>> Narrator: Live, from Washington D.C., it's theCUBE. Covering .conf2017, brought to you by Splunk. >> Well, welcome back to .conf2017. Here we are at Splunk's annual get together, with Dave Vellante, I'm John Walls. We are live in the Walter Washington Convention Center, in beautiful Washington D.C. I say that, proud to be a native. Actually raised here, lived here, fly the flag here. >> Wow. >> This is my place, Dave. >> Listen, I love this city. >> I do too. >> I love coming down here. Lots to do, my son's down here, so. >> But if we weren't here, where should we be, maybe on the deck of a Carnival cruise line ship right now? >> That would be good. >> I would like that. >> I would love to have theCUBE on the deck of a Carnival >> Maybe, maybe Ruel Waite can swing that. What do you think? Ruel Waite joins us. He is the manager of delivery and support for Carnival. And you got room for two on the next ship out of Miami? >> Listen, man, for you guys anything. >> I love that. Alright, you're hired. >> I can make it happen. >> Outstanding. Alright Ruel, thanks for being here with us. >> No problem. >> On theCUBE, glad to have you, and here at the show as well. Alright, so let's talk about first off, Splunk. What are you doing? Let's back up, in terms of what you do. Your core responsibilities and then we'll get into Splunk story after that. >> Yeah, so I manage the support operation for our ecommerce platform, as well as for the guest facing ship board application. So the ecommerce platforms is where you go and purchase your cabin on the web. You would also be able to purchase your show excursions, your spa treatments, as well. Or we have an e-retail site where if you have a friend who's sailing you can buy a bottle of champagne and have it in their room for when they get there. So all those purchasing perks now that we support on the ecommerce platform. And then the guest facing application, Shipboard, we're talking 'about the mobile application where guests chat and interact with each other or plan their day. We're talking about the Pixels application where guests are purchase their photos that they take throughout their cruise. And their some facial recognition stuff there as well. And the iTV that's in your room. So we have a separate, many different sort of applications that fit under that portfolio. >> Let's talk about the data. >> Yes. >> A lot of data that you just created. >> Right? >> Yup. >> What's the data pipeline look like, where does Splunk fit? >> We Splunk as much as we can and we're continuing to build that as we go. Our application logs are Splunk, everything we produce from the application. Also our performance metrics from our servers and our data and our network, and all those systems, we Splunk that because that's critical for us to triage issues that occurring. Because our operation is about monitoring what's happening, it's about resolving issues as quickly as possible, and it's about communicating to our business. So those three things are data essential to all of that. So we need to get as much as we can and we need to be able to get insights into it. >> Can you talk about where you started, you had mentioned off camera about four years ago, and how you've been able to inject automation into your processes and just take us through your journey. >> Yeah, so we started a few years ago with Splunk, and it was primarily a triage tool for us. So an incident would occur, we'd try to get it, and look at some logs, figure out what's going on. And as we've evolved it's become more of a proactive alerting tool for us, it's become a communication tool, a collaborative tool, for us. You know, we leverage things like the ITSI, right. That allows us to understand the base line behavior of our system. Once we base line that then we can understand the spikes, we can understand when things are changing, and that allows us to react and quickly identify things, defects in our system, things that are occurring, and resolve them. So once we kind of got our legs around okay, we get how to use Splunk to find stuff, now let's figure out how to get Splunk to tell us stuff. >> Okay. >> Right? And now once Splunk is telling us stuff, let's figure out how we tell the business that stuff. So that's kind of how we the journey we've had with Splunk. >> And Splunk's in that thread the whole way? >> The whole way. >> So from, >> The whole. >> So, ultimately then, right now what are you putting into practice that you didn't have available >> Yeah, sure. >> two, three years ago? >> Yeah sure, so one of the challenges we had was, with a typical ecommerce site you have several layers of the application, right. You have your web server, you have caching infrastructure, you have a database server, yet we have a mainframe reservation system as well. So there are several things involved with supporting all those different platforms. Now when we have an incident, it's sometimes challenging to, you know you get somebody on the phone, you're like hey what are you seeing over there on the mainframe side? Well I see this error occurring. Oh and the database side they're telling you okay, we're seeing some sort of timeout here, but we're not sure if it's related to the same thing you're talking about. And we didn't have a way to tie it together. But by using Splunk Transactions what we decided to do was we decided to log the session ID, the web servers session ID across all our layers, right, and push that through, and that allows us to tie those transactions together across those layers. And now when we have an incident we're able to, when we're talking to the mainframe we're saying hey guy, hey go look at this. And he say here's what I'm seeing. >> You can isolate it? >> We can isolate it, we can pull it together, and it's really helpful. >> So will you get to the point, or you were trying to get to the point, where you can automate the remediation? Or is that something you don't want to do 'cause you want humans involved? >> You know, automation is good. And whatever we can automate we try to do that. At this point we're not automating the resolution through Splunk at this time, but what we are doing is we are providing the on call, or the engineer that are responding with as much information as we can in order to have them quickly flip that switch. So if we have an alert that we know, hey this issue requires a recycle of an application pool, or some kind of other action like that, we can put that in our Splunk alert. And we say hey we're seeing this issue occur. That email and that text message that goes out actually tells the engineer that these are the suggested actions that you can take in order to quickly resolve this issue. >> Ruel, what are you hearing from the business side? What are the business drivers and how is that effecting what you're doing in IT generally, and specifically with data and Splunk? >> Okay so from business side we're looking at most bookings is the one of the major metrics that we look at. And our guest experience. So and on the web that means the site needs to be available, it needs to perform, and it needs to work. So what we really are trying to do with Splunk is understand those issues that are impacting our guests on the booking side. What that means is we need to know how well we're converting. And if we're looking at homepage performance, and we can now tell hey if our homepage loads in five seconds verses three seconds, there are how many fewer people make it to our payment page, which is huge for us. So that's something that we really try to hone in on. And it really helps us to collaborate with the business and understand, really, what is the revenue impact of these IT metrics that we're spitting out. >> But there could be other factors involved in that too, >> Yes. >> other variables, right? >> There are. >> You can't just you know this is, but you have enough of a track record the are a couple reasons to say okay, five seconds means this, we get a 30% conversion rate. We get three seconds, man, we got 'em hello, and, now we have a 50%, whatever. >> Yeah, but that is where, what I'm excited about at the conference is the machine learning capabilities that we've been hearing about. 'Cause that will allow us to then model how those different factors that go into when someone goes from the homepage to payment, you're totally right. There's several things that go into that. And what we want to be able to model, hey, on a normal day here's our guest behavior, whether we have a sale, how do our guests behavior differently, or on a Monday night at eight PM what is the behavioral trend. So it's all important to us. And getting the data behind it and being able to model that is going to be really key for us. >> Connect the dots for me on >> Yes. >> how you use machine learning, and how will that affect the business? You'll make different offers at different times, or? >> So what I mean is if I understand how guests behave I will know if I'm having an issue on the site. If there's something happening that's impacting their ability to book. 'Cause sometimes you do a release, you do your quality control, and then you go home, everything looks good. And sometimes hours later, sometimes days later unfortunately, something pops up that you introduced during that release. And understanding what that baseline is, right. So what Splunk has allowed us to do is say okay, here's what normal behavior is. And we're trying to grow this more, but what we've been using ITSI to say here's what that behavior really is. Based on what we kind of know are the metrics around booking. Here's what that behavior is. And we do a release and we see a spike, a change, and now we're able to say wait a minute, we never saw this error before. This error never existed in our system at any point. That was definitely something that was introduced right here in this release, we need to go ahead and resolve this as well. And sometimes you get some false positives there, if your development team is doing change the way they log a little bit you might get a spike. But that's cool because you get to go in immediately and figure out what those changes are, and you get a comfort level that you kind of understand how your system works. >> Let me ask you another question. You got some experience with Splunk. >> Yes. >> Obviously, you were just working with them. What, in your mind, is on their to do list? What do you want to see out of them? Doug, if I'm Doug. Tell me, where should I go, what should I do. >> What do I want Splunk to do. >> Any gripes, give me the good, the bad, and the ugly. >> For me, it's performance, performance, performance. I want to see my queries run as quickly as possible. I want to see things fast. I want to hit the button and it happens right away. Now obviously that's not going to, that's not realistic. But I like what some of the things that Splunk are doing. You look at the new metrics index that they've been talking about the last two days. So they've now isolated your time serious data and they're able to optimize the searches on time serious data seperate from your application logs. So, you know, your CPUs, your memory consumption, that data is not the same as your logging an error, or logging that a booking was created, or something like that. Those are kind of two different things. So they have kind of decoupled that and they're saying anything that's time serious I'm going to put it over here. And I'm going to optimize that query, and then you can handle your other logs separately. But the additional benefit of that is then you can take your time serious and you can look at a CPU spike and then you can take your event data and overlay it on top. And then you can see, hey wait a minute, this event is what caused that spike. So that's where the cool is. >> I think they call that mstats. Is that right, mstats? >> Yes, it's mstats, yes. >> How 'about the stuff that you saw this week in the keynotes, particularly today was the product stuff. A lot of security obviously. Anything that you've seen here at the show that excites you, that you really said alright, I got to have that, I got to learn more? >> Yeah, so the ITSI event analytics really seems like something's going to be cool for us. As I've said before, we utilize ITSI internally. So we put together a glass table that's shows us here are all the different components and the hierarchy of things. And when this goes red it effects these other layers. And it's really cool. But what they've added in is the ability to click a button and drill in to those components and then you have a view of hey, here are the events associated with that. That's really cool because now you're triaging in one place, now you get to the problem really quick. And you can emote directly into your Splunk queries. It really allows what we're looking for is just to resolve issues as quickly as possible. >> And you're describing, if I understand this correctly, you can visualize the dependencies, and you can take remedial action or identify, inform the business what to expect. >> Exactly. >> Be much more proactive, that's what people are talking about. >> Yeah, yeah. And we found that one of the surprising things we found with Splunk is that our business are users of Splunk as well, right. So it's always an IT tool, it's something that only the geeks are going to look at. And then all of a sudden you present a dashboard to a business user and they go ah. That's pretty, right. And then all of a sudden they want it more than you do. So that's what makes it great right, 'cause you can present the data however you want and you can put it in a way that different audiences can consume. And so it becomes a platform that goes across the organization, which is really, really cool. >> John: But your bottom line's all speed right? >> Yes, yeah. >> Take care of my problems faster, get my customer faster, deliver faster, come on Splunk. >> Come on, let's go. >> We want to go. >> Brings the weekend faster. >> Right, right. >> Get more sleep, get more sleep. >> Ruel, thanks for being with us. >> Oh. >> We appreciate that. >> And, we'll talk about the cruise. Leonard Nelson, our producer over here already said book him for a massage, the presidential suite. He wants one night, and then the champagne buffet please. >> It's done. >> Fast internet, though. >> Yeah. >> Fast internet, yeah. It's done. >> Alright. We're simple people, we don't need all that, but we'll talk later. >> Alright man, appreciate it, thank you. >> Thank you for being with us. Ruel Waite joining us from Carnival. Back with more from Splunk, .conf2017. 2015, where did that come from? 2017, it's been a long day. (upbeat music)