrator: Live from Washington D.C. it's The Cube, covering .comf 2017. Brought to you by Splunk. >> Welcome back to the district everybody. We are here at .comf 2017. This is The Cube, the leader in live tech coverage. I'm Dave Vellante with my co-host George Gilbert. Doug Merritt here, the CEO of Splunk. Doug, thanks for stopping by The Cube. >> Thanks for having me here Dave. >> You're welcome! Good job this morning. You are a positive guy, great energy. You got the fun T-shirt, I like big data and I cannot lie. The T-shirts I love, so great. You guys are a fun company. So congratulations. >> Doug: Well thank you. >> How's it feel? >> It feels great. You're surrounded by 7,000 fans that are getting value out of the products that you distribute to them and the energy is just off the charts as you said. It's truly an honor to be able to be surrounded by people that care about your company as much as these people do. >> Well one of the badges of honor that Splunk has at your shows is spontaneous laughter and spontaneous applause. You get a lot of that. And that underscores the nature of your customer base and the passion that they have for you guys so that's a pretty good feeling. >> From the very beginning, from the first code that Erik Swan and Rob Dos pushed out, the whole focus has been on making sure that you please the user. The attendance that they created to drive Splunk still stand today and I think a lot of that spontaneous laughter and applause goes back to if you really pay attention to your customer and you really focus all your energy on making sure they're successful, then life gets a lot easier. >> Well it's interesting to watch the ascendancy of Splunk and when you know, go back to 2010, 2011, everybody was talking about big data, it was the next big thing, Splunk never really hopped on that meme from a narrative standpoint. But now you kind of are big data. You kind of need big data platforms to analyze all this data. Talk about that shift. >> I still don't think that we are the lead flag waver on big data. And I think so much of that goes back to our belief on how do you serve customers? Customers have problems and you've got to create a solution to solve that problem for them. Increasingly in these days, those problems can be solved in a much more effective way with big data. But big data is the after effect. It's not the lead of the story, it's the substantiation of the story. So what I think Splunk has done uniquely well is, whether it's our origins in IT operations and systems administration or our foray into security operations centers and analytics and security analyst support. As we started with what is the problem that we're trying to solve. And then because we're so good at dealing with big data, obviously we're going to take a unstructured data, big data approach to that problem. >> So about two years in, you were telling us off camera about the story of Splunk has a tendency to be a little ADD. You came in, helped a little prioritization exercise, but what have you learned in two years. >> Ah, infinite. You have to have an hour for that. I think part of the ADD is because the platform is so powerful, it can solve almost any problem. And what we need to do to help our customers is listen to them and figure out what are the repeat problems so that we can actually scale and bring it to lots of different people. And that's been part of that focus problem or focus opportunity we have, is if you can solve just about anything, how do you help your customers understand what they should do first, second and third. I think that's part of the dilemma we see in the big data space, is people started with I want to just amass all the data. And I think that was a leftover to where big data, George and I were talking about this, where those big data platforms started from. If I'm Yahoo, if I'm Google, if I'm LinkedIn, if I'm Facebook, the guys that originated MapReduce and the whole Hadoop ecosystem, my job is data. Literally, that's all I have, that's all I monetize and drive. So I both have the motivation and the technical engineering knowhow to just put every bit of data I possibly can somewhere for later retrieval. But even those organizations have a hard time really optimizing that data. So if the average or ar-din-e-ah start in a different spot. It's not just put everything somewhere that I can later retrieve it, it's what problem are you trying to solve, what data do I need to solve that problem and then how do I use it, how do I bring it into something and then visualize it so that I get immediate payback and return and that's, I think you guys talked to Mike Odi-son on the show, he was in my keynote, that's a lot of the magic he brought to Get-lick and to Dubai Upworks is, let's just start with can we get people through security in five minutes or less? What data do we need? And then you can move on to the next problem and the next problem. But I think it's a more practical and more effective way of looking at big data is through a customer solution lens. >> Dave: Yeah great story Dubai Upwork. Go ahead George. >> When you look at the customer adjacencies, are you looking at what is the most relevant next batch of data relative to what I've accumulated for the first problem? Or is it an analytic solution that addresses a similar end customer, similar department? How do you find those adjacencies and attack them? >> So the good news and the beauty of Splunk is it's not difficult to get data into the platform. When you do the surveys on data scientists and I think Richard talked about this in his keynote, they all unanimously come back and say, "We spend 60 to 80% "of our time just trying to wrangle data." Well that's not super hard for them. How do you get data in quickly? So we've always been effective at getting massive amounts of data because of the way that we architect the system in. The challenge for us is how do you marry domain expertise and the different algorithms, queries or usage the data so you get that specific solution to a problem? So we've built up a whole practice of looking at the data sources that are in. What do we know from our customer base that says here are the top end use cases that have been able to take advantage of those data sources for these outcomes. And that's how we try to work with customers to say, "Alright you've already brought server logs, "firewall logs and API streams from these four "A to B odd services into Splunk. "I've already got this benefit. "What are the next two things you can do "with that data to get additional benefit?" >> So in a sense, you've got a template for mapping out a customer journey that says, "Here are the next steps." It's like a field guide to move them along in maturity. >> Dave: And you can codify that? >> That's been the hard part is both creating the open source contribution framework, for lack of a better word, what are all these different uses? But the final mile or final inch that most of these customers are trying to drive to is different for every single customer. And that's again, part of what the challenge is with AINML and what we were highlighting on stage this morning. There's two different dimensions, three different dimensions you're dealing with simultaneously. One is what data sets are you bringing together? And as you add different data it radically changes the outcome. What algorithms are you driving? And as you tweak an al-go, even on the same data, it radically changes the outcome. And then what functional lens are you putting in place? And so if you want to solve baggage handling at the airport like one of Michael Epperson's guys, you need some rich aviation and logistics experience to actually understand that to mean how do you bring that to main set together with the actual data that the algorithms and the data sets you get that rapid piece. And so creating enough of those so they're easily digestible and easily actionable by our customers, that is the horizon that we're trying to pierce through. >> And that leads to an ecosystem question, does it not? >> Doug: It does. >> Is that the answer or part of the answer for that mile or last inch that micro vertical. >> That's a huge chunk of the answer. Because you just go back to I need that domain expertise. And pharmaceutical drug exploration expertise is different than general healthcare medical expertise. If you're not able to bring that practical experience with the ability to easily wrangle data and some data scientists that can write these really interesting and effective ML routines, then it's difficult to get that value. >> So I know you'll jump in here in a second, so what are you guys doing explicitly on that front? Where does that fall in the priority list? Is it percolating? >> So many points made Splunk unique from the very beginning. A whole host of things. But one is we made it accessible for an average person to get data in, to store data and to extract value. A lot of the technologies that are out there, you can cobble together and eventually get to Splunk but it's really long, painful and difficult. If you take that same orientation around this now over-hyped MLAI world, it's the same thing, how do you raise the bar so that an average person on an average day with domain expertise and some understanding of data can find ways to get value back out. So I think there's certainly a technology problem because you've got to be able to do it at scale, at speed with integrity. But I think it's almost as much or maybe more of a user interface, an approachability problem 'cause there's just not enough data scientists and data experts that are also computer science experts to go around and solve this problem for the world. >> So it sounds like there's two approaches. There's the customer specific last mile and then what you were talking about earlier, sort of in the keynote and the (mumbles) breakout, which is try and find the horizontal use cases that you can bake into what Richard called curated experiences, which is really ML models that need minimal, light touch from the customer. >> Doug: Yes. >> So help us understand how those can build out with the customer last mile and then the customer wakes up with a platform. >> We have over 1,500 solutions as part of Splunk base which really are those mini curated experiences. From my Palo Alto environment, a combination of Palo Alto, us and third parties created Palo Alto Solution that is able to read data in from the different Palo Alto technologies and provide Dash, Borge, Alert, Remediations how to really assist the Palo Alto team doing their job more effectively. So there's over 1,500 of those in Splunk base. What Rick and the IT operations and App Dev arena and high end security arena are responsible for is how do we continue to gen up the ecosystem so we get more and more of those experiences? How can we extend from Palo Alto firewalls to overall network and perimeter visibility? Which is a combination now of breeding in Palo Alto firewall logs plus the other firewall technologies they likely have, plus network data, plus endpoint data so we can get visibility. And that almost always is a hyper heterogeneous environment, especially when you start to drive the applications (mumbles), maybe some in GCP, maybe some in Azure. They all have different formats. They've got different virtualization technologies that represent all those different on prime renditions. So I think that the world continues to get more complex. And the more that we can help the community, corral the community into here are buying centers and here are pinpoints, use the technology to finish and deliver that curated experience, the easier it is and the better it is for our customers. >> Doug I know you're super busy and you got to go, so last question. We've seen Splunk go from startup, pre IPO, successful IPO, couple bumps along the way. Now you guys are over a billion dollars. I feel like there's much more to come. The ecosystem is growing, the adoption is really, really solid. The richness of the platform continues to grow. Where do you see it going from here? >> I really do believe in my heart, my deepest heart, that this is the next five, ten, 20 billion dollar organization out there. And it's less the money than the representation of what that means. Reaching millions to tens of millions to hundreds of millions of people with these curated experiences, with these solutions within sights across hundreds of thousands to potentially millions of different entities out there, organizations, whether it's non-profit, governmental, commercial. We are, Mark Endreessen is famous for saying, "The world is becoming a software world." I agree. I take it one step further. I think the world is becoming a data driven and a data inside world. Software is key to that but you implement software so you can get insights and be intelligent and sense and respond and continue to iterate and grow. And I believe that Splunk is the best position company and technology on the planet right now to lean in and make this practical and approachable for the millions of end users and the hundreds of thousands of organizations that need that capability. >> So much more to talk about with Doug Merritt. Thanks so much for coming brother. >> Thank you. >> Really a pleasure having you. >> Thank you George. >> Alright keep it right there everybody, we'll be back with our next guest. This is #splunkconf17, check that out. Check out #cubegems. This is The Cube. We're live, right back from the D.C. Bye bye. (electronic pulse music)