>>live from Las Vegas. It's the Cube covering Splunk dot com. 19. Brought to you by spunk >>Welcome back, everyone to keep live coverage here in Las Vegas for Splunk dot com. 10th anniversary. 10 years of doing their big customer shows. Cubes. Seventh year of covering Splunk I'm John Ferrier, Host Cube. Our next guest is Cube. Alumni seem Haji, senior director and head of platform on industry for Splunk Knows the business way last topped. 2014 Great to see you. >>Good to see you again, John. You've been busy. I have. It's been a busy time. It's Plunk. >>You have been in the data business. We've been following your career for the years. Data stacks now Splunk on other endeavors. But you've been in the data, even swim in the data business. You've seen clouds scale, you understand. Open source. You understand kind of big dynamics. Splunk has a full enabling data platform. Started out with logs keeps moving along the by companies that interview. But this'll platform concept of enabling value valued customers has been a big part of the success that it continues to yield success every year. When people say no, what is successful data playful because everyone wants to own the data layer because we just want to get value on the data. So what as a product market, our product person, what is the date of platform? >>So it's really a question and, you know, you gonna hit the nail on the head when you said we've been talking about the data platform for several years, like decades. Almost so if you think about, you know, data platform, like, way back when and I'm dating myself. When I graduated from college, you know, people were looking for insights right there. Like give me a report, give me a dashboard way. Went into data, databases of data, warehouses. Enabling this you actually think about the data platform or data to everything. Platform is, as we explore. Call it. It has five critical elements in my in my mind. You know, the first is how do you get all of your information? Like the data that's coming in from networks, logs, applications, people, you and I generate a ton of data. How do we get this all together into a single place so you can get insights on it? 1 may think that it's pretty easy, but the truth is, we've been struggling as an industry with for decades. So it's fun to think what super unique is you can actually bring in any of the data. And some of the challenges that customers have had in the past is way forced them to structure this state of before they can ask questions of it. What's wrong? It's free form. You can bring it in any information and then structured when you're ready to ask that question. So you know a data platform. Number one is flexibility in the way you bring your data second. And you know this being the business is getting real time insights, alerts on your phone, real time decision ing and then you have, you know, operating in different ways on cloud on premises, hybrid environments. That's the third. And I think the fourth and the fifth are probably the most important, and into related is allowing like a good data platform caters to everyone in the or so from your most non technical business user to the most technical data admin I t. Guy security analysts with giving them the same information but allowing them to view it in many different ways and ask different questions of it. So we call this, you know, explained is from a product marketing in a business standpoint way Refer to it as many lenses on your same data. Good data platforms do that while allowing an empowering different users. So those are the five in my >>love kicking out on platform converses. Second, we could talk for now, but I know you got busy. I want to ask you all successful platforms in this modern era of rocket texture. When you get cloud scale, massive data volumes coming in need key building blocks. Take me through your view on why Splunk been successful plateau because you got a naval value from the dorm room to the boardroom. So we've gotta have that use case breath what you do. What key building blocks of this point. Data platform. >>Great question. And, you know, we've we've kind of figured this out is a cz. Well, a cz have been working on building out these building blocks at a most critical customers, right? Did you think about it? You start with the core, the index, if you will. And that's your place to bring you know, slung started with all your logs together and it's your single go to place then, as you think about it, with working with customers, they need massive date engines. So what we just announced today the general availability of data stream processor and data fabric search. It allows you to have those two massive engines from How do I bring my streaming data in to have Can I do massive scale processing? Thea other elements around a machine learning right. So in a world where we're moving to automation, that's super critical to the success. And then you have consuming the way you consume insights or uses consuming sites. If you think about you and I and this amount of time we spend on our phone, how do we make it easy for people to act on their information to those your core platform building blocks give index. You have your date engines, you have a I am l. You have your business analytics and then you have your portfolios on top, which is use case specific, if you will. For I t for security and then for de mops. >>That's awesome. And let's get into the news you were your product. Kino today? Yes, they was opening day. But I want to read the headline from Lung press release and commentary. Don't get your reaction to it. Splunk Enterprising X Man's data access with data fabric search and data stream processor powers Uses with context and collaboration keywords context in their collaboration. House search is a hard problem. Discovery. We've seen carnage and people trying things. You guys do a lot of data. Lot of diverse date has been a big team here, right? Your customers have grown with more data coming in. Why these two features important. What's the keys? Behind the fabric search on the data processor is that the real time is the date acceleration. What are some of the key value points? What people know about the fabric surge processor. >>So actually, let me start with the data stream processor. You know, with DSP, what we're really doing is looking at streaming data. So when you think about the real time customers I ot sensor data, anything that's coming on the wire data stream processor lets you bring that in display. Now, the uniqueness of data stream processor is you wanted Thio, you didn't have to bring it in. Splunk. You can actually like process that live on the wire and it works just as well. Not do fabric search. It's, you know, you alluded to this earlier. It's how do you search across your massive data leaks warehouses that exist without having to bring it all in one place. So in the product, he notes Demo. Today we showed a really cool demo of a business and bliss user, really solving a business problem while searching across S three Duke and data that's sitting in instruct and then with the fabric search, you can also do massive, like federated, like global size searches on the context and collaboration. That's really once you have all this data in Splunk, how do you How do you like your users? Consume it right? And that's the mobile connected experiences A cz well, a cz Phantom and Victor Rapps like really activating this data in automating it. >>I want to get your thoughts on something that we've been seeing on the Q. And I've been kind of promoting for about a year now, and it really came back for you. Go back to the early days of duping big data. And, you know, you know, those days getting diverse data is hard. And so because it's a different formats on the database scheme is Andorran structured to find that databases in a way hamper hinder that capability. We've been saying that diverse data gives a better machine, makes machine learning better. Machine learning is a day I provides business benefits. This flywheel is really important. And can you give an example of where that's playing out and spunk? Because that seems to be the magic right now. Is that getting the data together, knowing what day it is? No blind spots. As much as that is, it's possible. But getting that flag will doing better. Better diverse data, better machine learning better. Ay, I better I better business value. I >>think it comes down to the word divers, right? So when you're looking at data coming in from many different sources, you also get a holistic perspective on what's going on in your business. You get the insight on what your customers may be doing in engaging with your business. You get insight on how your infrastructure is performing and the way you can optimize people to the business from you know you need to. The ops and operations is to like how customers are working and interacting with your business. The other piece is when you think about machine learning in the I A. CZ, you automate this. It's a lot easier when you have the holistic context, right? So, you know, diverse data means more context. More context means better insight into what you're trying to get to. It's just gonna rounds out. The perspective I often refer to it is it's adding a new dimension to something you already know >>and opens up a whole nother conscious around. What is the practitioners? Role? Not just a database administrator is setting up databases because you're getting at, you know, context is important. What's the data about the data? What dough I keep what should be addressable foran application. Is this relevant content for this some day, it is more valuable than others at any given time, so address ability becomes a big thing. What's your vision around this idea of data address ability for applications? >>So, you know, just going back to what you said about the administrators and the doers we call them the doers there. The innovators right there. The bill, people building the cool stuff. And so when you actually can bring these elements in for them, you really are giving them the ability to innovate and do better and have that accessibility into the information and really kind of like, you know, like Bill the best that they could write. So, you know, we've been saying Turn data into doing and it really is true. Like these are again the architects of what's happening and they're the people, like taking all this diverse data, taking the machine, learning, taking the technology of the building blocks and then turning it into, like, hold doing that we d'oh! >>It's interesting with markets change him. It actually changed the role of the database person makes them broader, more powerful. >>Yes, and because you know they're the ones fueling the business. >>Thanks for coming. I really appreciate the insight. I wish we had more time on a personal question. What's exciting You in the industry these days? Actually, you're exploring. Companies continue to grow from start up the i p o massive growth now to a whole nother level of market leadership to defend that you put some good products out there. What? What are you getting excited about these days from tech standpoint? >>You know, I think it's we're finally getting it. We're finally getting what you know. Being a data to everything. Platform is, for example, right after the keynote. I had more than a few people come up to me and say, Well, you know, that made sense, right? Like when we think about Splunk is the data to everything platform on what data platforms are meant to dio and how they should operate. So I think the industry is finally getting their What's exciting me next is if you look behind us and all the industry traction that we're seeing. So you know, taking technology and data beyond. And really enabling businesses from financial service is to healthcare to manufacturers to do more. You know, the businesses that traditionally, like, maybe have not been adopting technology as fast as software companies. And now we're seeing that, and that's super exciting. >>You know, I always get into these kind of philosophical debates with people. Either on the Cube are are off the Cube, where you know what is a platform success look like, you know, I always say, I want to get your reaction to this. I always say, if it's got applications or things being enabled value on a healthy ecosystem, so do you agree with that statement? And if so, what's the proof points for Splunk on those two things? What is defining that? What a successful platform looks like? >>You know that I do agree with you. And when I think about a successful platform, it's if I look around this room and just see how you know, like New York Presbyterian as using Splunk Thio like we heard from Dell today an intel. So when you see the spectrum of customers using Splunk across a variety of successes, it's that super exciting to me that tells me that you know what it is everything when you say date it. Everything >>all right? We got a fun job these days. >>D'oh to be here. So it's great. >>Great to see you. Thanks for coming back on the Cube. I'm looking forward to catching up. I'm John Kerry here on the Cube. Let's see what she's awesome. Cube alumni from 2014. Now it's blonde leading the product efforts and marketing. I'm John. Where were you watching the Q. Be right back after this short break

>>live from Las Vegas. It's the Cube covering Splunk dot com. 19. Brought to You by spunk >>Hey, welcome back. Everyone's two cubes coverage here in Las Vegas for spunk dot com. 19 dot com 19. This is slugs. 10th year doing dot Com Cube seventh year of coverage. We've watched the progression have security data market log files. Getting the data data exhaust turned into gold nuggets now is the centerpiece of data security, data protection and a variety of other great things and important things going on. And we're here to great guests from slug i n songs. Vice president and general manager of security markets and Friedrichs, a VP of security automation. Guys, great to see you again. We just saw you and there's reinforce. Thanks for coming back. >>Thank you for having us. >>So you guys announced security operation Sweet last year. Okay, now it's being discussed here. What's the update? What our customers doing? How are they embracing the security piece of it? >>Wow. Well, it's being a very busy year for us. Way really updated the entire suite. More innovation going in. Yes, six. Tato got announce and phantom and you be a every product is getting some major enhancement for concealing scale. For example, years now way have customers running in the cloud like 15 terabytes, and that's like three X and from It's like 50 terrifies 50 with Search has classes. So that's one example and fend him throughout the years is just lots of capabilities. We're adding a case. Management was a major theme, and that's actually the release before the current one. So we'll be, really, you know, 80 and focusing on that just to summarize sort of sweet right. You be a continue to be machine learning driven, and there's a lot of maturity that's that's going into the product, and there's a lot of more scale and backup. Restore was like one of the major features, because become more mission critical. But what's really, really, really exciting? It's how we're using a new product called Mission Control to bring everything all together. >>I want to get into the Mission control because I love that announcement. Just love The name was behind it, but staying on the sweet when they're talking about it's a portfolio. One of the things that's been consistent every year at dot com of our coverage and reporting has been wth e evolution of a platform on enabling platform. So has that evolves? What does the guiding principles remain? The same. How you guys sing because now you're shipping it. It's available. It's not just a point. Product is a portfolio and an ecosystem falling behind it. You know the APP, showcase, developer, Security and Compliance Foundation and platforms on Just I T ops and A I ops are having. So you have a variety of things coming out of for what's the guiding principle these days is continuing to push the security. You share the vision >>guiding principle and division. It's really way believe the world. As we digitize more as everything's happening, machines speed as people really need to go to analytics to bring insides into things and bring data into doing that's that's really turning that into doing so. It's the security nerve center vision that continue guide what we do, and we believe Security nerve center needs really data analytics and operations to come together and again, I'm gonna tell you, Mission Control is one of the first examples that we bring all of the entire stack together and you talk about ecosystem. It takes a village is a team sport. And I'm so excited to see everybody here. And we've done a lot of integrations as part of sweets to continue to mature more than 1900 AP I integrations more than 300 APS. Justice Phantom alone. That's a lot of automated actions. People can take >>the response from the people in the hallways and also the interviews have been very positive. I gotta get to Mission Control. Phantom was a huge success. You're a big part of building taking that into the world now. Part was flung. Mission Control. Love the name Mission Control. This is the headline, by the way, Splunk Mission Control takes off super sharp itching security operations. So I think Mission Control, I think NASA launching rockets Space X Really new innovation. Really big story behind his unification. You share where this came from, what it is what's in the announcement? >>Yeah. So this is all about optimizing how sock analysts actually work. So if you think about it, a sock typically is made up of literally a dozen different products and technologies that are all different consuls, different vendors, different tabs in your Web browser, so it for an analyst to do their job literally pivoting between all of these consoles. We call it swivel chair syndrome, like you're literally are frantically moving between different products. Mission Control ties those together, and we started by tying slugs products together. So we allow you to take our sin, which is enterprise security, or you be a product's monkey. Be a and phantom, which is our automation and orchestration platformer sore platform and manage them and integrate them into one single presentation layer to be able to provide that unified sock experience for the analyst So it it's an industry first, but it also boosts productivity. Leading analysts do their job more effectively to reduce the time it takes. So now you're able to both automate, investigate and detect in one unified presentation, layer or work surface. >>You know, the name evokes, you know, dashboards, NASA. But what that really was wasn't an accumulation, an extraction of data into service air, where people who were analysts do their job and managed launching rockets. But I want to ask you a question. Because of this, all is based on the underpinnings of massive amounts of volume of data and the old expression Rising tide floats all boats also is rising tide floats, Maur adversaries ransomware attacks is data attacks are everywhere. But also there's value in that data. So as the data volume grows, this is a big deal. How does mission Control help me manage to take advantage of that all you How do you guys see that playing out? >>Yes, Emission control really optimizes the time it takes to resolving incident. Ultimately, because you're able to now orient all of your investigation around a single notable event eso It provides a kn optimal work surface where an analyst can see the event interrogated, investigated triage, they can collaborate with others. So if I want to pull you into my investigation, we can use a chat ops that capability, whether it's directly in mission control or slack integration waken manage a case like you would with a normal case management toe be ableto drive your incident to closure, leveraging a case template. So if I want to pull in crisis communications team my legal team, my external forensics team, and help them work together as well. Case management lets me do that in triage that event. It also does something really powerful. High end mentioned. The operations layer the analytics in the data layer. Mission Control ties together the operational layer where you and I are doing work to the data layer underneath. So we're able to now run worries directly from our operational layer into the data layer like SPL quarries, which spunk is built on from the cloud where Mission Control is delivered from two on premise Face Plunk installations So you could have Michigan still running in the Cloud Splunk running on premise, and you could have multiple Splunk on premise installs. You could have won in one city, another one in another city or even another country. You could have a Splunk instance in the Cloud, and Mission Control will connect all of those tying them together for investigative purposes. So it's very powerful. >>That's a first huge, powerful when this comes back to the the new branding data to everywhere, and I see the themes everywhere, the new colors, new brake congratulations. But it's about things. What do ours doing stuff, thinking and making things happen. Connecting these layers not easy, okay? And diverse data is hard. Thio get access to, but diverse data creates great machine learning. Ay, ay, ay, ay, ay creates great business value. So way see a flywheel development and you guys got going on here. Can you elaborate on that? Dated everywhere And why this connective tissue that you're talking about is so important? Is it access to the war data? Is that flywheel happening? How do you see that playing out? >>I'll start with that because they were so excited where data to everything company or new tagline is turning data into doing. And this wouldn't be possible without technologies like Phantom coming in right way have traditionally been doing really great with enterprise was data platforms. And with an Alex now was phantom. We can turn that into doing now with some of the new solutions around data stream processing. Now we're able to do a lot of things in real time. On you mentioned about the scale, right scales changes everything. So for us, I think we're uniquely positioned in this new age of data, and it's exploding. But we have the technology to help your payment, and it's representing your business way. Have the analytics to help you understand the insights, and it's really the ones gonna impact day today enabling your business. And we have two engine to help you take actions. That's the exciting part. >>Is that what this flywheel, because diverse data is sounds great, makes sense more data way, see better? The machines can respond, and hopefully there's no blind spots that creates good eye. That kind of knows that if they're in data, but customers may not have the ability to do that. I think that's where the connecting these platforms together is important, because if you guys could bring on the data, it could be ugly data on his Chuck's data data, data, data. But it's not always in the form you need. Things has always been a challenge in the industry. How do you see that Flywheel? Yeah, developing. >>Yeah, I think one of the challenges is the normalization of the data. How do you normalize it across vendors or devices, you know. So if I have firewalls from Cisco, Palo Alto Checkpoint Jennifer alive, that day is not the same. But a lot of it is firewall blocked data, for example, that I want to feed into my SIM or my data platform and analyze similarly across endpoint vendors. You know you have semantic McAfee crowdstrike in all of these >>vendors, so normalization >>is really key and normalizing that data effectively so that you can look me in at the entire environment as a single from a single pane of glass. Essentially, that's response does really well is both our scheme on reed ability to be able to quarry that data without having a scheme in place. But then also, the normalization of that data eyes really key. And then it comes down to writing the correlation searches our analytics stories to find the attacks in that data. Next, right. And that's where we provide E s content updates, for example, that provide out of the box examples on how to look for threats in that data. >>So I'm gonna get you guys reaction to some observations that we've made on the Q. In the spirit of our cube observe ability we talked to people are CEOs is si sos about how they cloud security from collecting laws and workloads, tracking cloud APS and on premise infrastructure. And we ask them who's protecting this? Who is your go to security vendors? It was interesting because Cloud was in their cloud is number one if it's cloud are not number one, but they used to clear rely on tools in the cloud. But then, when asked on premise, Who's the number one? Splunk clearly comes up and pretty much every conversation. Xanatos. Not a scientific survey, it's more of it handpicks. But that means it's funk is essentially the number one provider with customers in terms of managing those workloads logs across ABS. But the cloud is now a new equation because now you've got Amazon, Azur and Google all upping their game on cloud security. You guys partner with it? So how do you guys see that? How do you talk cutters? Because with an enabling platform and you guys are offering you're enabling applications. Clouds have Apple case. So how do you guys tell that story with customers? Is your number one right now? How do you thread that needle into this explosive data in the cloud data on premise. What's the story? >>So I wish you were part of our security super session. We actually spent a lot of energy talking about how the cloud is shifting the paradigm paradigm of how software gets billed, deployed and consumed. How security needs to really sort of rethink where we start, right? We need to shift left. We need to make sure that I think you use the word observe ability, right? T you got to start from there. That's why as a company we bought, you know, signal effects and all the others. So the story for us is start from our ability to work with all the partners. You know, they're all like great partners of ours AWS and G, C, P and Microsoft. In many ways, because ecosystem for cloud it's important. We're taking cloud data. We're building cloud security models. Actually, a research team just released that today. Check that out and we'll be working with customers and building more and more use cases. Way also spend a lot of time with her. See, So customer advisory council just happened yesterday talking about how they would like us to help them, and part of that they were super super excited. The other part is what we didn't understand how complicated this is. So I think the story have to start in the cloudy world. You've gotto do security by design. You gotta think about automation because automation is everywhere. How deployment happens. I think we're really sit in a very interesting intersection off that we bring the cloud and on prime together >>the mission, See says, I want to get cameras in that room. I'm sure they don't want any cameras in the sea. So room Oliver taking that to the next level. It's a complexity is not necessarily a bad thing, because software contract away complexity is from the history of the computer industry that that's where innovation could happen, taking away complexity. How do you see that? Because Cloud is a benefit, it shouldn't be a hindrance. So you guys were right in the middle of this big wave. What? You're taking all this? >>Yeah. Look, I think Cloud is inevitable. I would say all of our customers in some form or another, are moving to the cloud, so our goal is to be not only deliver solutions from the cloud, but to protect them when they're in the cloud. So being able to work with cloud data source types, whether it's a jury, w s, G, C P and so on, is essential across our entire portfolio, whether it's enterprise security but also phantom. You know, one exciting announcement that we made today is we're open sourcing 300 phantom maps and making making him available with the Apache to get a license on get hubs so you'll be able to take integrations for Cloud Service is, like many eight of US service is, for example, extend them, share them in the community, and it allows our customers to leverage that ecosystem to be able to benefit from each other. So cloud is something that we work with not only from detection getting data in, but then also taking action on the cloud to be. Will it protect yourself? Whether it's you, I want to suspend an Amazon on your instance right to be able to stop it when it's when it's infected. For example, right those air it's finishing that whole Oodle Ooh and the investigate monitor, analyze act cycle for the cloud as we do with on from it. >>I think you guys in a really good position again citizen 2013. But I think my adjustment today would be talking to Andy Jackson, CEO of AWS. He and I always talk all the time around question he gets every year. Is Amazon going to kill the ecosystem? Runs afraid Amazon, he says. John. No, we rely on third party. Our ecosystem is super important. And I think as on premises and hybrid cloud becomes so critical. And certainly the Io ti equations with industrial really makes you guys really in a good position. So I think Amazon would agree. Having third party if you wanna call it that. I mean, a supplier is a critical linchpin today that needs to be scalable, >>and we need equal system for security way. You know, you one of the things I shared is really an asymmetric warfare. Where's the anniversary? You talk about a I and machine learning data at the end of the day is the oxygen for really powering that arm race. And for us, if we don't collaborate as ecosystem, we're not gonna have a apprehend because the other site has always say there's no regulations. There's no lawyers they can share. They can do whatever. So I think as a call to action for our industry way, gotta work together. Way got to really sort of share and events or industry together. >>Congratulations on all the new shipping General availability of E s six point. Oh, Phantoms continue to be a great success. You guys on the open source got an APB out there? You got Mission Control. Guys, keep on evolving Splunk platform. You got ABS showcase here. Good stuff. >>Beginning of the new date. Excited. >>We're riding the waves together with Splunk. Been there from day one, actually 30 year in but their 10th year dot com our seventh year covering Splunk. I'm John Ferrier. Thanks for watching. We'll be back with more live coverage. Three days of cube coverage here in Las Vegas. We'll be right back.