>> Announcer: Live from Orlando, Florida it's theCUBE. Covering .conf18. Brought to you by Splunk. >> Hi everybody welcome back to Orlando. You're watching theCUBE, the leader in live tech coverage. We go out to the events, we extract the signal from the noise. My name is Dave Vellante, I'm here with my co-host Stu Miniman. This is day one of .conf18, Splunk's big user conference. You know we're talking a lot about AI at these conferences, talking a lot about data, one of the enablers is semiconductors, the power of semiconductors, and the cheap storage, have enabled people to ingest a lot of data. And when you look into the supply chain, beneath the semiconductors, there are companies who provide semiconductor equipment. One of those companies is Applied Materials and Amudha Nadesan is here, he's a senior manager at Applied Materials, symbol AMAT. Welcome Amudha, thanks for coming on theCUBE. >> Yeah, thank you, thank you for inviting me. >> You're welcome. So as I say, there's a semiconductor boom going on right now, which is obviously a great tailwind for your business. You're on the data side, obviously. >> Right. >> Dave: Getting your hands dirty. Give us a sense of your role and we'll get into it. >> Yeah, so I'm a senior manager in the software group of the Applied Materials actually. So Applied's core business is always the hardware which is the semiconductor and display equipment manufacturer, so every new chip that was kind of manufactured, or any new display equipment displays coming out, that's manufactured using the Applied tool actually. We are the software world that kind of interfaces with the Applied tools, so we get all the data from the Applied tools and non-Applied tools, and we kind of do all the analytics using our software, actually. So, I'm kind of the technology group leader within the automation products group, so we are responsible for bringing in the new technologies into our products, actually. And our products, now we are kind of trying to align with the industry for final principles, so we are trying to bring in all the new technologies like mobility, virtualization, IoT, then predictive monitoring, predictive analytics, all these new technologies, we are trying to kind of bring into our products right now. >> So I know that, certainly, the tolerances in the semiconductor business are so tight, and given that you're manufacturing semiconductor equipment and providing software associated with that, is it your job to try to analyze the performance and the efficacy of the equipment and feed that back to your engineers and your customers in a collaborative mode? What's the outcome that your team is trying to drive? >> So, my team's main responsibility is to kind of maintain that finite availability for all the data that is coming from the tools into our products, actually. Right so, our products need to be up and running all the time, actually. If our product stops, the production line will stop, actually, right if the production line stops, then there's going to be a big business impact, actually. So that's where we are kind of trying to leverage all these new technologies, so we can really kind of run our software with finite availability, actually. >> You mentioned three things, mobility, virtualization, prediction. There may be others. >> Right. >> So the mobility, presumably, is a productivity aspect. So people can work at home on the weekends, or wherever they are, teasing of course. Virtualization, getting more out of, that's an asset utilization play. And prediction, that's using machine intelligence to predict failures, optimize the equipment, maybe you could describe what's behind each of those. >> Yeah, I'll kind of go one by one, actually. All of our products, they are like at least twenty, thirty years old, actually. They have been all big clients, actually, running on desktops and laptops, actually. Right so now we are kind of trying to bring the user experience, where the end users who are using the UI for our products, they can get a good experience, and that can kind of improve the productivity. So that's what the mobility is. So we are kind of trying to model the latest technologies like Angular and STML for our product UI, actually. And with respect to the virtualization, we have been kind of running our softwares on physical servers, actually, in an enterprise fashion, and that is kind of taking up lot of cost, actually. So we are kind of getting into this virtualization world where we can kind of reduce the TCO of our assets actually that is running all these softwares. >> Help connect the dots with us as to how Splunk fits into your environment. >> Oh, okay, so we just got into Splunk just two years back, actually, we have close to 25 to 30 software products that kind of completely automate that manufacturing line, actually. All these products, they generate so much of logs, actually, on a daily basis. If you take in a year, they kind of generate about 100 gigs of just log files, actually, and those log files have lot of critical information within the log file, and when we didn't have the Splunk two years back, what we would do is, whenever there is a problem in our customer production line, it allows them to kind of FTP those logs, actually. And then we have to kind of manually go and scan through all those logs and identify the issue, actually. Sometimes, even to identify the issue, it takes about like a week, actually, right? And after we identify the issue, we are to come up with the resolution to kind of fix the problem, and then it takes months, sometimes. I worked on a problem, even for six months to kind of bring a resolution to it, and the customers are very upset, actually. >> Yeah, it's interesting, go back to your earlier statements, you know, we've talked for years, decades, our whole careers, about how important uptime is, and then you talk about your people and there's a lot more efficient things they could be doing if they're not looking after and doing all these manual things. You've been there 22 years, what is something like Splunk, how do you measure that, the success of the outcome of using a tool like that? >> Yeah, so right now we can see the success immediately because we have implemented Splunk, and we are kind of remotely monitoring our production lines. At least five customers, right now, we are remotely monitoring them. Every customer, they have down time at least once or twice a year, actually, so when they have a down time, if it's a small customer, they take a loss of about 10 K per hour, actually. So and if it is a medium, then probably 100 K, if it's a large, then it's 1 million actually, per hour. I have experience in the last 22 years, I've experienced at least, a customer has one to two down times a year, sometimes even more than that, actually. So after we implemented Splunk, the last two years, one of our customers we are remotely monitoring, we never had a down time, so that itself is a big success, actually, but we are not done with it yet, actually, we are continuing to innovate with Splunk on the log monitor. >> Make sure I understood what you said. So, rough rules of thumb, these things vary, we always understand that, but you say in small customers, when their down time, you said $10,000 an hour, medium $100,000 an hour, large customer's a million dollars, and probably up with huge companies. >> Yes, yeah, it really kind of depends upon, when I say a small customer, they have less number of tools, actually, which means they have less number of operators. So less number of people impact it, actually, when the production line stops, but when you go for a kind of go for a medium size, they have more tools, more people are working with those tools, they don't have to work which means right it's a disruption, actually, in the production line. And if it's a large fab, there are more number of operators actually working in the production line, so that's how we kind of calculate the loss, actually. >> When they have, right, the math is pretty simple to calculate but when they have a down time like that, do they try and make it up on the weekends? Or can they not do that because people have lives, or they are already actually running 24/7? >> It's already running 24 by seven. >> And you can't get more time in a day. >> Yeah, they can't make it over the weekend, actually it's already running 24 by seven, and when the production line stops, that means it's a revenue loss for them, and then also their operators are sitting idle actually. >> Dave: These are companies with a fab, right? >> These are companies with fab actually. >> Which is a multi-billion dollar investment oftentimes, right? >> Yes, yes. Name any semiconductor companies like Intel or Samsung, they're all using Applied tools to run their manufacturing. >> And when they're down, it's right in the bottom line. >> Yes, that's right, and they all use our softwares to kind of like completely automate their factory end to end, actually. >> Can you directly attribute the lack of down time, the reduction in that down time, to Splunk? >> That's right, actually, yeah. At least one of the customers we are remotely monitoring right now, those customers are monitored using Splunk. We are, right now, scaling up with more and more customers for the remote monitoring. >> The other thing you said is you're starting to innovate even more with Splunk, maybe you can elaborate a little on that. >> Yeah, we are trying to kind of, right now we are just using the basic machine learning algorithms that are available from Splunk for kind of doing the anomaly detection, our outlier detection, our trend analysis. So we are expecting to kind of introduce more and more machine learning algorithms that can accurately predict the servers going down, that can kind of give us more lead time to kind of proactively address the issues before the user can see an impact, actually. Currently, most of the time it is kind of more reactive, we see the issue and then we kind of react to it. We want to be more proactive and that is where Splunk is playing a big role, actually. >> Your role is customer facing, is that right? Your software is customer facing? Or are you guys using this internally as well? >> We are using both internally. Right now, it is customer facing, but our IT organization, after seeing the success with how we are kind of monitoring our customers they are also kind of adapting it, and there are other business units now who are kind of receiving lot of data from these tools actually like the sensor data from the tools, they are also kind of trying to use Splunk and see how they can kind of predict the issues in the tool more proactively or accurately. >> Splunk is not a new company. I'm just curious, and Applied Materials is obviously a huge company, you know, $35 billion market cap, why did it take you so long to find out about Splunk and adopt Splunk? Was it just organizational, was it your processes are so delicate and hardened? I wonder if you could explain. >> Yeah, so that's a very good question actually. Right so, only in the last two years we have started investing more on the R&D, especially on the software products actually. Mostly the investment was on the hardware products where they want to kind of improve the productivity, they want to kind of improve the testing methodology, all those things. Most of the investment was going to the hardware components, so they were not even looking at all these software innovations that were happening. So last two years, they're kind of investing more on the software groups actually, which they want to kind of bring it, or kind of take it to that industry 4.0 revolution, actually, right? So that's where we started investing on all, we started looking at many technologies, and one of the first technologies to adapt was the Splunk, actually. And then especially we kind of came up with this remote monitoring concept where most of our customers are, the small customers, I would say, they did not have their own IT organization, right so whenever they had a down, they had to kind of literally log a call and they had to wait for us to kind of come in, fix their problem, and it took days, actually. And they took a big impact because of that. So then they said, we don't have our own IT organization, why don't you kind of take the IT responsibilities off, keep making sure those softwares are kind of up and running all the time? So that's the time when we went to Splunk, and we got it, we implemented it, we tested it, and we are kind of seeing a good success with it, actually. >> And do you guys buy this as a subscription, or is it a perpetual license? Or how do you guys do that? >> It is a perpetual license, yeah, we have an on-prem. That's another concern with our customers, because they want to make sure their IP does not go out, actually, they don't want to put anything on the cloud. This is for every semiconductor companies, they are not there on the cloud yet, actually. So that's why we are to host the Splunk, on-prem, and kind of transfer all the data from our customers through a secure FTP, bring it to our on-prem Splunk servers and do all the analytics, actually. >> We've heard Splunk and many other companies this year and for the last couple of years talking about AI and ML. Does that resonate with you, those sort of solutions that you think you'll be looking for, that kind of functionality, how does that play into your environment? >> That's right, actually. So we are trying to kind of get into that. We have to a certain extent, we are kind of already into the machine learning algorithms, actually, but we kind of want to go more deeper into that, actually, so that currently our prediction, whatever we have built up in house, actually, our prediction algorithms can predict only 60%, actually. So that's the accuracy we could get, but we want to get somewhere in the 90% or 93% accuracy, which means we have to get more, we have to get more on the accuracy part, actually right, we have to get more accurate machine learning algorithms developed actually, so that is where we are trying to kind of see if the platform can kind of provide more of this machine learning algorithms, which can predict more accurately, actually, the problem. >> So that's data, the modeling, iterations, just time, right? You'll eventually get there. Amudha, thanks very much for coming to theCUBE, it was great to hear your story. Last question is, we hear this story of Splunk, I call it land and expand. >> Right. >> We have, you know, one use case, and then there are other use cases, is that your situation? You've only been a customer for a couple years now, do you see using Splunk potentially in other areas? >> Yes, we are trying to kind of expand to other areas, right now we started with remote monitoring, we are going to use it for IT, our IT is going to use it, and then we want to kind of go to the predictive analytics actually, that means we want to kind of look at the tool data like the data that is coming from the sensors from the tool, we want to kind of do the analytics and then make sure that we can predict the problems, we can predict the maintenance that we need to do, actually, so all those things we want to do, actually, that's the area we want to kind of more expand with, we will really kind of add value to our customers, actually. >> Amudha Nadesan from Applied Materials, thanks so much for coming on theCUBE, appreciate your time. >> Yeah, thank you. >> Alright, keep it right there, everybody, we'll be back with our next guest, I'm Dave Vellante, he's Stu Miniman, we'll be right back, you're watching theCUBE from Splunk .conf18. (techno music)

>> Announcer: Live from Orlando, Florida, it's theCUBE, covering .conf2018. Brought to you by Splunk. >> Welcome back to .conf2018 everybody, this is theCUBE the leader in live tech coverage. I'm Dave Vellante with Stu Miniman, wrapping up day one and we're pleased to have Bina Khimani, who's the global head of Partner Ecosystem for the infrastructure segments at AWS. Bina, it's great to see you, thanks for coming on theCUBE. >> Thank you for having me. >> You're very welcome. >> Pleasure to be here. >> It's an awesome show, everybody's talking data, we love data. >> Yes. >> You guys, you know, you're the heart of data and transformation. Talk about your role, what does it mean to be the global head Partner Ecosystems infrastructure segments, a lot going on in your title. >> Yes. >> Dave: You're busy. (laughing) >> So, in the infrastructure segment, we cover dev apps, security, networking as well as cloud migration programs, different types of cloud migration programs, and we got segment leaders who really own the strategy and figure out where are the best opportunities for us to work with the partners as well as partner development managers and solution architects who drive adoption of the strategy. That's the team we have for this segment. >> So everybody wants to work with AWS, with maybe one or two exceptions. And so Splunk, obviously, you guys have gotten together and formed an alliance. I think AWS has blessed a lot of the Splunk technology, vice versa. What's the partnership like, how has it evolved? >> So Splunk has been an excellent partner. We are really joined hands together in many fronts. They are fantastic AWS marketplace partner. We have many integrations of Splunk and AWS services, whether it is Kinesis data, Firehose, or Macy, or WAF. So many services Splunk and AWS really are well integrated together. They work together. In addition, we have joined go to market programs. We have field engagement, we have remand generation campaigns. We join hands together to make sure that our customers, joint customers, are really getting the best value out of it. So speaking of partnership, we recently launched migration program for getting Splunk on prem, Splunk Enterprise customers to Splunk Cloud while, you know, they are on their journey to Cloud anyway. >> Yeah, Bina let's dig into that some, we know AWS loves talking about migrations, we dig into all the databases that are going and we talk at this conference, you know Splunk started out very much on premises but we've talked to lots of users that are using the Cloud and it's always that right. How much do they migrate, how much do they start there? Bring us instead, you know, what led to this and what are the workings of it. >> So what, you know if you look at the common problems people have customers have on prem, they are same problems that customers have with Splunk Enterprise on prem, which is, you know, they are looking for resiliency. Their administrator goes on vacation. They want to keep it up and running all the time. They help people making some changes that shouldn't have been made. They want the experts to run their infrastructure. So Splunk Cloud is run by Splunk which is, you know they are the best at running that. Also, you know I just heard a term called lottery proof. So Splunk Cloud is lottery proof, what that means the funny thing is, that you know, your administrator wins lottery, you're not out of business. (laughs) At the same time if you look at the the time to value. I was talking to a customer last night over dinner and they were saying that if they wanted to get on Splunk Enterprise, for their volume of data that they needed to be ingested in Splunk, it would take them six months to just get the hardware in place. With Splunk Cloud they were running in 15 minutes. So, just the time to value is very important. Other things, you know, you don't need to plan for your peak performance. You can stretch it, you can get all the advantages of scalability, flexibility, security, everything you need. As well as running Splunk Cloud you know you are truly cost optimized. Also Splunk Cloud is built for AWS so it's really cost optimized in terms of infrastructure costs, as well as the Splunk licensing cost. >> Yeah it's funny you mentioned the joke, you know you go to Splunk cloud you're not out of a job, I mean what we've heard, the Splunk admins are in such high demand. Kind of running their instances probably isn't, you know a major thing that they'd want to be worrying about. >> Yes, yes, so-- >> Dave: Oh please, go. >> So Splunk administrators are in such a high demand and because of that, you know, not only that customers are struggling with having the right administrators in place, also retaining them. And when they go to Cloud, you know, this is a SAS version, they don't need administrators, nor they need hardware. They can just trust the experts who are really good at doing that. >> So migrations are a tricky thing and I wonder if we can get some examples because it's like moving a house. You don't want to move, or you actually do want to move but it's, you have be planful, it's a bit of a pain, but the benefits, a new life, so. In your world, you got to be better, so the world that you just described of elastic, you don't have to plan for peaks, or performance, the cost, capex, the opex, all that stuff. It's 10 X better, no debate there. But still there's a barrier that you have to go through. So, how does AWS make it easier or maybe you could give us some examples of successful migrations and the business impact that you saw. >> Definitely. So like you said, right, migration is a journey. And it's not always easy one. So I'll talk about different kinds of migration but let me talk about Splunk migration first. So Splunk migration unlike many other migration is actually fairly easy because the Splunk data is transient data, so customers can just point all their data sources to Splunk Cloud instead of Splunk Enterprise and it will start pumping data into Splunk Cloud which is productive from day one. Now if some customers want to retain 60 to 90 days data, then they can run this Splunk Enterprise on prem for 60 more days. And then they can move on to Splunk Cloud. So in this case there was no actual data migration involved. And because this is the log data that people want to see only for 60 to 90 days and then it's not valuable anymore. They don't really need to do large migration in this case it's practically just configure your data sources and you are done. That's the simplest part of the migration which is Splunk migration to Splunk Cloud. Let's talk about different migrations. So... you have heard many customers, you know like Capital One or many other Dow-Jones, they are saying that we are going all in on AWS and they are shutting down their data centers, they are, you know, migrating hundreds of thousands of applications and servers, which is not as simple as Splunk Cloud, right? So, what AWS, you know, AWS does this day in and day out. So we have figured it out again and again and again. In all of our customer interactions and migrations we are acquiring ton of knowledge that we are building toward our migration programs. We want to make sure that our customers are not reinventing the wheel every time. So we have migration programs like migration acceleration program which is for custom large scale migrations for larger customers. We have partner migration programs which is entirely focused on working with SI partners, consulting partners to lead the migrations. As well as we're workload migration program where we are standardizing migrations of standard applications like Splunk or Atlassian, or many of their such standard applications, how we can provide kind of easy button to migrate. Now, when customers are going through this migration journey, you know, it's going to be 10 X better like you said, but initially there is a hump. They are probably needing to run two parallel environments, there is a cost element to that. They are also optimizing their business processes there is some delay there. They are doing some technical work, you know, discovery, prioritization, landing zone creations, security, and networking aspects. There are many elements to this. What we try to do is, if you look at the graph, their cost is right now where this and it's going to go down but before that it goes up and then goes down. So what we try to do is really provide all the resources to take that hump out in terms of technical support, technical enablement, you know, partner support, funding elements, marketing. There are all types of elements as well as lot of technical integrations and quick starts to take that hump out and make it really easy for our customers. >> And that was our experience, we're Amazon customer and we went through a migration about, I don't know five or six years ago. We had, you know, server axe and a cage and we were like, you know, moving wires over and you'd get an alert you'd have to go down and fix things. And so it took us some time to get there, but it is 10 X better now though. >> It is. >> The developers were so excited and I wanted to ask you about, sort of the dev-ops piece of it because that's really, it became, we just completely eliminated all the operational pieces of it and integrated it and let the developers take care of it. Became, truly became infrastructure as code. So the dev-ops culture has permeated our small organization, can't imagine the impact on a larger company. Wonder if you could talk about that a little bit. >> Definitely. So... As customers are going through this cloud migration journey they are looking at their entire landscape of application and they're discovering things that they never did. When they discover they are trying to figure out should I go ahead and migrate everything to AWS right now, or should I a refactor and optimize some of my applications. And there I'm seeing both types of decisions where some customers are taking most of their applications shifting it to cloud and then pausing and thinking now it is phase two where I am on cloud, I want to take advantage of the best of the breed whatever technology is there. And I want to transform my applications and I want to really be more agile. At the same time there are customers who are saying that I'm going to discover all my workload and applications and I'm going to prioritize a small set of applications which we are going to take through transformation right now. And for the rest of it we will lift and shift and then we will transform. But as they go through this transformation they are changing the way they do business. They are changing the way they are utilizing different technology. Their core focus is on how do I really compete with my competition in the industry and for that how can IT provide me that agility that I need to roll out changes in my business day in day out. And for that, you know, Lambda, entire code portfolio, code build, code commit, code deploy, as well as cloud trail, and you know all the things that, all the services we have as well as our partners have, they provide them truly that edge on their industry and market. >> Bina, how has the security discussion changed? When Stu and I were at the AWS public sector summit in June, the CIO of the CIA stood up on stage in front of 10,000 people and said, "The cloud on my worst day from a security perspective "is better than my client server infrastructure "on a best day." That's quite an endorsement from the CIA, who's got some chops in security. How has that discussion changed? Obviously it's still fundamental, critical, it's something that you guys emphasize. But how has the perception and reality changed over the last five years? >> Cloud is, you know, security in cloud is a shared responsibility. So, Amazon is really, really good at providing all the very, very secure infrastructure. At the same time we are also really good at providing customers and business partners all of the tools and hand-holding them so that they can make their application secure. Like you said, you know, AWS, many of the analysts are saying that AWS is far more secure than anything they can have within their own data center. And as you can see that in this journey also customers are not now thinking about is it secure or not. We are seeing the conversation that, how in fact, speaking of Splunk right, one customer that I talked to he was saying that I was asking them why did you choose Splunk cloud on AWS and his take was that, "I wanted near instantaneous SOA compliant "and by moving to Splunk cloud on AWS "I got that right away." Even I'm talking to public sector customers they are saying, you know, I want fair DRAM I want in healthcare industry, I want HIPPA Compliance. Everywhere we are seeing that we are able to keep up with security and compliance requirements much faster than what customers can do on their own. >> So they, so you take care of, certainly from the infrastructure standpoint, those certifications and that piece of the compliance so the customer can worry about maybe some of the things that you don't cover, maybe some of their business processes and other documentation, ITIL stuff that they have to do, whatever. But now they have more time to do that presumably 'cause that's check box, AWS has that covered for me, right? Is that the right thinking? >> Yes, plus we provide them all the tools and support and knowledge and everything so that they, and even partner support who are really good at it so that not only they understand that the application and infrastructure will come together as entire secure environment but also they have everything they need to be able to make applications secure. And Splunk is another great example, right? Splunk helps customer get application level security and AWS is providing them infrastructure and together we are working together to make sure our customers' application and infrastructure together are secure. >> So speaking about migrations database, hot topic at a high level anyway, I wonder if you could talk about database migrations. Andy Jassy obviously talks a lot about, well let's see we saw RDS on Prim at VMworld, big announcement. Certainly Aurora, DynamoDB is one of the databases we use. Redshift obviously. How are database migrations going, what are you doing to make those easier? >> So what we do in a nutshell, right for everything we try to build a programatic reputable, scalable approach. That's what Amazon does. And what we do is that for each of these standard migrations for databases, we try to figure out, that let's take few examples, and let's figure out Play Books, let's figure out runbooks, let's make sure technical integrations are in place. We have quick starts in place. We have consulting partners who are really good at doing this again and again and again. And we have all the knowledge built into tools and services and support so that whenever customers want to do it they don't run into hiccups and they have really pleasant experience. >> Excellent. Well I know you're super busy thanks for making some time to come on theCUBE I always love to have AWS on. So thanks for your time Bina. >> Thank you very nice to meet you both. >> Alright you're very welcome. Alright so that's a wrap for day one here at Splunk .conf 2018, Stu and I will be back tomorrow. Day two more customers, we got senior executives coming on tomorrow, course Doug Merritt, always excited to see Doug. Go to siliconangle.com you'll see all the news theCUBE.net is where all these videos live and wikibon.com for all the research. We're out day one Splunk you're watching theCUBE we'll see you tomorrow. Thanks for watching. >> Bina: Thank you. (electronic music)

(upbeat music) >> Narrator: Live from Orlando, Florida. It's theCUBE, covering .conf 18 brought to you by Splunk >> Welcome back to Orlando, everybody. This is Dave Vellante with Stu Miniman You're watching theCUBE, the leader in live tech coverage. We go out to events, we extract the signal from the noise. This is day two of Splunk's big user conference #Splunkconf18 Winding down, Stu. Been quite an amazing two days just said Doug Paradon had tons of customers, a lot of security talk today. Luke Bampton is here, another security expert, he's the application security specialists with SecurePay, >> Hi guys >> from Australia. Hi, how ya doing, mate? >> Good, not bad, can you tell that I'm from Australia, or not so much from the accent? >> That rack of beer you got down there gives it away. >> Haha, yeah (laughing) >> Australians like beer or so they say. But they don't drink Fosters so I hear. >> No, no, no such thing, actually, it's yeah, >> That's great marketing to dumb Americans. >> Yeah, a very common misconception though, so kudos to you for picking it up. >> Well, we were talking about the Melbourne Cup, but we'll get back to that later. But lets talk about SecurePay. >> Luke: Sure >> What do you guys do and what's your role there? >> Yeah so, we're an online payment gateway, so we help businesses trade online facilitating e-commerce, so we're actually owned by Australia Post so, Australia's premiere mail network. So that gives us kind of a unique competitive advantage being able to sell both parceled delivery and payments facilitation all in one service to our customers. Um, makes it really compelling offering to customers have an all in one kind of one-stop shop for all their e-commence needs. >> What's your role and what are the big drivers from the business or the operations that are effecting that role? >> So my role is an Application Security Specialist, so I look after a lot of the PCI, DSS constraints, so payment card industry, data security standard. I do a lot of stuff around vulnerability management, card reviews, penetration testing, web application, firewall administration, I work very heavily with our SOC guys work very heavily with our network, security team, platform application, you name it, we do it pretty much. >> So-- >> Yeah, yeah I mean security obviously for a payment company is pretty important, maybe you can talk about you know, what was changing in the industry, how does that impact your job? >> Yeah, so financial tech or fin tech has kind of boomed in Australia. If not the world in the last like five ten years, so there are a lot of new companies, and so therefore, it's driving a lot of innovation. So big players even like SecurePay are even feeling that, feeling that desire to work faster, more agile, and be more competitive in market, and that means a lot of change, a lot of fast paced change, especially when you're dealing with industry regulation such as calculating surcharges on the flyer, making sure the people aren't skimming off the top of what is just what it's supposed to be at cost covering exercise. For our merchants, so competing with legislative changes competing with industry changes, best practice, and if payments stopped then your entire ecosystem stops, and the economy stops. >> Yeah, so, I see hear application security, and I'm a networking guy by background so I start thinking level four through say, layer four through seven. Bring us inside a little bit. What your team does and kind of solutions you're using, I would expect Splunk's, piece of it, what's the stack and security layer look like? >> Yeah, sure, so from a security viewpoint, SecurePay being a subsidiary and being a payment card provider kind of has to be stand alone, so we can't leverage, we have to manage a lot of stuff in-house, I should say. Um, so what that means is basically you have to think of it as condensing your entire organization into a team of like five, six, seven. And really making the most of your products that you've got available to you. So that means really making the most of technologies out of the firewall space, out of the application security space, code scanning, basically everything that you'd expect a full blown enterprise to do, only with a much smaller team, much smaller budget, which means you've got a lot of competing priorities all the time. >> So when you say, in house, I'm inferring that means a lot on PREM as well or not sure? >> Yeah so at the moment, we are prominently on PREM, in terms of our infrastructure, we are moving to more of a hybrid cloud, particularly with non production environmentS. But, with that said, everything's got to be to be in line with all of the network controls, all of the application controls, segmentation all the rest of it is required under PCI. As far as individual tooling is concerned, we work very heavily with Splunk in terms of the event correlation, event management, alerting. Our risk guys use it to fraud profile, and risk profile both our merchants and our customers. And really like just keep an eye on what's going on in the overall enrollments payment ecosystem. Not only for our customers, but also for customers in the overall payment scene, because we hold relationships with other significant players, we can give them a head's up of what's going on. So any market trends, intelligence, like sharing, makes it a really good place to be. >> How long have you been a Splunk customer? >> So we've been a Splunk customer about 18 months now. >> Okay great. So relatively recent? >> Yeah. >> Tell us about life, what was the catalyst to bring Splunk in? What was life like before and the after? >> Yeah, so, the catalyst for bringing Splunk in was really the contract negotiation with our parent company in Australian Post. So we've moved away from our previous tooling and moved to Splunk. I'll be honest, there wasn't a huge adoption 'cause there was so much going on at that point in time, but about twelve months ago, we started really investing heavily in optimizing our instance of Splunk cloud, to the point where we're now able to leverage it's functionality in terms of application monitoring, making logs available and searchable. Just make things a lot more visible for even our senior leadership team to come up and see a dashboard on a TV screen on a wall and be like, "Hey, we're doing really well today". Or "hey, what's with that number, do I need," "is there something that I need to know?" The power of visibility when you're talking to leadership teams is just amazing. >> And you couldn't do this before, or you could do it would take a lot more resources? >> Yeah, exactly. You could do it, it's just that it's a lot less visual, and a lot more time intensive to actually pull that out. So where Splunk has really assisted us is in the ease of reporting, and the visibility and speed with which we can deliver the information required. So, with our previous tools, there was an issue with the timeliness of the data, so by the time that we'd actually pulled it out, taken the core insights that we needed it was probably not as accurate, or as up to date as what we like, and being in high paced financial industry time is money. >> So what have you done with that extra time is it just sort of perfecting the dashboards and the reporting and that process, or have you shifted resources to other activities? >> Yeah, so I mean when you're dealing with such a small team, time is key. And really that reporting time got shifted away and back into the hands of more technical on hands, technical uplift. You have more time you know, making sure that your firewall rules are correct, you've got more time making sure that you're applications, and your code reviews are going well, and you're clearing pipelines, and you're looking at training, you're looking for indicators of compromise instead of just kind of sitting there hoping that your current configures okay, but knowing that you could probably give it some more love if you had more time. >> Alright, yup Luke, one of the things we talked to a lot of customers about is that they start with a specific use case for Splunk, but then the business starts asking questions other groups get involved, what's your experience? >> Yeah, no, as our experience in that field is exactly the same, so we brought Splunk onboard purely as a seam for the security team to use. And it got to the point where you had say the sales team approach us and were like, "hey we know that you" "guys are pulling out a lot of metrics about" "our customers and what activities are going on in system," "is there any way we can leverage this" "to say calculate profitability for various accounts" "or you know can we offer bulk discounts?" Or you know, whatever so it kind of starts getting extended to the sales team, and then the customer service guys came aboard and they're like, "Hey, if we had access to this information" "sooner, we could better service our customers." And that offering itself was really powerful because it has a direct impact on our ability to deliver as a service provider. And it just keeps growing, and growing and growing to the point where pretty much every single team uses Splunk in some way, shape, or form, and are getting real value out of it. >> Now, when you say every single team, >> Yeah >> You mean across the company or? >> Yeah, just, across our company, so across SecurePay, so from the infrastructure guys to the network guys to the dev team, to the QA's to the BA's, just yeah. >> What about well, so we heard a lot of announcements today there sort of positioning Splunk for the lines of business the business users, the less technical folks. Do you see that happening in the near to midterm? >> Yeah, so that has. That's going to have a big impact as to where we sit, so on our current experience has been with the internal customers using Splunk who aren't as technical because we are using Splunk Cloud and we've got that shared like service pool from Splunk. Can unfortunately impact the ability of users who do need access to certain things, in a faster manner can be limited sometimes. So the ability to actually give those guys the ability to self serve a little bit bettter, up skill and actually kind of kind of teach them to fish as opposed as to delivering fish. Is really going to be very powerful, and it's just going to be it's going to be something to play to Splunk's credit. >> How large of an installation are you? How do you measure that, is that like, I guess it's gigabytes or terabytes right? >> Yeah, so in terms about our daughter in just I'm not 100% sure. I think we're, the majority of our logging comes out of our firewalls and perimeter stuff, as you'd expect, being a public facing organization so we've always got scans and whatever going on. But, in terms of the rest of our ingest, >> Dave: So small, medium or large? >> Yeah, I'd say we're probably, small or medium, depending on our ingest. So SecurePay for reference is only about 100, 120 people strong. So, we try to keep things as agile as possible and as lightweight as possible and Splunk's kind of there to support that because we can, we know when we're hitting our overhead and what we can do to actually kind of peg that back or wrap it up and where we've got the head room. >> Things you'd like to see Splunk do, what's on their to do list? >> That's a fantastic question, I'd like to, so I'm personally not a Splunk ninja by any means, I'm still very new, so given the fact that we've only had Splunk for about 18 months I would like, there are people here who would Splunk me into the ground. (laughing) >> But, >> That sounds vicious. (laughing) >> But personally what I'd like to see is a lot of that natural language translation stuff coming through that they announced, Can be really, really powerful. Just to empower those guys who haven't got quite like trying to reduce that barrier to entry rather than in nothing else. >> Luke, thanks so much for coming on theCUBE and good luck >> Yeah, no worries. >> with the future. That's it for us too, that's a wrap, I mean your final thoughts, you want to bring it home? >> Yeah, at the crossroads at day to day, it's really amazing to see this, they going to have WAS tomorrow, they got a huge party at Universal, so it's been a great experience for me, I really appreciate ya you know coming and sharing the ride. >> My pleasure. It's all about the data. We're seeing, we've watched the ascendancy of Splunk, Splunk went public with a very little of the cash, forty million dollars in cash, got to the public markets been growing like crazy, we're seeing a massive CAM expansion now into lines of business and new areas like IOT, so we're actually very excited about Splunk. We really appreciate them having us here. Busy month for theCUBE. theCUBE team's packing up. I'll be going to Miami. Stu will be going to Miami. You guys will be going to Miami. You guys are going back to California. We'll see you next week. Check out the Cube.net it will show you where theCUBE is for all the shows, checkout siliconangle.com for all the news. Some big news today, so look for that in the big data space Hortonworks and Cloudera merging evidently, just just came across the wire, wow. Hatfields and the McCoys. And, check out wikibottom.org sorry wikibottom.com for all the research. Thanks for watching everybody, This is theCUBE, we're out from Splunk .conf 2018 We'll see you next time. (upbeat music)

>> Announcer: Live from Orlando, Florida, it's theCUBE, covering .conf 18. Brought to you by Splunk. >> Hello everybody. Welcome back to Splunk's .conf 18, #splunkconf18. You're watching theCUBE, the leader in live tech coverage. My name is Dave Vellante. He's Stu Miniman, @stu, @dvellante. Tweet us with any questions you might have. Larry Shatzer is here. He's an Operational Intelligence Engineer at Myriad Genetics and he's joined by Amarbir Dhindsa who's an Analyst in SalesOps, also at Myriad Genetics. Gentlemen, welcome to theCUBE. Good to see you again. >> Thanks for having us. >> Thanks for having us. >> Myriad Genetics, tell us about the company. What do you guys do? >> So we test people to know if they have a tendency to develop, maybe breast cancer, ovarian cancer. We have a series of questions that people like to ask of like, will I get cancer, do I have cancer, what should I treat it with, and how should I treat it? And so we try to answer those questions over different diseases and cancer being the most prevalent one. >> And Operational Intelligence Engineer, what does that entail? >> So I'm part of the group of developers that maintain the labs and I work in the Business Intelligence group and then my primary focus is the lab and the operation. So I work with the different process engineers and clinical scientists to help maintain their, the different ask days that they perform and make sure that the robots are working at peak performance and if we could predict where problems might be. >> And Amarbir, you used to be in operational intelligence, right now you're in the sales side in the line of business, is that right? >> Yes, yeah, yeah. I get to mix both worlds and look at some lab metrics and see what kind of effect they're having on business indicators like turnaround time. So if there's something weird going on in the lab, we want to see what it's effecting in terms of the turnaround time that we might be getting customers back their sample in time, or if it's taking longer than competitors, or if it's taking a little bit longer than the norm. >> Now, in the old days of business intelligence, you had maybe a guy, maybe a couple of folks, maybe a team of people, but they were the experts, and you'd go there and you'd beg them to build theCUBE. And then you'd wait. And then by the time you got the data, often times things had changed. You got a nice report but sometimes it just wasn't worth it. You probably remember that world. >> Yes. >> How is that dynamic changed? >> Users are more demanding. There's a lot of more users that are more savvy when it comes to technology. A lot of our users were used to doing things in Excel that I was surprised that they even knew what a VLOOKUP was. And stuff like that. And their level of quality that they expect from you is higher but they also know their data more than you know it. There's only so much data I can understand, you know. We've got all kinds of parts of the domain knowledge that's needed to perform different parts of the process. You know, coming from the chemistry stuff to sales, to HR, to finance, all that stuff, you lose focus, and you go from one project to another and it's hard, so now it's a better world where the users come to you also with solutions in hand. Sometimes that's bad, but sometimes it's good. >> Well, but so the tooling has to change to accommodate that right? >> Larry: Yes. >> So presumably that's where Splunk fits in but how has the tooling evolved? And I'm really interested in learning how you've become this, sort of, power user within sales presumably. >> Yeah and I can attest to both worlds. So before I moved into sales, I used to monitor quality and labs manually. So everyday I'd come in and a good hour, two hour would be spent characterizing each platform, each re-agent, each user, and now it's just one click away. So you can get a verdict on quality daily, really quick and you can make changes really quick, rather than something infiltrating the system, having its effect and going out, you can catch it way early. And my days have gotten a lot more productive, right. Instead of copying and pasting from a remote query, now that query runs in the background and populates everything. >> So where does Splunk fit in all this? How do you use it? >> So we started with Splunk with the traditional use case of we've got a web service that we've deployed, we want to bring in the logs and analyze them, and then we were in a meeting with some business users and we happened to show them Splunk and one of the users was like, I want that. We've got logs coming off of our robots in the lab that when users click this button that they shouldn't click that we can't change 'cause it's from a vendor, we want to know when that happens, because there's a potential for something bad happening down stream. So we want to catch that early. And we've got these Perl scripts that are ugly, hard to maintain, can we look at Splunk? And so we were like, okay we'll start looking at your logs. It's more data, I'm a data nerd. I like looking at random weird data. So we started bringing it in and then it just exploded from there. >> It's actually been the catalyst for change right. Splunk has been the catalyst for change, where we've gone from manual oversight to having an automated oversight. Not just in the lab end but also in the front end of where samples are coming from, where volumes might be decreasing. Is there a special market where there's a downtrend that we want to be conscious of, not at every weekday of reporting in a row. We want to be conscious of that everyday. It's hard to find that manually and Splunk is the catalyst that's given us real time information on key performance indicators that we can act on. >> One of the things I'm wondering if you can comment on is how much are you the one that everyone goes to? You're the center of knowledge, all the data lives there, and how much does this tooling enable you to allow the business team, the sales team, to be able to self-service? You've given them a dashboard and they don't need to come to you. >> It's been a long journey and getting to that point I hold weekly user sessions with different users to sort of help enable them, hold their hands. At the early on, it was, this is how you do a search, this is what alert is, this is what a dashboard is and now it's more about what are the problems you're having and then showing them different dashboards that use different techniques that I'm like, this is for this user, but you can apply some of the same techniques and then they'll just copy, paste, and change it for their use case. And it's just been fantastic to enable them. Since our group is small, there's me and another guy, who's here, wandering around right now. Our mantra is teach them to fish. You know, they know their data better than we know it. We prefer to be more like a consultant with them to say we know the math, we know the techniques, you know the data, let's just put our minds together, then usually will come out with a great product at the end. >> So one of the things we were talking about was how Splunk is different than some of the other disruptive technologies and you're able to do things that you really couldn't do before. Like you can't teach lines of business users how to maintain Perl scripts. It's just not going to happen right. And so now maybe in SecOps we heard that some of the sim tools were competitive and Splunk was disruptive 'cause it was easy to use but it seems like, as Amarbir was saying, this is a catalyst for change because it's new, it's different, it's enabling you to do things that you really couldn't do before. Is that an accurate characterization? >> I think that is. The other aspect, at least for us, is that some of our business units were so data starved, because they just didn't have access to the data. Armabir's old boss, when he worked in the lab, said if you don't have answers to your questions, it's your own fault for not asking for help. Now he's like, now with Splunk in the mix, we've gained insight to some of our products that we've had running for like 13 years with no visibility into it and now we've got this visibility and they're discovering new and interesting metrics that they want to look at and make decisions off of. >> Yeah I'm wondering, we've heard from a number of customers where they've got really what we'd called those hero stats out there, you know, we heard one company up on stage this morning was like, oh saving $60,000 a month in fraud. I'm curious as you report to the business, what success to your team? >> Well we've been able to identify turnaround time changes really quickly. We've reduced it by an appreciable amount when problems come in. That's the cool thing about Splunk. You can actually catch things before they infiltrate your system. Now you were talking about it might be a little bit harder to get users to be comfortable with the search processing language but one of the keynotes, somebody was saying that if you know about 20 commands in Splunk, and you're comfortable, three users sessions that Larry runs, you can explore your data a little bit more and you can become a steward of your data, that will help you catch influxes of problems way before they become prevalent. >> So you're saying they can do some basic SPL in there, it's not just okay, we've got a gooey in a dashboard for ya. >> I think with a little bit of help they can right. Especially with the documentation and the videos that Splunk provides, users can be self proficient to some degree. >> Where are you today with Splunk? I mean how do you measure the size of your Splunk installation? Is it capacity ingested? Or number of indexers? How do you guys look at that? >> We're a small license. We'd only ingest about 20 gigs. Or that's what our license is. And we do about half of that, so we make that license count. We are also very pragmatic, starting off with, what do we want to ingest first? What's the highest value logs that we can get in that we could, with a little bit of effort, get the most reward out of? And then it's just been growing. And also as our company's bot and a few other companies as we've made some acquisitions, some of them are like, we want some of that as well. Some of them run the same platforms we do in their lab, both labs, so we can take what we've learned there and apply it at other places as well. >> How long you been a Splunk customer? >> Larry: Five years. >> So it's been a while though. Okay so you're likely going to stay more focused but it was interesting, 'cause Amarbir you go from an operations intelligence role into a sales role, that's sort of, an indication, that this platform is permeating throughout the business but will that continue or you pretty much confined to where you are and you're getting the value out of what you have today? >> There's new users asking us questions all the time. In fact, just yesterday got an email from a user in a different lab that we haven't been focusing on, saying hey, in fact it was Amarbir that was talking to him, saying you should send an email to Larry and his boss and ask about getting some more visibility in your lab, you know, their small little lab that runs, you know, they're not the big product that we offer but they've got data needs. Just because you don't impact the top line like other parts of the business, doesn't mean you can't have data problems and data needs yourself so. >> I think once people see the answers that Splunk can provide in their realm. So for a given lab, if Splunk can answer your questions and you're immediate needs in a quick fashion, then you become enamored and want more, as to what Splunk can provide. And it's done that across a variety of departments in our company and more departments, I think, will hop on board when they become more familiar with what Splunk can do and how fast it can do it. >> And you're in the sales organization correct? >> Right I migrated over into the sales organization and over there, we're really concerned with what the effectiveness of our sales call is, right. So now we can, kind of, the world is the possibility with Splunk. If we have data, now we can explore it. In that past, the exploration wasn't as user friendly and I know user friendly is one of those things that people don't associate with the SPL, kind of based platform, but I think once users see what this can do, they're a big fan of it. >> I mean I ask because you're not marching to the tune of a centralized analytics group. The sales folks can say, hey I need this, help me. And on a moment's notice. And so you're a resource that's dedicated for them. How do you like that world? >> It's a little bit of a change but it's data rich, so I kind of love it. And all of a sudden, we can model things. I'm just going to give you a quick example. We can model a territory that overtime has changed from being a poor performer to being a good performer. Now we can try and get indicators that have changed overtime and we can monitor them and maybe propose changes to area managers that can emulate that process. So that's just one use case where data will drive decisions and possibly can give more insight to decision makers. >> All right guys we got to leave it there. Thanks so much for coming to theCUBE. Always appreciate the customer insights and congratulations on your great work. >> Thank you. >> Thank you very much. Thanks for having us. >> You're welcome. All right, keep it right there everybody. Stu and I will be back with our next guest. We're live, day two from .conf 18. You're watching theCUBE.

(energetic music) >> Live from Orlando, Florida, it's theCUBE covering .conf 18, brought to you by Splunk. >> We're back in Orlando, Splunk .conf 2018, I'm Dave Vellante, Stu Miniman, and this is theCUBE, the leader in live tech coverage. Doug Merritt is here, the CEO of Splunk, long time CUBE guest, great to see you again. >> Thank you, Dave, great to be here. >> So, loved the keynote yesterday and today. You guys have a lot of fun, I was laughing my you-know-what off at the auditions. They basically said, Doug wasn't a shoo in for the keynote, so they had these outtake auditions. They were really hilarious, you guys are a lot of fun. You got the great T-shirts, how do you feel? >> It's been a, my favorite time of year is .conf, both because there's usually so much that we're funneling to our customers at this time, but being here is just infectious, it's, and one of the things that always amazes me is it's almost impossible to tell who are the customers and who are the employees. That just, I think Devonia this morning said it's a family affair, and it's not just a family affair, it's that there's a shared passion, a shared, almost culture and value set, and there's, it just is a very inspiring and naturally flowing type of event and I know I'm biased because I'm the CEO of Splunk, but I don't, I just don't know of events that feel like our, like .conf does. There's a lot of great shows out there, but this has got a very unique feel to it. >> Well, we do a lot of shows, as you know, and I've always said, .conf, I think ServiceNow, does a great job obviously, re-invent the tableau shows. That energy is there, and the other thing is, we do, when we go to these shows, a lot of times, you'll look at the keynotes and say, are there any products being announced? You guys, that wasn't a problem here. You guys announced this -- >> Not this year. >> Bevy of products, I mean, it's clear the R and D is translating into stuff that people can consume, and obviously that you can sell, so that's huge. >> I'm really excited about the product roadmap right now, and it's, that was, when I got the job, almost three years ago, one of the key areas I leaned forward and the board was excited about it was, what, where or how are we going to take this product beyond the amazing index and search technology that we have? And this show, it takes a while to progress the roadmap to the point that you can get the type of volume that we have here, but this show was the first time that I felt that we had laid enough of the tracks, so you could see a much, much broader landscape of capabilities, and now it's a challenge of packaging and making sure our customers are successful with it, with the product that we just have, the products we've announced. >> Cloud caught a lot of companies and a lot of end user companies, flatfooted. You guys have embraced the cloud, not only with the AWS partnership, which we're going to talk about, but also the business model. You're successfully transitioning from a company with perpetual license model, to a ratable model, which is never easy. Wall Street is killing companies who try to do that. Why have you been successful doing that? You know, give us an update. >> Yeah, so five years ago, less than 20% of our contracts were, had any type of subscription orientation to it, whether it's a multi-year term or a cloud. We'd just launched our cloud four years ago. And we moved from there to we had told the street there would be 65% term in subscription by the end of this year and updated guidance at the end of the second quarter, which is just a month and change ago, that we've already hit the 75% mark that we were set in for next year, so it's been a pretty rapid progression and I think there're two elements that have helped us with that. One: cloud continues to catch fire and so the people's orientation on "Do I do something in the cloud?" four years ago they were much more nervous, so less nervous today. But data is growing at such a huge rate and people are still wrapping their heads around, "How do I take advantage of this data, how do I even begin to collect this data and then how do I take advantage of it?" And the elasticity that comes in the cloud and that comes with term contracts, we can flex out and flex back in, I think it's just a much more natural contracting motion than you bought this big, perpetual thing and pay maintenance on it, especially when someone is growing as fast as data is growing. >> Well and it requires you to communicate differently to the financial analysts. >> It does. >> Obviously, billings, you know, was an important metric. You've come up with some new metrics to help people understand the real health of the business. And one of the other metrics that strikes me, and you see this with some of the successful companies, I actually think Aneel Bhusri was sort of the modern version of this, is the number of seven figure deals. You're startin' to hit that, and it's not, the way he's phrased it was pretty good. It's not something you're trying to engineer, it's the outcome -- >> Yes. >> of having great, loyal customers, it's not something you try to micromanage. >> Right, and that's, just recently we dropped six figure deals, which, when I joined, you got this wonderful dynamic forecasting system that sits on top of sales for us, and so as head of sales, where I started, you're really paying attention to deals. I'd go down to a hundred thousand dollar deals that would track throughout the quarter. And now it's hard to get it down to the six figures 'cause we've got a big enough envelope of seven figure deals. So the business has changed pretty dramatically from where it was, but it is an outgrowth of our number one customer priority, which is, or number one corporate priority, which is customer success. 'Cause that investment by companies, when you get to a million dollars plus, in most cases that's a million annually, you better believe in and trust that vendor, 'cause that's no longer an easy, small departmental sale. You're usually at the CIO, CFO type level. So it's something that we're very honored by, that people trust us enough to get that footprint of Splunk to be that size and to feel like they're getting a value from Splunk to justify that purchase. >> Alright we'll get off the income statement, Stu, and you can read about all that stuff, and we're going to get into, we've got a lot of ground to cover with you, Doug. Jump in here, Stu. >> Yeah, so Doug, I've really enjoyed talking to some of your customers that, you know, most of them started on premises with you and now many of them, they're using Splunk cloud, it's really kind of a hybrid model, and it's been really interesting to watch the maturation of your partnership with Amazon, and being the leader in the cloud space. Give us a little bit of color as to what you're hearing from the customers, you said three, four years ago, you know, they were obviously a little bit more cautious around it, and bring us inside a little bit that partnership. >> Sure, so the first piece that, as part of Splunk, that I think is a little bit different than other vendors is because we are both a lower level infrastructural technology, right, data is, the way I frame what we do is there's these raw materials, which are all these different renditions of data around, and companies increasingly have to figure out how to gather together these different raw materials, put them together different ways, for the output that is driving their business. And we are the manufacturing parts provider that makes it easy for them to go and pick up any of these different compounds and then actually do what they want to do, which is make things happen with data. And that middle layer is really important and we have never taken a super strong stance either, we started on prem, but as we moved to cloud, we never took a strong stance saying everything should be in the cloud or everything should be on prem because data has gravity, there is physics to data. And it doesn't always make sense to move data around and it doesn't always make sense to keep data stagnant, so having that flexibility, being able to deploy your collection capability, whether it's ours or third party, your storage capability, and then your process and your search, what are you going to do with the data, anywhere that makes sense for a customer, I think, is important. And that's part of that hybrid story, is as people increasingly trust and interview us and other cloud vendors to build core apps and then house a lot of their data, we absolutely need to be there. And I think that momentum of the cloud is certainly as secure and, in many cases, more secure than my on prem footprint, and the velocity of invention that some like ABDS is driving allows me to be much more agile and effectively drive application development and leading edge capability, I think just has people continuing to trust the cloud service providers a little bit more. >> Yeah well, we're here in the pavilion, and seeing your ecosystem grow, we've been at re:Invent for about five years, that ecosystem is just so >> It's been amazing. >> massive and full, give us a little bit about the relationship with Amazon and how you look at that, how Amazon looks at a company like yours. >> Yeah, it's been, so one, whenever you're playing with a highly inventive and hugely successful company like Amazon, my orientation and what I convey back to the company is our job is to be more inventive, more agile, and continue to find value with our maniacal focus every day being the data landscape. Data is a service and outcomes is a service, so our job is run faster than Amazon. And I think that this show and our announcements help illustrate that our invention cycle is in high tilt gear and for what we do, we are leaning in in a really aggressive way to add that value. With that backdrop, Andy and I formed this partnership four years ago. He felt there's enough value in Splunk and we were a good enough partner and the way we consume their services that he would commission and quota their sales reps whenever a Splunk sale was done in the ADBS landscape, which I think has been really helpful for us, but we obviously are a huge customer of ADBS's and they become an increasingly large customer of ours and finally gave us approval with their three year renewal a quarter ago to publicly reference them as a sizeable customer for us. >> Oh, okay, congratulations on that. And something I've really, it's really crystallized for me: so many administrators out there, you look at their jobs, you know, what are they? It's like okay, I'm the security expert, I'm the network certified person. You're really, your users here, you know, they are the beacons of knowledge, they are the center of data, is really what they are. You know, Splunk's a tool, they're super excited about the product, but it's data at the center of what Splunk does and therefore, you're helping them in just such a critical aspect of what is happening in the industry today. >> Yeah, the key aspects of the keynote, of my keynote, were we are moving to a world where data is the product that people care about so the whole object is how do you make things happen with data and the people that can get that done increasingly are becoming the most valuable players on the field, so what infrastructure, what tooling, what capability exists that allows people from all departments, you know, we're very heavy within IT and security, but increasingly HR departments, finance departments, marketing departments, sales departments, manufacturing departments will not be successful without a really competent group of folks that understand how to make things happen with data and our job is to lower that bar so you don't have to go to Carnegie Mellon for four years and get a Masters in Computer Science and Data Science to be able to be that most valuable person on the field. >> I want to take a moment, I want to explain why I'm so bullish on Splunk. We had a conversation with Susan St. Ledger yesterday. Digital transformation is all about data. >> Yup. >> And you guys are all about data, there's the cliche which is "data is the new oil" and we've observed, well not really. I could put oil in my car, I can put oil in my house, I can't put it in both places, but data? I can use that same data in a lot of different use cases and that's exactly what you guys are doing now as you expand into line of business -- >> Yup. >> With Splunk Next. >> Yup. >> So you've announced that, you showed some cool demos today. I'd like you to talk about how you're going from your core peeps, the IT ops guys and the sec ops guys, and how, what your plan is to go to lines of business. More than just putting the data out there, you've come up with some new products that make it simpler, like business work flows, but what else are you doing from a go to market standpoint and a partnership standpoint, how do you see that playing out? >> Yeah, I think that the innovation on product, there are three key pillars that we're focusing on. Access data, any type of data, anywhere it lives. Make sure that we're driving actionable outcomes with that data, and acquisitions like Phantom and VictorOps have been a key pillar of that, but there's other things we're doing. And then, expand the capability of finding those outcomes to a much broader audience by lowering the bar. So the three key themes across the portfolio. But all of those are in service of the developers at a customer site, the developers in the ecosystem, to make it easier for them to actually craft a set of solutions that help a retailer, help a discrete manufacturer, help a hospital actually make things happen with data. 'Cause you could certainly start with a platform and build something specific for yourself but it's much easier if you start with a solution. And a lot of the emphasis we've been putting over the past two to three years is how do we up that platform game. And the many, many, 20 different product announcements that we rolled at this .conf and one of them that I'm also very excited about is our developer cloud where we've really enhanced the API layer that interacts with the different services that the entire Splunk portfolio represents. Not just the search and index pieces that people are familiar with but everything from orchestration to role based access to different types of visualization so a very broad API layer that's a well-mannered, restful set of APIs that allows third parties to much more crisply develop, excuse me, applications to compliment the 1800 apps that are already part of our Splunk base and right behind me is a developer pavilion where we've got the first hand full of early adopter OEM partners that are building their first sets of apps on top of that API framework. >> Dozens of them, it's actually worth walking around to see. Now, so that developer cloud is a lever, those developers are a lever for you to get into lines of business and build those relationships through the software, really, and through the apps. Same thing for IOT. >> Yup. >> Industrial IOT. Now, we've observed, and a lot of the IT companies that we see are trying to take a top down approach into IOT and we don't think it's going to work. It's, we talk about process engineers, it's operations technology people, they speak a different language. It's not going to be a top down, here, IT. >> A very different audience. >> It's going to be a bottoms up set of standards coming from the OT world. The brilliance of what you guys have, it's the data, you know, it's data coming off machines, data, you don't care. And so, you're in a good position to do a bottoms up in IOT and we heard some of that today. Now, there are some challenges. A lot of that data is still analog, okay, you can't really control that. A lot of the devices aren't instrumented, they're not connected, you can't control that. But once they become instrumented and connected and that analog data gets digitized, you're in a really good position, but then you got to build out the ecosystem as well. >> Yup. >> So talk about how you're addressing some of those challenges in industrial IOT. >> Yup, man, it's a great subject 'cause I think that the trying to rely on standards is the wrong approach. The velocity across this digital landscape is so high and my view over the past 30 years, I think it's only accelerated now, is there's going to be more and more varieties of data with different formats than there's ever been, and we've seen it in the past five years. Just look at the variety of services on top of AWS, which didn't even exist ten years ago, but and they now have hundreds of services and there is no organizing principle across those services as far as data definition. So it's a very chaotic data landscape and I don't think there's any way to manage it other than to embrace the chaos and work a little bit more bottoms up, you know, grab this data, don't worry about cleansing it, don't worry about structuring it, just make sure you have access to it and then make sure that you've got tools like Splunk that allow you to play with the data and try and find the patterns and the value inside of that data, which is where I think we're very uniquely suited as a technology set. Helping the ecosystem come to that realization is a key aspect of what we're doing. We're trying to attack it the same way we attacked the IT security piece which is pick a handful of verticals and really focus on the players, both the marquis anchor tenants, the BMWs, the Siemens', the Deutsche Bahn railroads of the world, as customers. And through that, get access to the key influencers and consultants and advisors to those industries and start to get that virtuous circle of "I actually have more data than I think I have." Even though there's some analog machines, there's so many different ways to attach to the signal that those machines are emitting and it may not be bi-directionally addressable, but at least you can see what's happening within those machines without a full manufacturing floor rip and replace. And everyone is excited about doing that. The advisors to the industry are excited, the industry themselves are excited. We had BMW on stage who walked through how they're using Splunk to help on everything from product design all the way through to predictive maintenance and feedback on the quality of the cars that they're rolling out. We've all heard stories that there's more lines of code in the Ford F150 and these other vehicles than there is within Facebook right now, so we all are dealing with rolling and sitting in building's and house's data centers. How do you make sure that you're able to pay attention what's happened within that data center? So I think that that is as big or bigger of an opportunity than what we've done with IT and security, it just has its own pace of understanding and adoption. >> Carnival Cruise Line, another one, Stu. We had those guys on today and they basically look, they have a lot of industrial equipment on those ships, so they're excited. >> Yeah, absolutely. Alright, so Doug, we started the beginning talking about the last couple years, how we measure Splunk has changed. Going to more subscription models, talk about how many customers you have. I look at developers, I look at IOT, whole different set of metrics. So if you look at Splunk Next, how do we measure you, going forward? What is success for your team and your customers going forward? >> Yeah, and the whole orientation around Splunk Next, as I'm sure Susan covered, it's not a product, it's a messaging framework. People are so used to Splunk being all about the collection of data within the index and searching in said index, and we're increasingly moving, we're complementing the index, the index is a incredibly unique piece of IP for us. But there's a lot of other modalities that can complement what that index does and Splunk Next represents all of our investments in next generation technologies that are helping in with everything from stream processing to distributed compute capability, next generation visualizations, et cetera. The metric that I care about over time is customer adoption and customer success. How many use cases are being deployed at different customers? How many companies, both customers and partners, are incorporating Splunk in what they do every day? You're getting OEM Splunk, making Splunk a backbone of their overall health and success. And ultimately that needs to translate into revenue, so revenue and bookings will always be a metric that we care about, but I think the leading indicators within theses different markets of rate of adoption of technology and, more importantly, the outcomes that they're driving as they adopt this technology, are going to be increasingly important. >> Yeah, I just have to tell you, when you talk about your customers not only excited, but it's a deeper partnership when you talk to insurance company out of Toronto that, like, they're talking to the people that they insure about, should they be using Splunk and how do they do that. It just, a much deeper, and you know, deeper than a partnership model for your customers. >> It's one of the things I love about this conference, is it's, we were talking about earlier, it's hard to tell the customers from the employees, like, there's a, there's a, this whole belief and purpose that everybody shares, which I adore about being here. But when you look at a sea of data, we've thought traditionally looked at the data we manufacture, typically data that's historic and at rest from our ERP systems. This next wave is certainly all the data that's happening within our organizations but increasingly it's all the data that's available in the world at large. And whether it's insurance or automotive or oil and gas, the services that I'm going to have to deliver to customers require me to farm data outside of my walls, data inside my walls, combine those two, to come up with unique value added services for my customers. So it's great to hear that, that our customers are on that journey 'cause that's where we all need to go to be successful. >> And there's a definitely alignment there. Doug, I know you're super busy, we got to go. Thanks so much for coming on theCUBE. Give you the last word, .conf 18 takeaways. >> (laughs) Unbelievable excitement and enthusiasm. A huge array of products that, I think, broaden the aperture of what Splunk does so dramatically that people are really trying to digest, "What should, how should I be thinking about Splunk moving forward?" And I'm, we started a whole series of transformations three years ago, and I'm really excited that they're all starting to land and I can't wait for the slow realization of the impact that our customers are counting on us to provide and that we'll increasingly be known for across the data landscape. >> Well and the landscape is messy and, as you said, the messiest part of that landscape is the data landscape. You guys are helping organize that, curate it. And hopefully we're helping curate some of the, from some of the noise and distracting to the signal to you on theCUBE. Doug, thanks so much for coming on theCUBE, great to see you again. >> Thank you Dave, thank you Stu, you guys do a great job. >> Thanks, we appreciate that. >> Thanks for being here with us. >> Alright, keep it right there, buddy. We'll be back with our next guest from .conf 18 from Orlando, we'll be right back. (digital music)

(upbeat music) >> Announcer: Live from Orlando Florida, it's theCUBE, covering .conf18. Brought to you by Splunk. >> Welcome back to .conf18 everybody. I'm Dave Vellante with Stu Miniman, and you're watching theCUBE, the leader in live tech coverage. We love to go out to the events, extract the signal from the noise. A lot of focus today, Stu, on security and Haiyan is here. Haiyan Song is the Senior Vice President and General Manager of Security at Splunk. Great to see you again. >> Thank you for having me. >> You're very welcome. Fifth time I think for you on theCUBE So you're super alum. And really always appreciate your deep knowledge. As I said, today was security day. A lot of customers talking about security. It's obviously a strong hold of Splunk. But, give us the update. What's new this year with you? We talked a year ago in D.C. What's happening with you guys? >> Well this is the year that we really went out and shared our vision of what SOC looks like in 2020. And we call it the Vision of SOC 2020. And on a very high level, we envision that in a couple of years with the technology like analytics, and operations, automation, orchestration, we envision that 90% of the Tier 1 work that a SOC analyst would be doing will be automated. And with that automation we are envisioning that most of the time, more than 50% of the time, the SOC analyst can actually focus on detection logic and really responding to things, that requires the human skills and insights. And we're also envisioning that by that time, there will be a place, one place, where things for response gets orchestrated versus people have to go to twenty different places trying to figure out what's going on. So, that sort of, from a business perspective but to deliver that, there's really, sort of ten, we share the ten big we call it core capabilities, that capability road map to SOC 2020. And for us, we feel really fortunate that with the acquisition of Phantom, we are really able to bring that full stack together, to deliver that capability. So we have data platform. You heard all the exciting news on what we are doing, with data fabric search, stream processing, and amplifying the performance analytics. You heard all those things that we're putting into IT, and security, ES, UBA, and then last but not least is the ability to orchestrate, to automate, to collaborate. So I think we're really uniquely positioned, because we can bring all three together. That's the full stack to deliver on that vision. >> So let's talk a little bit more about that vision. So, I mean my rudimentary understanding is you really had a reactive mode in the past. It's kind of herding cats, trying to figure out, okay I'm going to to try to respond to an incident. Then you started to use data and analytics to try to prioritize, to focus on those things that aren't going to be a false positive or of high value. What you're putting forth is a vision where a lot of that heavy lifting goes away. Machine intelligence is either augmenting, or making decisions about which items to go after. Talk more about that world. What does it look like? What's the role of the security professional in that new world? >> Yeah, there's two parts we do in the Security Operations Center. Detecting things and responding things and taking care of sort of the incidents. So a lot of the things you really touched on is how we have applied machine learning and analytics and really leveraging the business context. The feature we talked about, the distribute, the data fabric search is a really powerful tool. Now we can reach out and get lot more information to help you make better decisions to reduce the reshow of noise to signal, or signal to noise, and whichever way you want to see it up and down. So, that world we expect more machine learning, more data modeling, more threat modelings so we can really sort of incorporate business, sort of context, so risks become a one key thing to help people prioritize. That's our product ES, and UBA, and you heard about the whole predictive capabilities in IT. I think all of those will be sort of that world. And the second part of what we do is if something does happen now we really got the signal. What do you do about it? We envision that world lot of initial men did prep work. Like, oh I want to find out if this ID belongs to which organization? Is this really a signature in the virus total, sort of database and what happened, so that whole prep hopefully, will be done for you before you even get started into an incident. And furthermore, if we have responded to those type of incidents before, we actually would like to give you a recommendation, this is what happened before, this is what worked, and why don't you think about this playbook and automate this part? So, I think the world in 2020, is going to be a lot of augmentation. >> One of the things we've heard from a number of your customers, is security in DevOps and how they are using the DevOps mentality to make security more pervasive and integrated in everything they do. Could you explain how Splunk fits into that discussion? >> Yeah, so DevSecOps, I think that's, sort of, the term you might be eluding to and I think the cloud adoption, the acceleration, and the new IT is really, sort of, bringing that into focus for us. Splunk plays to that in several ways. We have a security business, we have a IT business, and you may have heard we just acquired another company called VictorOps after Phantom. So they're really helping the DevOps world and try to coordinate and enable collaboration. So we definitely expect that capability will show up in the security side to help the DevOps, DevSecOps' world and we are also, as a company, taking data security really seriously. So we are putting a lot of, you know, you saw the data stream processing and one of the capabilities to obfuscate credit card and for GDPR and a lot of other things, there's that mending. You got to give people the control of things so there is a lot of that. We're taking into consideration and putting that into the product and the other thing is, really, we ourselves operate probably one of the biggest, sort of, cloud capabilities on AWS and we have infused a lot of best practices around, how do you automate? How do you protect? How do you be compliant? And how do you insure customer have control? And there's a lot of work we're doing there and practicing DevSecOps ourselves. >> Haiyan, in thinking about the Splunk portfolio and in the context of the vision that you guys laid out, how does Splunks existing portfolio fit in to that vision and where are the gaps? What has to evolve, whether it's your capabilities, or the industry's MI, ML, or machine learning capabilities? Where are the gaps? >> So I think in many ways the ten core capabilities were laid out. I going to try to go through them in my head. So. >> Okay. >> Ingest. Detect. Predict. and then automate. Orchestrate. Recommend. Investigate. Case Management. Collaborate. And reporting. So those are the ten. When we were sharing with our audience, we actually look at our ES, UBA, and Phantom. We are able to give them all those capabilities to get started on their path for SOC 2020. But we also realize and recognize that all those capabilities, I'll give you an example, Case Management, now there is more and more requirements coming to the security side to say I want you to bring all the different things together, and I want you to take in the automated playbooks and how this plays into those, so there's always room for us to continue to enhance those capabilities. But, we also see the opportunity for us to bring all those things in a more seemless way into, sort of, one full stack, the full stack that gives you, you know, I don't know if you heard the term, powering the OODA Loop? Right, the observe, orient, decide, and act. And that was really, sort of, military strategy for the fighter pilots to say the whole premise is whoever can power that loop, and execute the fastest, wins. >> It's like readying fire but more data focused. >> More data focused, I like that. So for us, it's really how do we bring the portfolio together, so they can really power that loop in a very intuitive way. And in a very open way. I want to make sure that I iterate that reiterate our commitment to be open. There's data layer, there is analytics layer, there's operational layer. We want to be that company can bring the full stack make them work really well. But, in the meantime work well with other data, with other analytics, detection engines, and other ways to operate. So being open is very important. >> And you'll automate as many of those or all of those ten that you mentioned. Do you automate the run book? >> Automated run book is what Phantom is all about and the run book gets more and more sophisticated and I think we give people the ways to say if on day one, you don't want to automate everything, especially shutting down his email, then you have the choice. But, it's as you learn, as you become more confidence, and you have that under your control. How much you want to automate, and hopefully, as more automated actions are taken, we get to analyze those and start making recommendations so you become more comfortable with that. >> So I understand New York Presbyterian was in your session. And, you were talking about going beyond security. I often like to say that security and privacy are two different sides of the same coin. But, when they talked about going, well share with us, what you learned from them. >> Yeah you have really the best phrase to say they are both sides and as a security professional in the digitized world I don't think you have a boundary to say my job starts with SOC and ends with SOC. It goes way beyond. It goes into data privacy. It goes into even fraud analytics, because a lot of things are happening online. It also goes into compliance. And, it's interesting that we thought years ago, compliance was driving investment. I think now with GDPR, with some of the data privacy challenges we've seen, that's impacting the masses, the criticalness of compliance is actually coming back. So the story that I was super impressed that our customer, New York Presbyterian shared with us is they had a challenge of really managing all this sort of patient records, and try to understand the staff's activities. Because, the auditors have a certain set of things. You know you shouldn't be snooping around the patient's record, if its your neighbor, or your buddy. So they used Splunk and they powered, sort of, us with a lot of the data from various applications. They have probably 20 data sources, that's very healthcare centric. We partnered up, we had our product expert, and fraud experts on that. And, we built a privacy platform, a early version of that, and they showed it to their privacy officers, and they basically said we've not seen anything like this to give us the flexibility and ease of use to be able to bring everything together. And, they did even more than that. If you have time I'll share with you on the opiate diversion capabilities they started building with. >> Dave: Oh, yeah talk about that, yeah please >> So we were thinking, we're just going to help them with compliance that makes their organization more compliant and better, but they didn't stop there. They said well, based on the power we're able to, really, leverage from the Splunk platform, we see the data we have for our pharmacies, there's a lot of prescription, sort of, information and with the world that's battling the opiate epidemic, we think we can actually analyze the data and give us early patterns and earnings, warnings of what might be happening. So, that's the next project we're partnering up. And for us we have technology, and customer have domain knowledge, have data. I think that's a great partnership. And they are willing, they are wanting us to go evangelize 'cause they want the whole industry to benefit, they want the nation to benefit. >> Well we saw this week on 60 Minutes, did you see that story? The one pharmaceutical company got in big trouble and a doctor went to jail. The pharmaceutical company was shipping 500 million Oxycontin pills into Florida. This is a state with a population of 20 million. Something was wrong. Obviously those were hitting the streets. And, this individual this doctor went to jail for life. So, data analysis could identify that. >> Data was there. I think it's the inside to look for the ways, to look for those things and having that inside drive decisions is really the partnership we have with our customers >> We're seeing that, g'head Stu. >> Yeah I was just, you spoke on a panel of the Grace Hopper event. >> Haiyan: Last week. >> We've been hearing great messages of diversity at this show. You had the Carnival Cruise CEO up on stage giving some great discussion points yesterday. Maybe you could share a little bit of your experience at the show and the panel that you were on. >> The Grace Hopper is such an amazing event and we see so many college grads and people, sort of, starting their career and that is like the go to place. And I see all the big companies, big, or small actually, putting so much effort to try to really evangelize to that audience. 'Cause California just passed, the Governor just signed into law, they require a woman on the board, as part of the requirements because diversity is being proven to bring better decision making into the board and I, myself, can tell you that my security leadership team over the years become more and more diverse. I don't think diversity is just gender diversity. I think diversity needs to go beyond gender. It's background where people who are from the private sector, from the government, where people from different Geo's of the world. That sort of richness of perspective always give us the best, sort of, angles to think about and validating, and debating on our, sort of, strategies. And going back to Grace Hopper, the panel that I was on was really sharing with the people who are there, what are some of the things that you should be prepared for if you want a cyber security career. And the part is not try to, oh here's a high bar. We really try to encourage everyone, whether you're technical, or you just having great analytical skills. I think one of my fellow panelist, she made a comment I thought was super funny. She was a CEO of a company and she said, sometimes women just have to have enough confidence and to go take the risk, grab the opportunity. She use the word, sometimes you have to fake it until you prove it and until you make it. And she's really just encouraging the attendees, just step up take the opportunity. I am in total agreement with that. >> Lean in baby. >> Lean in. That's another way to do it. >> Haiyan thanks so much for coming back in theCUBE. Really great to see you again. >> Thank you for having me. >> You're very welcome. All right, keep it right there everybody. Stu and I will be right back with our next guest. Right after this short break. We're live from Orlando, Splunk .conf18 You're watching theCUBE. (upbeat music)

>> Live from Orlando, Florida, it's theCUBE, covering .conf 18. Brought to you by Splunk. >> We're back in Orlando, everybody, at Splunk .conf18, #splunkconf18. I'm Dave Vellante with my co-host Stu Miniman. You're watch theCUBE, the leader in live tech coverage. We like to go out to the events. We want to extract the signal from the noise. We've been documenting the ascendancy of Splunk for the last seven years, how Splunk really starts in IT operations and security, and now we hear today Splunk has aspirations to go into the line of business, but speaking of security, Gary Mikula is here. He's a senior director of cyber and information security at FINRA, and he's joined by Siddharta "Sid" Dadana, who's the director of information security engineering at FINRA. Gentlemen, welcome back to theCUBE, Gary, and Sid, first-timer, welcome on theCUBE. So, I want to start with FINRA. Why don't you explain, I mean, I think many people know what FINRA is, but explain what you guys do and, sort of, the importance of your mission. >> Sure, it's our main aspiration is to protect investors, and we do that in two ways. We actually monitor the brokers and dealers that do trades for people, but more importantly, and what precipitated our move to the Cloud was the enormous amount of data that we have to pull in daily. Every transaction on almost every US stock market has to be surveilled to ensure that people are acting properly, and we do that at the petabyte scale, and doing that with your own hardware became untenable, and so the ability to have elastic processing in the Cloud became very attractive. >> How much data are we talking about here? Is there any way you can, sort of, quantify that for us, or give us a mental picture? >> Yeah, so the example I use is, if you took every transaction that Visa has on a normal day, every Facebook like, every Facebook update, and if you took every Twitter tweet, you added them altogether, you multiplied it by 20, you would still not reach our peak on our peak day. >> (laughs) Hence, Splunk. And we'll talk about that but, Sid, what's your role, you got to architect all this stuff, the data pipeline, what do you... >> So, my role is basically to work with the webs teams, application teams to basically integrate security in the processes, how they roll out applications, how they look at data, how they use the same data that security uses for them to be able to leverage it for the webs and all the performances. >> So, your mission is to make sure security's not an afterthought, it's not a bolt-on, it's a fundamental part of the development process, so it's not thrown over the fence, "Hey, secure this application." It's built in, is that right? >> Yes. >> Okay. Gary, I wonder if you could talk about how security has changed over the last several years. You hear a lot that, well, all the spending historically has been on keeping the bad guys out the perimeter. As the perimeter disappears, things change, and the emphasis changes. Certainly, data is a bigger factor, analytics have come into play. From your perspective, what is the big change or the big changes in security? >> So, it's an interesting question. So I've been through several paradigm changes, and I don't think anyone has been as big as the move the Cloud, and... The Cloud offers so much opportunity from a cost perspective, from a processing perspective, but it also brings with it certain security concerns. And we're able to use tools like Splunk to be able to do surveillance on our AWS environments in order to give us the confidence to be able to use those services up there. And so, we now are actually looking at how we're going to secure individual AWS services before we use them, rather than looking to bring stovepipe solutions in, we're looking to leverage our AWS relationship to be able to leverage what they've built out of the box. >> Yeah, people oftentimes, Stu, talk about Cloud security like it's some binary thing. "Oh, I don't want to go the Cloud, because Cloud is dangerous" or "Cloud security is better". It's not that simple, is it? I mean, maybe the infrastructure. In fact, we heard the CIA, Stu and I were in D.C. in December, we heard the CIO of the CIA say, "The Cloud, its worse day is better than my client's server from a security perspective." But he's really talking about the infrastructure. There's so much more to security, right? >> Absolutely, and, so I agree that the Cloud gives the opportunity to be better than you are on PRAM. I think the way FINRA's rolled out, we've shown that we are more secure in the Cloud than we have been on traditional data centers, and it's because of our ability to actually monitor our whole AWS environment. Everything is API-based. We know exactly what everybody's doing. There's no shadow IT anymore, and those are all big positives. >> Yeah, I'm wondering how you've, what KPIs you look at when you look at your Splunk environment. What we hear from Splunk, you know, it's scalability, cost, performance, and then that management, the monitoring of the environment. How are they doing? How does that make your job easier? >> So, I think we still look at the same KPIs that Splunk advertises all the time, but some of the reasons, from our perspective, we kind of look at it in terms of, how much value can we give it to not just one part of the company, but how can we make it much more enhanceable part for everyone in the organization. So, the more we do that, I think that makes it a much better ROI for any organization to use a product like this one. >> You guys talk about the "shift left" movement. What is "shift left" and what is the relevance to security? >> Yeah so, "shift left" is a concept where, instead of looking at security as a bolt-on, or an add-on, or a separate entity, we're looking to leverage what are traditional DevOp tools, what are traditional SDLC pipeline roles, and we're looking at how we integrate security into that, and we use Splunk to be able to integrate collection of data into our CDCI pipelines, and it's all hands-off. So, somebody hits a button to deploy a new VPC and AWS, automatically things are monitored and into our enterprise search, I'm sorry, enterprise security SIM, and automatically being monitored. There's no hands-on that needs to be done. >> So, on a scale of one to five, thinking of a maturity model in terms of, in a DevOps context, five being, you know, the gold standard and one being you're just getting started. Where would you put FINRA on that spectrum, I mean, just subjectively? >> So, I'll never say that we're a five because I think there's always, >> You're never done. >> You're never done and there's always room for improvement, but I think we're at least a strong four. We've embraced those concepts, and we've put them into action. >> And so, I thought so, and I want to ask you from a skill standpoint how you got there. So, you've been around a long time. You had a Dev team and an Ops team before the term DevOps even came around, right? And we talk about this a lot, Stu. What did you do with the Ops guys and the Dev guys? Is it OpsDev or DevOps? Did you retrain them? Did you fire them all and hire new people? How did you go through that transition? >> Yep, that's a fair thing. I went to my CISO John Brady a couple of years ago and I told him that we were going to need to get these new skill sets in, and that I thought I had the right person in Sid to be able to head that up, and we brought in some new talent, but we also retrained the existing talent because these were really bright people, and they still had the security skills. And what Sid's been able to do is to embrace that and create a working relationship with the traditional DevOps teams so that we can integrate into their tools. >> So, it does include a little bit work even on our end to do where you kind of learn how the DevOps forces work, so you've got to do it on your own to first figure out things and then you can actually relate to the problems which they will go through and then you work through problems with them, rather than you designing up a solution and then just say, "Hey, go and implement it out." So, I think that kind of relationship has helped us and in the long run, we hope to do a bit better work. >> Yes, Sid, can you bring us in a little bit, when you look at your Splunk deployment, FINRA'S got a lot of applications, how do you get all those various applications in there? You know, Splunk talks about, you can get access to your data your way, do you find that to be the reality? >> Yes, to a certain extent, so... Let's take a step back here. So our design is much more hybrid-oriented. So, we use Splunk Cloud, but that's primarily for our indexers whereas we host our own sort of class receptor. All the data basically goes in from servers from AWS components, from on-prem, basically it flows into our Splunk Cloud indexers, and we use a role-based access management to actually give everyone access to whatever data they need to be looking at. >> Alright. The number of enhancements from 702, updates, the Cloud, Gar-Gar, is there anything that's jumped out that's going to architecturally help your team? >> So, I think one of the interesting things is the new data pipeline, and to be able to actually mangle that data before I get it into my Splunk indexers is going to be really really life-changing for us. One of the hard parts is that developers write code and they don't necessarily create logs that are event-driven. They don't have date-time stamps, they do dumps. So, I'm going to be able to actually massage that before it hits the indexers, and it's going to speed up our ability to be able to provide quick searches because the indexers won't be working on mangling that data. >> And how big of a deal is it for you? They announced yesterday the ability to scale storage and compute separately in a more granular fashion, is that a big deal for you? >> So, I actually, I remember speaking to Doug Merritt probably three years ago. >> You started this! (laughing) >> And I said, "Doug", I said, "I really think that's the direction that you need to go. You're going to have to separate those two, eventually, because we're doing a petabyte scale, we realized very early that that'd need to be done. And so, it's really really refreshing to see, because it's going to be transformative to be able to do compute-on-demand after that. Because now we can start looking at API brokers, and we can start looking at containers, and all those other things can be integrated into Splunk. >> Love having customers on like you guys, so knowledgeable. I have to ask, switch gears a little bit, I want to ask you about your security regime. We had a customer on yesterday, and it was the CISO who reported to him. He was the EVP, and he reported to the CIO. A lot of organizations say, "You know what? We want the CISO to be separate from the CIO. Cause it's like the, you know, the fox in the henhouse kind of thing. And we want that a little bit of tension in there." How do you guys approach it? What's the regime you have for... >> That is a fair question, and I've heard that from many other CISOs that have that same sort of complaint. And I think it's really organization-based. And I think, do you have the checks and balances in place? First of all, our CIO, Steve Randich, is extremely, he cares a lot about security, and he is very good at getting funding for us for initiatives to help secure the environment. But more importantly, our board of directors bring up security at every board event. They care about it, they know about it, and that permeates through the organization. So there's a checks and balances to make sure that we have the right security in place. And it's a working relationship, not adversarial at all, so, having our CISO John Brady report to Steve Randich, the CIO, has not been a hindrance. >> And I think that's a change in the last several years, because that regime that I described, which was, there was sort of a wave there, where that became common, and I think you just hit on it. When security became a board-level issue, and for every Fortune 1000, Global 2000 company, it's a board-level issue. They talk about it every board meeting. When that occurred, I think there was an epiphany of, "We need the CIO to actually be on this." And you want the CIO to be responsible for that. And the change was, it used to be, "Hey, if I fail, I get fired." And I think boards now realize that "failure" in security doesn't mean you got breached. >> Sure. >> You know. Breaches are going to happen. It's how you respond to them and, you know, how you react to them that is becoming more important. So there's much more transparency around security in our view. I wonder if you agree with that. >> I think there's transparency. And the other thing is is that you have to put the decision-making where it makes the most sense. Most of the security breaches that we're talking about are highly technical in nature, where a CIO is better able to evaluate some of those decisions, not all companies have a CEO that came from a technology train in order to be able to make those decisions. So, I think it makes more sense to have the CISO report to somebody in the technology world. >> Great, thank you for that. Now, the other question I have for you is, in terms of FINRA's experience with Splunk, did it start with SecOps and security, or was it, sort of, IT operations, or...? >> It did, it started with security. We were disenfranchised with traditional SIMs that were out there, and we decided to go with Splunk, and we made the decision that security was going to own it, but we wanted it to be a corporate asset from day one. And we worked our tails off to integrate, through brown bags, through training. So we permeated through the organization. And, on any given week, we pull about 35-40% of all of technology is using Splunk at FINRA. >> So, I'm curious as to, we heard some announcements today, I don't know if you saw them, about, you know, Splunk Next, building on that, Splunk for the line of business, the business flow, they did a nice demo there. Do you see, because security sort of was the starting point, and your mission was always to permeate the organization, do you see that continuing to other parts of the organization more aggressively now given this sort of democratization of data for the business lines, and... Will you guys be a part of that, directly? >> We hope so. We hope we are part of that change, too. I mean, the more we can use the same data for even business users that will help them, that would relieve a lot of, and they made this point again and again in the keynote, too, that, the It Ops and SecOps are already burdened enough. So, how do we make life easy for business users who actually leverage the same data? So we hope to be able to put these tools up and see if it can make any difference to business users. >> So, you guys have put a lot of emphasis on integrating with Splunk and AWS Cloud. You have a presentation later on today at .conf18 around the AWS Firehose that you have with Splunk. What's that all about? What's the AWS Firehose? How are you integrating it? Why is it important? >> So, it is streaming and it allows me to get information from AWS that's typically in something called the CloudWatch Logs, that is really difficult to be able to talk to. And I want to get it into the Splunk so I can get more value from it. And what I'm able to do is put something called a subscription filter on it, and flow that data directly into Splunk. So, Splunk worked with AWS to create this integration between the two tools, and we think we've taken it to a high level. We use it for Lambda, to grab those logs, we use it for VPC Flow Logs, we're using it for SaaS Providers, provide APIs into their data, we use it for that, and finally, we're going to be doing database activity monitoring, all leveraging this same technology. >> Love it, I mean, you guys are on the forefront of Cloud and Splunk integration, Cloud adoption, DevOps, you guys have always been great about sharing your knowledge, you know, with others, and we really appreciate you guys coming on theCUBE. Thank you. >> Thanks for having us. >> You're welcome. Alright, keep it right there, everybody. Stu and I will be back. You're watching theCUBE from .conf18, Splunk's big user conference. We'll be right back. (electronic music)

>> Narrator: Live from Orlando, Florida. It's theCUBE! Covering .conf18. Brought to you by Splunk. >> Welcome back to Orlando, everybody. Splunk .conf18. This is theCUBE, the leader in live tech coverage. I'm Dave Vellante with my co-host, Stu Miniman. Carnival Cruise Lines is back. We heard from them yesterday, we heard them on the main stage of .conf. CEO is up there with Doug Merritt. Sheldon White is here. He's an enterprise architect at Carnival Cruise Line And Alex Taberras, who's the director of threat intelligence at Carnival. Gents, welcome to theCUBE. >> Thank you. >> Doing a lot of talk on security today. They've lined us up, which is great. We love the conversation. So much to learn. Alex, I'll start with you. When you think about security and threat intelligence, what are the big changes that you've seen over the last, whatever, pick a time. Half a decade? Decade? Couple of years even. >> Alex: So, it's just the amount of threats that are coming in now and how fast they're coming in, right? We can't seem to be keeping up with everything that's happening in the environment, everything that's happening outside, trying to get into our environment and cause all that damage, right? So, that's why Splunk is awesome, right? I get to see everything come in, real time. I'm able to quickly pinpoint any action I need to take, send it to my team and have them immediate right away. >> So, Sheldon, yesterday we had ship and shore from Carnival and he was talking about really different problems. You know, the folks on the ship, they got 250 thousand people on the ocean at any one point in time collecting data, trying to make a better experience, keep them connected. Folks on the shore, obviously, websites and things like that. Where do you fit into that mix of ship and shore? >> Sheldon: Right, so there's an entire value stream that we map out as enterprise architects. And so, what we do there is analyze all the customer touch points. And then we aggregate all of that information into a pipeline that we then address our audiences with those critical KPIs. Operational and infrastructure, the entire stack. >> Dave: You guys obviously have very strong relationship with Splunk. We heard from your CEO, Arnold Donald, right? >> Alex: Correct. >> Interesting name, I haven't messed that up yet so. (laughing) And so, where did that relationship start? Did it start in SecOps? Did it start in IT operations management? >> Alex: So, it really started in Devops, right? And they started... They purchased Splunk, I think back in like 2007, 2008. And they started looking at it, right? And I think I was talking to one of our other architects and it was one gig is what we started at, right? Now, we're upwards of 600 gigs. Just for security. So, it started there and it just kind of morphed into this huge relationship where we're partnering and touching all aspects of our business with Splunk. You know, and the Cloud and everything else. >> So, we heard, I don't know if you guys saw the key notes today, but we saw some announcements building on yesterday's Splunk next announcement. We heard some business workflow and some industrial IOT. I would think both of those are relevant for you guys. Not industrial IOT, but your IOT. Do you see Splunk permeating further into the organization? I guess, the answer's yes. You kind of already said that. But I'm interested in what role you guys play in facilitating that ? Are you kind of champions, evangelist, experts, consultants? How does that work? How do you see that (mumbles)? >> Sheldon: So, we see ourselves as internal consultants. We have our internal customers that depend on our guidance and our end-to-end view of the business processes. So, and now as enter our Cloud journey, into the second year of our Cloud journey, just we're able to accelerate our time to value for our internal customers to gain even greater insights into what's happening ship and shore. >> Dave: I wonder how, if you can talk about, how enterprise architecture has changed over the last decade even. You know, it used to be you were trying to harden the two tier or three tier architecture and harden top, don't touch it, it works. And then, of course, we all know, it created a lot of different stove pipes and a lot of data was locked into those stove pipes. That's changed, obviously. Cloud, now the Edge. Maybe because you guys were always sort of a distributed data company, you approached it differently. But I wondered if you could gives us (mumbles)? >> Sheldon: No, that's an interesting question. Because the evolution is not so much enterprise architect as it is eco system architect, right? So, now you have these massively distributed systems. So, you're really managing an eco system of internal and third party. And then all the relevant touch points, right? Like Alex mentioned, all that perimeters constantly shifting now. So, yeah, our focus is always aligning with the on-time business process and our internal customers. >> Yeah, wonder if we could dig into the Cloud a little. Alex, can we start with you? How does Cloud fit into your world of security? >> Alex: So, for me, the Cloud, as far as Splunk goes, it allows me to expand and contract as needed, right? So before, we used to have our on premise hardware, very finite RAM memory, I mean, disk space everything. So now, with the Cloud, I'm able to expand my environment as I move across all my North American brands, European brands, to be able to gather all that data, look at it and take action on it, right? >> Stu: And Sheldon, you're using AWS. We see they're, every software provider lives in AWS. It's often in the marketplace. We been seeing a lot this week that there's a deeper partnership. There's actually a lot of integration. Maybe give us your viewpoint on what you've seen on how Splunk and AWS work together to meet your requirements. >> Yeah. So, that's an interesting evolution as well of that partnership, right? So, you're starting to see things like the S3 API integration. So that you're removing storage from the critical path. And now that opens up different scale of possibilities, right? And internal opportunities. But yes, as you can see, leveraging the machine learning toolkit. I saw that one coming. It's going to be interesting to see how that keeps evolving, right? And also, like I was speaking to Alex, about the natural language capability. So, that also is well brought into the dimension of how our senior leadership with interact with these operational platforms. >> Yeah, I got to thank you. You're going to have your customer's natural language has to get into some of their rooms. It's definitely future. >> Sheldon: Oh, it's going to be apart of that value chain. Yeah, for sure. >> Dave: How does the S3 API integration affect you guys? Obviously, you got to put Syntax in an object store, which is going to scale. What does that mean for you guys? >> Sheldon: So, using the Splunk developer Cloud, we could develop all sorts of solutions to manage it intelligently how our storage, right? In near real time. So, we can completely automate and that end-to-end just integration with Splunk, how it ingest, how long that data stays relevant and how we offload it into things like Glacier. >> Dave: In the enablement, there is the S3 API. So, you're taking advantage of all the AWS automation tooling. >> Sheldon: Correct. >> Is that right? >> Sheldon: Correct. >> Alright. >> Sheldon: That's another example of that side integration. Not only with the S3 API. Lex, for the natural language. Obviously, TensorFlow and the machine learning toolkit. So, I think you're going to see that type of... those type of capabilities expanding as Splunk evolves. Next year, I'm sure they're going to have a ton of more, you know, announcements around how this evolution continues, right? >> Dave: So, you know, I was interested in the TensorFlow and Spark integration. And Stu and I were talking in an earlier segment. It's great, developers love that. We saw a lot of demos today that was like, looks so simple. Anybody could do it. Even I might be able to do it. But as practitioners of Splunk, is it really going to be that easy? Are business users actually going to be able to pick this stuff up and what are they going to have to do in order to take advantage of Splunk? Some training involved? >> Sheldon: Right, right. >> What's the learning curve going to be like? >> Sheldon: That's a great question, because there's a dual focus to this, right? First, is offloading from the developer. All that heavy lifting of creating this user interface and the dashboards, per say. Now, its all API driven. So, as you saw, maybe in the keynote this morning, that within the demo, was an API driven dashboard came together in several minutes. But one is offloading that and the second part is just enabling the business user with other capabilities, like natural language process. And they don't necessarily need to be on that screen. They can get acception reporting through emails and voice commands. So, training is also part of it, obviously. So, it's a multifaceted approach to leveraging these new capabilities. >> Dave: Are you guys responsible for the physical infrastructure of your ships? I mean, is that part of your purview? Okay. So, really there's is an industrial IOT component big time for you guys. >> Absolutely. >> Alex: And there's a huge push now for Maritime security, right? We saw what happened with Maersk and NotPetya virus, right? So, how it took them out of operation for about three weeks. So, this IOT is very, I think, awesome, right? I was speaking to some of the Splunk guys yesterday about it. How we could leverage that on our ships to gather that data, right, from our SCADA systems. And from our bridge and engine control systems to be able to view any kind of threat. Any kind of vulnerability that we might be seeing in the environment. How we can control that and how we can predict anything from happening, right? So, that's going to be very key to us. >> Dave: So, Splunk is going to take that data right off the machines. Which Stu and I were talking, that to us is a huge advantage. So many IT companies are coming and saying, "Hey! We're going to put a box at the edge". That's nice, but what about the data? So, Splunk's starting with the data, but it's the standards of that data. They're really driven by engineers and operations technology folks. Is Splunk sort of standard agnostic? Can they be able to ingest that data? What has to be done for you guys to take advantage of that? >> So, we'll have to ingest that data. And we'll have to, you know, look at it and see what we're seeing, right? This is all brand new to us as well. >> Dave: Right. >> Right. This whole Maritime thing has risen up in the past year, year and a half. So, we're going to have to look at the data and then kind of figure out what we want to see. Normalize it, you know, we'll probably get some PS services or something to assist us. Some experts. And then we just go from there, right? We build our dashboards and our reports. >> Dave: And predictive maintenance is a huge use case for you guys. >> Alex: Absolutely. >> I mean, to me, it's as important as the airlines. >> Alex: Absolutely, yes. >> So, I would think, anytime you... Well, first of all, real time during a journey. But anytime that journey is completed, you must bring in the inspectors and, I'm sure, very time consuming and precise. >> So, I know that some of our senior leadership, especially in the Maritime space, has now looking towards Splunk to do some of that predictive maintenance. To make sure that we have that right nuts and bolts, right? Per say, on the ship. To be able to fix any issue that might arise at sea while we're on there. >> Dave: Now, it's expect that the drive is going to be for human augmentation and of drive efficiency. >> Alex: Correct. >> You're not just going to trust the machines right out of the box. No way, right? >> Alex: No. But it's empowering those engineers, right? As we see with some of the dashboards that they're coming up with at the keynote. Empowering some of the those engineers that are in the engine room. That are in bridge. To be able to see those issues come up, right? And be able to track. >> Dave: Plus, I would imagine this is the kind of thing like an airline pilot. You're double checking, you're triple checking. So, you might catch misses earlier on in the cycle. >> Alex: Yeah. I could see it having huge impact. >> Stu: Yeah. Sheldon, I was just thinking through the other next announcement. I wonder if Splunk business flows sounds like something that might fit into your data pipeline? Get insights, understand satisfaction. Seems like it might be a fit. Is that of interest to you? >> Sheldon: Yeah, it sure is. Because we definitely want to, since we've evolved with kind of fragmented systems. We still have main frames, we still have whole call center environment that we need to ensure that it's parts of the end-to-end guest experience. So, for sure, we're getting into the whole early adopter program on the process flow. >> Yeah. Can you give us little insight? What kind of back and forth do you have with Splunk? What sort of things are you asking that would help make your jobs easier going forward? >> So, going forward, I know they're addressing a lot so the ingestion and data standardization. And now, with the decoupling of the storage, which is awesome, makes our lives a lot easier. But the evolution of the natural language and the integration with AWS natively is huge for us, as well as our Cloud program matures. And we start enabling Serverless architectures, for example. So, yeah. No, it's a very important part. >> Stu: Yeah. I mean, Serverless is actually something we're pretty interested. What are some of the early places that you're finding value there? >> Well, many people don't know this, but Carnival's also one of the largest travel agencies in the United States. So, we have the whole... Well, it's the whole global air travel platform that we're currently migrating to a Serverless architecture, integrates with Sabre. So, we're looking at things like open trace for that. And I know that our friends at Splunk are enabling capabilities for that type of management. >> Dave: And what's the business impact of Serverless there? You're just better utilization of resources? Faster time to value? Maybe you could describe. >> Yeah. Near real time processing. Scaling up and scaling down seasonally. Our key aspects of that. Removing the constraints of CPU and storage and-- >> Dave: Alex, has it changed the security paradigm at all? Serverless? How does it change it? >> Alex: So, it does. It let's me not have to worry so much about on premise stuff, right? As I did before. So, that helps a lot, right? And being able to scale up and down quickly as much data as we're ingesting is very key for us. >> Dave: You guys are heavy into Cloud, it's obvious. I wonder if you could share with us how you decide, kind of, what goes? If you're not all in on Cloud, right? It's not 100 percent Cloud? >> Sheldon: No, we could never be all in. >> No. >> Dave: And we've put forth that notion for years. We call it "true private cloud". That what you want to do is bring the Cloud experience to your data, wherever that data lives. There's certain data and workloads that you're not just going to put into the Cloud. >> Sheldon: That's correct. >> So, you would confirm that. That's the case. Like, you just said it. >> Correct. >> Dave: You're never going to put some of these workloads on Cloud. >> Well, we have floating data centers. So, we'll always be in a hybrid model. But there is a decision framework around how we create those application, migration pipelines. And the complexity and interdependencies between these platforms, some are easier to move than others. So, yeah. No, we're quite aware of-- >> Dave: And so, my follow up question is are you trying to bring that Cloud experience to those... to the floating data centers, wherever possible? And how is the industry doing? If you had a grade them in terms of their success. I mean, you certainly hear this from the big tech suppliers. "Oh, yes! We've got private Cloud" and "It's just like the public Cloud". And we know it's not and it doesn't have to be. >> Sheldon: Right. >> But if it can substantially mimic that public Cloud experience, it's a win for you guys. So, how is the industry doing in your view? >> So, I think it's a crawl, walk, run type of thing. Obviously, you have these floating cities and satellite bandwidth is a precious resource that we have to use wisely, right? So, we definitely are Edge computing strategy is evolving rapidly. What do we act upon at the Edge? What do we send to the Cloud? When do we send it? There also some business drivers behind this. For example, one of our early Cloud forays was in replicating a guest activity aboard the ship. So, we know if somebody buys a margarita off the coast of Australia, we know it five seconds later. And then, we could act upon that data. Casino or whatever data it may be in near real time. >> So, a lot of data stays at the floating data center, obviously. >> Correct. >> Much of it comes back to the Cloud. When it comes back to the Cloud is a decision, 'cause of the expense of the bandwidth. What do you do? You part the ship at the data center and put a big fire hose in there? (laughing) >> Alex: I wish it was that easy. >> You got a bunch of disc drives that you just take and load up? That's got to be a challenge. >> So, there business requirements, right? So, we have to figure out what application is more important, right? So, usually like our ship property management system, right. Where we have all our guests data, as far as their names, birth dates, all that stuff. That takes priority over a lot of other things, right. So, we have to use, like Sheldon said, that bandwidth wisely. 'Cause we don't really own a lot of the ports that we go into. So, we can't, just like you say, plug in a cable and move on, right? We still rely heavily on our satellites. So, bandwidth is our number on constraint and we have to, you know, we share it with our revenue generating guests as well. So, obviously, they take priority and a lot of factors go into that. >> Dave: And data's not shrinking. So, I'll give you guys the last word, if you could just sort of summarize, in your view, some of the big challenges that you're going to try to apply Splunk towards solving in the next near to mid term. >> Alex: Well, I'm more security focused. So, for me, its just making sure that I can get that data as fast as possible. I know that I saw yesterday at the keynote, the mobile app. That for me is going to be like one of the things I'm going to go like, research right away, right? 'Cause for me, its' getting that alert right away when something's going on, so that I can mitigate quickly, move fast and stop those threats from hitting our environment. >> Dave: Sheldon? >> Yes, I think the challenges are, like you mentioned earlier, about the stove pipes and how organizations evolve. Now, with this massive influx of data, that just making sense of it from a people, technology and processes standpoint. So that we could manage the chaos, so to speak, right? And make sure that we have an orderly end-to-end view of all the activity on the ships. >> Dave: Well, thank you guys. Stu and I are like kids in a candy shop, 'cause we getting to talk to so many customers this week. So, we really appreciate your time and your insights and the inspiration for your peers. So, thank you. >> Oh, thank you very much. >> Alex: Thank you for having us. >> Dave: You're welcome. Alright, keep it right there everybody. Stu and I will be back right after this short break. You're watching theCUBE Live from .conf18. Be right back. (techno music)

>> Live from Orlando, Florida, it's theCUBE, covering .conf2018! Brought to you by Splunk. (techno music) >> Welcome back to Orlando, everybody. We're here with theCUBE covering Splunk.conf2018. I'm Dave Vellante with my co-host, Stu Miniman. Chris Crocco is here, he's the Lead Solutions Engineer at ViaSat. Great to see you, thanks for coming on theCUBE. >> Well, thanks for having me. I appreciate it. >> You're very welcome. Let's start with ViaSat. Tell us what you guys do and what your role is all about. >> So ViaSat is a global communications and technology company primarily focused on satellite-based technologies, anything from government services to commercial aviation and residential service. >> And what does a Lead Solutions Engineer do? >> My primary role is to help us kind of transition from a traditional operations state into more of a DevOps environment including monitoring, alerting, orchestration and remediation. >> Oh, we love this conversation, don't we? Okay. The basic question is, and I know it's hard, but it's subjective, it's kind of if you think about the majority of your organization in the context of DevOps, on a scale of one to five, five being nirvana, so let's assume you're not at five 'cause it never ends, right? You're constantly evolving. Where would you say you are? Are you just getting started? Are you more like a four, 4 1/2, what do you think? >> That's a good question. I would say we're probably three on our way to four. We've had a lot of growing pains, we've had a lot of learning opportunities. The processes of DevOps are getting pretty well-entrenched and right now, we're working on making sure that the culture sticks with the DevOps. >> That's critical, right? >> I mean, that's really where the rubber meets the road is that organizational and political. Without getting into the dirt of it, give us what it looked like before and where you are today. >> Sure. Prior to our shift to DevOps, which was mainly motivated by our latest spacecraft, ViaSat-2, we had a very traditional operational model where we had everything funneled through a Network Operations Center, we had a Technical Operations Team, and if they weren't able to triage and remediate issues, they kicked it over the fence to engineers and developers who would then throw something back. There wasn't a lot of communication between the two organizations, so when we did find recurring problems, recurring issues in our network and in our environment, it took a long time to get those resolved and we had to have a large volume of staff there just to kind of put out the fires. With the transition of DevOps, one of the things that we've been focusing on is making sure that our development teams, our engineering teams understand the customer experience and how it's impacted by what they do, and de-centralizing that operation structure so all of the triage work goes to the people who actually work on those services. So it's a pretty big paradigm shift but it's also helping us solve customer problems faster and get better education about what the customer experience is to the people who actually make it better. >> And roughly, what was the timeframe that it took to go from that really waterfall model to the structure that you have today? >> We've been going for about two or three years now in this transition. Like I said, the first year or so was kind of bumpy and we've really kind of ramped up over the past year in terms of the amount of teams that are practicing DevOps, the amount of teams that are in an agile and scrum model. So overall, two to three years to get to where we are today. >> So the problem with the traditional model is you have time to deployment is slower, that means time, the value is slower, a lot of re-work. Here, you take it. No, you take it. Hey, it worked when I gave it to you, a lot of back and forth, and not a lot of communication creates frustration, not a lot of collaboration and teamwork, then you're working through that now. How large is the team? >> My team is five people. We have 4,500 people roughly at ViaSat as a whole. I believe roughly 2,000 of them are in an engineering or technical role. >> Okay, but in the previous model, you had developers and you had operations folks, is that right? And your five are sort of split over those or was it a much, much larger corpus of folks? >> It was a very large distribution of people. It was very engineering and developer-centric. We still had a Core Operations Team of 60 to 100 people based in our Denver office. We're keeping our headcount relatively the same with respect to our operations and we're growing a lot in terms of those DevOps teams. So as those teams continue to grow, we're adding more operational resources to them and kind of inserting a lot of that knowledge into other parts of the organization. >> You're doing a lot more with the same. Are you coming from the ops side or the dev side? >> I come from the ops side. I actually started my career with ViaSat in our knock in Denver. From there, I transitioned into a ops analyst role and then we created the Solutions Engineering Team and I took the lead on that. >> Chris, can you tell us how Splunk plays into your DevOps? Did you start using it in the knock and kind of go from there? >> We did, actually. Splunk started out as just a tool for us to see how many modems were offline in the knock. It was up on the video wall and we would see spikes and know that there was a problem. And as we've made this transition at DevOps, a lot of teams that were using other solutions, other open-source and home-grown solutions were kind of organically pivoting to Splunk because it was a lot easier for them to use for alerting dashboards, deep-data analysis, a lot of the things they needed to do their job effectively. So as we've grown as a company, as we've grown in this organizational model, Splunk has kind of grown along with that in terms of use case. >> That growth is predominately in IT operations and security, correct? >> Well, it's actually pretty interesting. It's kind of all over the board in our organization. It started in IT operations and security, but we have people in our marketing department using it to make sales and campaign decisions. We have executive leadership looking at it to see the performance of our spacecraft, we have exploratory research being done with it in terms of what's effective and what's not for our new spacecraft that will be coming out, the ViaSat-3 Constellation. So it's really all over the board in our organization. >> That's interesting, Stu, you're not the first customer who's told us that no, it's not just confined to IT, it's actually seeping through the organization. Despite the fact that we heard a bunch of announcements today, I don't know if you saw the keynotes, making it simpler for lines of business folks to actually utilize Splunk, so given that a lot of your teams in the business are actually using it already, what do you think these announcements will do for them? Maybe you haven't had time to evaluate it, but essentially, it's making it easier for business people, you know, simplifying it. >> Yeah, you know, all of the announcements in the keynotes over the past two days have been really, really exciting. Everything that I was hoping for got checked off the list. So I think one of the big things that it's going to allow us to do is get our customer-facing teams and our customer care organizations more involved with the tool. And getting them the information that they need to better serve customers that are calling in, and potentially even prevent the situations that customers have to call in for in the first place. So giving them a lot of account information quickly, giving them the ability to access information that is PCI and PII-compliant but still allowing them to get the data they need to service an individual customer, all of those things I think are really going to be impacted by the announcements in this conf. >> So you were the keynote yesterday. >> I was! >> Were you shaking the phone? >> I was, yeah. >> Which group were you, were you orange? >> We were orange group, yeah. >> We were orange, too! But we were sitting in the media section and all the media guys were sitting on their hands but we had a lot of devs and ops guys shaking with us. It's like when you do the wave at Fenway Park when it gets behind home plate, everybody just kind of sits down, but we were plugging hard. Alright, Chris, what else has excited you about .conf2018? School stuff that you've seen, some innovations, things you've learned. >> Well, I'm really excited about the app for infrastructure. That's something that we've been trying to get for ITSI for a long time now in terms of NED-level monitoring and NED-level thresholding. I think that's going to complement our business really, really well. The advancements that they're doing with the metrics store, specifically with things like Syslog are really, really exciting. I think that that's going to allow us to accelerate our data and make it more performant. The S3 compliant storage is absolutely fantastic and it comes in black now and that's really, really fantastic. >> Oh right! The dark mode! >> Dark mode, yup. >> You mentioned the ITSI. Have you used the VictorOps pieces before or is that something you're looking to do? >> We haven't looked at VictorOps as of yet. We're an xMatters customer right now so we've been using their integration that they built out and it's on Splunk base. But VictorOps, it'll be interesting to see how that organization changes now that it's part of the Splunk. >> So dark mode actually, it's one of those things that it really got such a loud ovation. It was funny, I was actually talking to a couple Splunkers that are like, "We want that dark mode t-shirt." Which I think you have to be a user and you need to sign up for some research thing that they're doing, and they're giving out the black shirt that has like gray text on it. >> Awesome! >> Why does that resonate with you, the dark mode? >> Well, it was actually what they talked about in the keynote. If you have it up on a video wall, which we have in various parts of our company, or if you're sitting in a dark office, something like that, looking at a really white screen for a long period of time, it's not easy on your eyes, it's hard to look at for a long period of time. And generally speaking, a lot of our presentation layers go towards that visual format. So I think this is going to allow us to make it much more appealing to the people who are putting this up on screens in front of people. >> Your responsibility extends out into the field, I presume. The data that's in the field, is that true? >> It does. >> Okay, so I'm interested in your reaction to the industrial IoT announcements, how you see or if you see your organization taking advantage of that. >> Well, we're a very vertically integrated company so we actually manufacture a lot of the devices that we use and that we provide to our customers. I think a lot of our manufacturing capabilities would really benefit from that. Anything from building antennas for ground segment that actually talked to the spacecraft. It's the modems that we put in people's houses, that entire fabrication process I think would benefit a lot. I really loved the AR presentation that they did where they were actually showing the overlay of metrics on a manufacturing line. I think that's something that would be fantastic for us, particularly for sending somebody to an antenna or a ground station to replace a piece of equipment. We can overlay those metrics, we can overlay all of that, we can use the industrial analytics piece of that to actually show which piece of hardware is most affected and how best to replace that. So a lot of opportunities there for our company. >> So I wonder if you could help us understand what's, from your perspective, on Splunk's to-do list. We're going to have Doug Merritt on a little later. If you had Doug right here and he said, Chris, what can we do to make your life better? What would you tell him? >> You know, I think a couple of the things that would make it better, and it looks like they're heading this direction, is streaming in and streaming out. You know, streaming in is of course important, that's where a lot of your data lives, but you also have to be able to send that out to Kafka, to Kinesis, to other places, so other people can consume the output of what Splunk is doing. So I think that would be a really, really important thing for us to socialize the benefit of Splunk. And then vertically integrating the incident management chain, it looks like something that's on their roadmap and I'd be interested to see what their roadmap looks like in terms of pulling in Phantom, pulling in VictorOps, pulling in some of these other technologies that are now in the Splunk umbrella to really make that end-to-end process of detecting, directing and remediating issues a lot more efficient. >> Okay, and do you see at some point that the machine will actually do, the machine intelligence will do a lot of that remediation? >> I think so. >> Do you see the human still heavily involved? >> Well, I think one of the important things is for a lot of these remediation things, we shouldn't have a human involved, right? Particularly things that are well-known issues. Human beings are expensive and human beings are important, and there are a lot more important things that they can be doing with their time than putting out fires. So if we can have machines doing that for them, it frees them up to do a lot more cool stuff. >> You're right. Alright, Chris, well listen, thanks very much for coming on theCUBE. It was great to have you. >> Yeah! Appreciate it very much. >> Thanks for your insights. Alright, keep it right there, everybody. Stu and I will be back with our next guest. You're watching theCUBE from Orlando Splunk.conf2018. Be right back. (techno music)

>> Announcer: Live from Orlando, Florida. It's theCube. Covering .conf18, brought to you by Splunk. >> We're back in Orlando, Dave Vellante with Stu Miniman. John Rooney is here. He's the vice president of product marketing at Splunk. Lot's to talk about John, welcome back. >> Thank you, thanks so much for having me back. Yeah we've had a busy couple of days. We've announced a few things, quite a few things, and we're excited about what we're bringing to market. >> Okay well let's start with yesterday's announcements. Splunk 7.2 >> Yup. _ What are the critical aspects of 7.2, What do we need to know? >> Yeah I think first, Splunk Enterprise 7.2, a lot of what we wanted to work on was manageability and scale. And so if you think about the core key features, the smart storage, which is the ability to separate the compute and storage, and move some of that cool and cold storage off to blob. Sort of API level blob storage. A lot of our large customers were asking for it. We think it's going to enable a ton of growth and enable a ton of use cases for customers and that's just sort of smart design on our side. So we've been real excited about that. >> So that's simplicity and it's less costly, right? Free storage. >> Yeah and you free up the resources to just focus on what are you asking out of Splunk. You know running the searches and the safe searches. Move the storage off to somewhere else and when you need it you pull it back when you need it. >> And when I add an index or I don't have to both compute and storage, I can add whatever I need in granular increments, right? >> Absolutely. It just enables more graceful and elastic expansiveness. >> Okay that's huge, what else should we know about? >> So workload management, which again is another manageability and scale feature. It's just the ability to say the great thing about Splunk is you put your data in there and multiple people can ask questions of that data. It's just like an apartment building that has ... You know if you only have one hot water heater and a bunch of people are taking a shower at the same time, maybe you want to give some privileges to say you know, the penthouse they're going to get the hot water first. Other people not so much. And that's really the underlying principle behind workload management. So there are certain groups and certain people that are running business critical, or mission critical, searches. We want to make sure they get the resources first and then maybe people that are experimenting or kind of kicking the tires. We have a little bit of a gradation of resources. >> So that's essentially programmatic SLAs. I can set those policies, I can change them. >> Absolutely, it's the same level of granular control that say you were on access control. It's the same underlying principle. >> Other things? Go ahead. >> Yeah John just you guys always have some cool, pithy statements. One of the things that jumped out to me in the keynotes, because it made me laugh, was the end of metrics. >> John: Yes. >> You've been talking about data. Data's at the ... the line I heard today was Splunk users are at the crossroads of data so it gives a little insight about what you're doing that's different ways of managing data 'cause every company can interact with the same data. Why is the Splunk user, what is it different, what do they do different, and how is your product different? >> Yeah I mean absolutely. I think the core of what we've always done and Doug talked about it in the keynote yesterday is this idea of this expansive, investigative search. The idea that you're not exactly sure what the right question is so you want to go in, ask a question of the data, which is going to lead you to another question, which is going to lead you to another question, and that's that finding a needle in a pile of needles that Splunk's always great at. And we think of that as more the investigative expansive search. >> Yeah so when I think back I remember talking with companies five years ago when they'd say okay I've got my data scientists and finding which is the right question to ask once I'm swimming in the data can be really tough. Sounds like you're getting answers much faster. It's not necessarily a data scientist, maybe it is. We say BMW on stage. >> Yeah. >> But help us understand why this is just so much simpler and faster. >> Yeah I mean again it's the idea for the IT and security professionals to not necessarily have to know what the right question is or even anticipate the answer, but to find that in an evolving, iterative process. And the idea that there's flexibility, you're in no way penalized, you don't have to go back and re-ingest the data or do anything to say when you're changing exactly what your query is. You're just asking the question which leads to another question, And that's how we think about on the investigative side. From a metric standpoint, we do have additional ... The third big feature that we have in Splunk Enterprise 7.2 is an improved metrics visualization experience. Is the idea of our investigative search which we think we are the best in the industry at. When you're not exactly sure what you're looking for and you're doing a deep dive, but if you know what you're looking for from a monitoring standpoint you're asking the same question again and again and again, over and again. You want be able to have an efficient and easy way to track that if you're just saying I'm looking for CPU utilization or some other metric. >> Just one last follow up on that. I look ... the name of the show is .conf >> Yes. >> Because it talks about the config file. You look at everywhere, people are in the code versus gooey and graphical and visualization. What are you hearing from your user base? How do you balance between the people that want to get in there versus being able to point and click? Or ask a question? >> Yeah this company was built off of the strength of our practitioners and our community, so we always want to make sure that we create a great and powerful experience for those technical users and the people that are in the code and in the configuration files. But you know that's one of the underlying principles behind Splunk Next which was a big announcement part of day one is to bring that power of Splunk to more people. So create the right interface for the right persona and the right people. So the traditional Linux sys admin person who's working in IT or security, they have a certain skill set. So the SPL and those things are native to them. But if you are a business user and you're used to maybe working in Excel or doing pivot tables, you need a visual experience that is more native to the way you work. And the information that's sitting in Splunk is valuable to you we just want to get it to you in the right way. And similar to what we talked about today in the keynote with application developers. The idea of saying well everything that you need is going to be delivered in a payload and json objects makes a lot of sense if you're a modern application developer. If you're a business analyst somewhere that may not make a lot of sense so we want to be able to service all of those personas equally. >> So you've made metrics a first class citizen. >> John: Absolutely. >> Opening it up to more people. I also wanted to ask you about the performance gains. I was talking to somebody and I want to make sure I got these numbers right. It was literally like three orders of magnitude faster. I think the number was 2000 times faster. I don't know if I got that number right, it just sounds ... Implausible. >> That's specifically what we're doing around the data fabric search which we announced in beta on day one. Simply because of the approach to the architecture and the approach to the data ... I mean Splunk is already amazingly fast, amazingly best in class in terms of scale and speed. But you realize that what's fast today because of the pace and growth of data isn't quite so fast two, three, four years down the road. So we're really focused looking well into the future and enabling those types of orders of magnitude growth by completely re imagining and rethinking through what the architecture looks like. >> So talk about that a little bit more. Is that ... I was going to say is that the source of the performance gain? Is it sort of the architecture, is it tighter code, was it a platform do over? >> No I mean it wasn't a platform do over, it's just the idea that in some cases the idea of thinking like I'm federating a search between one index here and one index there, to have a virtualization layer that also taps into compute. Let's say living in a patchy Kafka, taking advantage of those sorts of open source projects and open source technologies to further enable and power the experiences that our customers ultimately want. So we're always looking at what problems our customers are trying to solve. How do we deliver to them through the product and that constant iteration, that constant self evaluation is what drives what we're doing. >> Okay now today was all about the line of business. We've been talking about, I've used the term land and expand about a hundred times today. It's not your term but others have used it in the industry and it's really the template that you're following. You're in deep in sec ops, you're in deep in IT, operations management, and now we're seeing just big data permeate throughout the organization. Splunk is a tool for business users and you're making it easier for them. Talk about Splunk business flow. >> Absolutely, so business flow is the idea that we had ... Again we learned from our customers. We had a couple of customers that were essentially tip of the spear, doing some really interesting things where as you described, let's say the IT department said well we need to pull in this data to check out application performance and those types of things. The same data that's following through is going to give you insight into customer behavior. It's going to give you insight into coupons and promotions and all the things that the business cares about. If you're a product manager, if you're sitting in marketing, if you're sitting in promotions, that's what you want to access and you want to be able to access that in real time. So the challenge is that we're now stepping you with things like business flow is how do you create an interface? How do you create an experience that again matches those folks and how they think about the world? The magic, the value that's sitting in the data is we just have to surface it for the right way for the right people. >> Now the demo, Stu knows I hate demos, but the demo today was awesome. And I really do, I hate demos because most of them are just so boring but this demo was amazing. You took a bunch of log data and a business user ingested it and looked at it and it was just a bunch of data. >> Yeah. >> Like you'd expect and go eh what am I supposed to do with this and then he pushed button and then all of a sudden there was a flow chart and it showed the flow of the customer through the buying pattern. Now maybe that's a simpler use case but it was still very powerful. And then he isolated on where the customer actually made a phone call to the call center because you want to avoid if possible and then he looked at the percentage of drop outs, which was like 90% in that case, versus the percentage of drop outs in a normal flow which was 10%- Oop something's wrong, drilled in, fixed the problem. He showed how he fixed it, oh graphically beautiful. Is it really that easy? >> Yeah I mean I think if you think about what we've done in computing over the last 40 years. If you think about even the most basic word processor, the most basic spreadsheet work, that was done by trained technicians 30-40 years ago. But the democratization of data created this notion of the information worker and we're a decade or so now plus into big data and the idea that oh that's only highly trained professionals and scientists and people that have PHDs. There's always going to be an aspect of the market or an aspect of the use cases that is of course going to be that level of sophistication, but ultimately this is all work for an information worker. If you're an information worker, if you're responsible for driving business results and looking at things, it should be the same level of ease as your traditional sort of office suite. >> So I want to push on that a little if I can. So and just test this, because it looked so amazingly simple. Doug Merritt made the point yesterday that business processes they used to be codified. Codifying business processes is a waste of time because business processes are changing so fast. The business process that you used in the example was a very linear process, admittedly. I'm going to search for a product, maybe read a review, I'm going to put it in my cart, I'm going to buy it. You know, very straightforward. But business processes as we know are unpredictable now. Can that level of simplicity work and the data feed in some kind of unpredictable business process? >> Yeah and again that's our fundamental difference. How we've done it differently than everyone in the market. It's the same thing we did with IT surface intelligence when we launched that back in 2015 because it's not a tops down approach. We're not dictating, taking sort of a central planning approach to say this is what it needs to look like. The data needs to adhere to this structure. The structure comes out of the data and that's what we think. It's a bit of a simplification, but I'm a marketing guy and I can get away with it. But that's where we think we do it differently in a way that allows us to reach all these different users and all these different personas. So it doesn't matter. Again that business process emerges from the data. >> And Stu, that's going to be important when we talk about IOT but jump in here. >> Yeah so I wanted to have you give us a bit of insight on the natural language processing. >> John: Yeah natural language processing. >> You've been playing with things like the Alexa. I've got a Google Home at home, I've got Alexa at home, my family plays with it. Certain things it's okay for but I think about the business environment. The requirements in what you might ask Alexa to ask Splunk seems like that would be challenging. You're got a global audience. You know, languages are tough, accents are tough, syntax is really really challenging. So give us the why and where are we. Is this nascent things? Do you expect customers to really be strongly using this in the near future? >> Absolutely. The notion of natural language search or natural language computing has made huge strides over the last five or six years and again we're leveraging work that's done elsewhere. To Dave's point about demos ... Alexa it looks good on stage. Would we think, and if you're to ask me, we'll see. We'll always learn from the customers and the good thing is I like to be wrong all the time. These are my hypotheses, but my hypothesis is the most actual relevant use of that technology is not going to be speech it's going to be text. It's going to be in Slack or Hipchat where you have a team collaborating on an issue or project and they say I'm looking for this information and they're going to pass that search via text into Splunk and back via Slack in a way that's very transparent. That's where I think the business cases are going to come through and if you were to ask me again, we're starting the betas we're going to learn from our customers. But my assumption is that's going to be much more prevalent within our customer base. >> That's interesting because the quality of that text presumably is going to be much much better, at least today, than what you get with speech. We know well with the transcriptions we do of theCUBE interviews. Okay so that's it. ML and MLP I thought I heard 4.0, right? >> Yeah so we've been pushing really hard on the machine learning tool kit for multiple versions. That team is heavily invested in working with customers to figure out what exactly do they want to do. And as we think about the highly skilled users, our customers that do have data scientists, that do have people that understand the math to go in and say no we need to customize or tweak the algorithm to better fit our business, how do we allow them essentially the bare metal access to the technology. >> We're going to leave dev cloud for Skip if that's okay. I want to talk about industrial IOT. You said something just now that was really important and I want to just take a moment to explain to the audience. What we've seen from IOT, particularly from IT suppliers, is a top down approach. We're going to take our IT framework and put it at the edge. >> Yes. >> And that's not going to work. IOT, industrial IOT, these process engineers, it's going to be a bottoms up approach and it's going to be standard set by OT not IT. >> John: Yes. >> Splunk's advantage is you've got the data. You're sort of agnostic to everything else. Wherever the data is, we're going to have that data so to me your advantage with industrial IOT is you're coming at it from a bottoms up approach as you just described and you should be able to plug into the IOT standards. Now having said that, a lot of data is still analog but that's okay you're pulling machine data. You don't really have tight relationships with the IOT guys but that's okay you got a growing ecosystem. >> We're working on it. >> But talk about industrial IOT and we'll get into some of the challenges. >> Yeah so interestingly we first announced the Industrial Asset Intelligence product at the Hannover Messe show in Germany, which is this massive like 300,000 it's a city, it's amazing. >> I've been, Hannover. One hotel, huge show, 400,000 people. >> Lot of schnitzel (laughs) I was just there. And the interesting thing is it's the first time I'd been at a show really first of all in years where people ... You know if you go to an IT or security show they're like oh we know Splunk, we love Splunk, what's in the next version. It was the first time we were having a lot of people come up to us saying yeah I'm a process engineer in an industrial plant, what's Splunk? Which is a great opportunity. And as you explain the technology to them their mindset is very different in the sense they think of very custom connectors for each piece. They have a very, almost bespoke or matched up notion, of a sense to a piece of equipment. So for an example they'll say oh do you have a connector for and again, I don't have the machine numbers, but like the Siemens 123 machine. And I'll be like well as long as it's textural structural to semi structural data ideally with a time stamp, we can ingest and correlate that. Okay but then what about the Siemens ABC machine? Well the idea that, the notion that ... we don't care where the source is as long as there's a sensor sending the data in a format that we can consume. And if you think back to the beginning of the data stream processor demo that Devani and Eric gave yesterday that showed the history over time, the purple boxes that were built, like we can now ingest data via multiple inputs and via multiple ways into Splunk. And that hopefully enables the IOT ecosystems and the machine manufacturers, but more importantly, the sensor manufacturers because it feels like in my understanding of the market we're still at a point of a lot of folks getting those sensors instrumented. But once it's there and essentially the faucet's turned on, we can pull it all in and we can treat it and ingest it just as easily as we can data from AWS Kineses or Apache Access logs or MySequel logs. >> Yeah and so instrumenting the windmill, to use the metaphor, is not your job. Connectivity to the windmill is not your job, but once those steps have been taken and the business takes those steps because there's a business case, once that's done then the data starts flowing and that's where you come in. >> And there's a tremendous amount of incentive in the industry right now to do that level of instrumentation and connectivity. So it feels like that notion of instrument connect then do the analytics, we're sitting there well positioned once all those things are in place to be one of the top providers for those analytics. >> John I want to ask you something. Stu and I were talking about this at our kickoff and I just want to clarify it. >> Doug Merritt said that he didn't like the term unstructured data. I think that's what he said yesterday, it's just data. My question is how do you guys deal with structured data because there is structured data. Bringing transaction processing data and analytics data together for whatever reason. Whether it's fraud detection, to give the buyer an offer before you lose them, better customer service. How do you handle that kind of structured data that lives in IBM mainframes or whatever. USS mainframes in the case of Carnival. >> Again we want to be able to access data that lives everywhere. And so we've been working with partners for years to pull data off mainframes. Again, the traditional in outs aren't necessarily there but there are incentives in the market. We work with our ecosystem to pull that data to give it to us in a format that makes sense. We've long been able to connect to traditional relational databases so I think when people think of structured data they think about oh it's sitting in a relational database somewhere in Oracle or MySequel or SQL Server. Again, we can connect to that data and that data is important to enhance things particularly for the business user. Because if the log says okay whatever product ID 12345, but the business user needs to know what product ID 12345 is and has a lookup table. Pull it in and now all of a sudden you're creating information that's meaningful to you. But structure again, there's fluidity there. Coming from my background a Json object is structured. You can the same way Theresa Vu in the demo today unfurled in the dev cloud what a Json object looks like. There's structure there. You have key value pairs. There's structure to key value pairs. So all of those things, that's why I think to Doug's point, there's fluidity there. It is definitely a continuum and we want to be able to add value and play at all ends of that continuum. >> And the key is you guys your philosophy is to curate that data in the moment when you need it and then put whatever schema you want at that time. >> Absolutely. Going back to this bottoms up approach and how we approach it differently from basically everyone else in the industry. You pull it in, we take the data as is, we're not transforming or changing or breaking the data or trying to put it into a structure anywhere. But when you ask it a question we will apply a structure to give you the answer. If that data changes when you ask that question again, it's okay it doesn't break the question. That's the magic. >> Sounds like magic. 16,000 customers will tell you that it actually works. So John thanks so much for coming to theCUBE it was great to see you again. >> Thanks so much for having me. >> You're welcome. Alright keep it right there everybody. Stu and I will be back. You're watching theCUBE from Splunk conf18 #splunkconf18. We'll be right back. (electronic drums)

>> Announcer: Live from Orlando, Florida It's theCUBE covering .conf18. Brought to you by Splunk. >> Welcome back to theCUBE's coverage of Splunk .conf18. It's Florida week. I'm Stu Miniman, and my co-host for this week is Dave Vellante. Dave, I'm really excited. You've done this show a handful of times. It's our seventh year doing theCUBE here. It is my first time here. Thought I understood a few of the pieces and what's going on, but it's really been crystallizing to me. When we talk about on theCUBE, for the last couple of years, data is at the center of everything, and in the keynote this morning they talked about Splunkers are at the crossroads of data. I've talked to a bunch of practitioners here. People come to them to try to get access to data, and the vision that they've laid out this week for Splunk Next is how they can do a massive TAM expansion, try to get from the 16,000 users that they have today to 10x more. So, what's your take been on where we are today and what Splunk of the future looks like? >> Well so Stu, as you know, the keynotes are offsite, about a half hour away from the hotel where we're broadcasting, and there's like 8,000 buses that they're jamming customers in. It's a bit of a pain to get there, so logistically it's not ideal. So I thought the keynotes today, just remotely, we didn't hop in the bus because we had to miss a lot of the keynotes yesterday, to get back here. So we watched remotely today. It just felt like there wasn't as much energy in the room. And I think that's for a couple of reasons, and I'll get into that. But before I do, you're right. This is my fourth .conf, and I was struck by in the audience at how few people actually, it was probably less than a third of the audience, when they asked people to stand up, had been to four or more .confs. A ton of people, first year or second year. So, why is that relevant? It's relevant because these are new people. The core of Splunk's audience are security people and IT operations management people. And so with that many newbies, newbies, they're trying to learn about how they can get more value out of the tool. Today's announcements were all about line of business and industrial IOT. And frankly, a lot of people in the audience didn't directly care. Now, I'll explain why it's important, and why they actually do care and will care going forward. But the most important thing here is that we are witnessing a massive TAM expansion, total available market expansion, for Splunk. Splunk's a one point six, one point seven billion dollar company. They're going to blow through two billion. This is a playbook that we've seen before, out of the likes of particularly ServiceNow. I'm struck by the way in which Splunk is providing innovation for non-IT people. It's exactly the playbook that ServiceNow has used, and it works beautifully, and we'll get into some of that. >> So Dave, one of the things that really struck me, we had seven customers on the program yesterday, and the relationship between Splunk and the customers is a little different. You always hear, oh well, I love this technology. Lots of companies. You've been telling me how passionate you were. But really partnerships that you talk about, when you talked about, we had an insurance company from Toronto, and how they're thinking about how the security and risks that they look at, how that passes on to their customers. So many, it's not just people are using Splunk, but it's how it affects their business, how it affects their ultimate end users, and that value of data is something that we come back to again and again. >> So the classic Splunk user is somebody in IT, IT operations management, or the security knock. And they're hardcore data people, they're looking at screens all day and they love taking a bath in data. And Splunk has completely changed their lives, because rather than having to manually go through log files, Splunk has helped them organize that sort of messy data, as Doug Merritt said yesterday. Today, the whole conversation was about expanding into line of business and industrial IOT. These are process engineers, there weren't a lot of process engineers in the audience today. That's why I think not a lot of people were excited about it. I'm super excited about it because this is going to power, I've always been a bull on Splunk. This is going to power the next wave of growth at Splunk. Splunk is a company that got to the public markets without having to raise a ton of capital, unlike what you're seeing today. You're seeing hundreds of millions of dollars raised before these companies IPO. So, Splunk today in the keynotes, first of all, they had a lot of fun. I was laughing my you-know-what off at the auditions. I mean, I don't really, some of that stuff is kind of snarky, but I thought it was hilarious. What they did is, they said, well Doug Merritt wasn't a shoo-in to keynote at this, so we auditioned a bunch of people. So they came in, and people were singing, they were goofing, you know, hello, Las Vegas! We're not in Las Vegas, we're in Orlando this year. I thought it was really, really funny and well done. You know Stu, we see a lot of this stuff. >> Yeah, absolutely. Fun is definitely part of the culture here at Splunk, love that we talked about yesterday, the geeky t-shirts with all the jokes on that and everything. Absolutely so much going on. But, Dave there's something I knew coming in, and we've definitely heard it today in the keynotes, developers are such an audience that everybody is trying to go after, and you talk about kind of the traditional IT and security might not really be the developer audience, but absolutely, that's where Splunk is pushing towards. They announced the beta of the Splunk Developer Cloud, a number of other products that they've put in beta or are announcing. What's your take as to how they go beyond kind of the traditional Splunk user? >> Yeah so that's what I was saying. This is to me a classic case of, we saw this with ServiceNow, who's powering their way through five billion land and expand, something that Christian Chabot, former CEO of Tableau used to talk about. Where you come in and you get a foot in the door, and then it just spreads. You get in like a tick, and then it spreads to other parts of the business. So let's go through some of the announcements. Splunk Next, they built on top of that today. Splunk Business Flow, they showed, what I thought was an awesome demo. They had a business person, it was an artificial example of the game company. What was the name of the game company? >> Stu: Buttercup Sames. >> Buttercup Games. So they took a bunch of data, they ingested a bunch of data on the business workflow. And it was just that, it was just a big, giant flow of data. It looked like a huge search. So the business user was like, well what am I supposed to do with this? He then ingested that into Splunk Business Flow, and all of a sudden, you saw a flow chart of what all that data actually said in terms of where buyers were exiting the system, calling the call center, et cetera. And then they were able to make changes through this beautiful graphical user interface. So we'll come back to that, because one would be skeptical naturally as to, is it really that easy? They also announced Splunk for industrial IOT. So the thing I like about this, Stu, and we've seen a lot of IOT announcements in the past year from IT companies. What's happening is that IT companies are coming in with a top-down message to industrial IOT and OT, Operations Technology, professionals. We think that is not the right approach. It's going to be a bottoms-up approach, driven by the operations technology professionals, these process engineers. What Splunk is doing, and the brilliance of what Splunk is doing is they're starting with the data. We heard today, OEE. What's OEE? I haven't heard that term. It's called Overall Equipment Effectiveness. These aren't words that you hear from IT people. So, they're speaking a language of OT people, they're starting with the data, so what we have seen thus far is, frankly a lot of box companies saying, hey we're going to put a box at the edge. Or a lot of wireless companies saying, hey, we're going to connect the windmill. Or analytics companies saying, we're going to instrument the windmill. The engineers are going to decide how it gets instrumented, when it get instrumented, what standards are going to be used. Those are headwinds for a lot of the IT companies coming in over the top. What Splunk is doing is saying, we're going to start with the data coming off the machines. And we're going to speak your language, and we're going to bring you tooling you can use to analyze that operations data with a very specific use case, which is predictive maintenance. So instead of having to do a truck roll to see if the windmill is working properly, we're going to send you data, and you're going to have to roll the truck until the data says there's going to be a problem. So I really like that. Your thoughts on Splunk's IOT initiative versus some of the others we've seen? >> Yeah, Dave. That dynamic of IT versus OT, Splunk definitely came across as very credible. The customers we've talked to, the language that they use. You talk about increasing plan for performance and up time. How can they take that machine learning and apply it to the IOT space, it all makes a lot of sense. Once again, it's not Splunk pushing their product, it's, you're going to have more data from more different sources, and therefore it makes sense to be able to leverage the platform and take that value that you've been seeing with Splunk in more spaces. >> So the other thing that they announced was machine learning and natural language processing four dot oh. They had BMW up on the stage, talking about, that was really a good IOT example, but also predicting traffic patterns. If you think about Waze, you and I, well I especially, use Waze, I know that Waze is wrong. It's telling me I'm going to get there at four thirty, and I know traffic is building up in Boston, I'm not going to get there until ten to five, and Waze somehow doesn't know that. BMW had an example of using predictive analytics to predict what traffic flow is going to look like in the future so I thought that was pretty strong. >> And I loved in the BMW example, they've got it married with Alexa so the business person, sitting at their desk can say, hey Alexa, go ask Splunk something about my data, and get that result back. So pretty powerful example, really obvious to see how we get the value of data to the business user, even faster. >> Now the problem is, I'm going to mention some of the challenges I see in some of these initiatives. The problem with NLP is NLP sucks. Okay, it's not that good today, but it's going to get better. They used an example on stage with Alexa, it obviously worked, they had it rehearsed. It doesn't always work that way, so we know that. They also announced the Splunk Developer Cloud. They said it was three Fs: familiar, flexible, and fast. What I love about this is, this is big data, actually in action. Splunk, as I've been saying all week, they never use the term big data when big data was all on the hype cycle, they now use the term big data. Back when everybody was hyping big data, the big vacuum was applications. Pivotal came out, Paul Maritz had the vision, We're going to be the big data application development platform. Pivotal's done okay there, but it's not taking the world by storm. It's a public company, it had a decent IPO, but it's not like killing it. Splunk is now, maybe a little late to the game, a little later than Pivotal, or maybe even on IBM, but they key is, Splunk has the data. I keep coming back to the data. The data is the linchpin of all of this. Splunk also announced SplunkTV, that's nice, you're in the knock, and you got smart TV. Woo hoo! That's kind of cool. >> Yeah but Dave, on the Developer Cloud, this is a cloud native application, so it's fitting with that model for next generation apps, and where they're going to live, definitely makes a lot of sense. >> They talked about integrating Spark and TensorFlow, which is important obviously in that world. Stu, you in particular, John Ferrier as well, spent a lot of time, Jim Kabilis in the developer community. What's your take on what they announced? I know it was sort of high level, but you saw some demos, you heard their language. There were definitely some developers in the room. I would say, as a constituency, they sounded pretty excited. They were a relatively small number, maybe hundreds, not thousands. >> One of the feedback I heard from the community is being able to work with containers and dockers, something that people were looking for. They're delivering on that. We talked to one of the customers that is excited about using Kubernetes in this environment. So, absolutely, Splunk is reaching out to those communities, working with them. When we talked to the field executive yesterday, she talked about- >> Dave: Susan St. Ledger >> How Splunk is working with a lot of these open source communities. And so yeah, good progress. Good to see where Splunk's moving. Absolutely they listen to their customers. >> So, land and expand, Splunk does not use that term. It's my term that I stole from Christian Chabot and Tableau. Certainly we saw that with ServiceNow. We're seeing a very similar playbook. Workday, in many ways, is trying it as well, but Workday's going from HR into financials and ERP, which is a way more entrenched business. The thing I love about Splunk, is they're doing stuff that's new. Splunk was solving a problem that nobody else could solve before, whereas Workday and ServiceNow, as examples, were essentially replacing legacy systems. Workday was going after PeopleSoft. ServiceNow was going after BMC. Tableau, I guess was going after old, tired OBI. So they were sort of disruptive in that sense. Splunk was like, we can do stuff that nobody's been able to do before. >> Yeah Dave, the last thing that I want to cover in this analysis segment is, we talk about the data. It's the people interacting with it. We've been talking for years, there's not enough skills in data scientists. There's so many companies that we're going to be your platform for everything. Splunk is a platform company, but with a big ecosystem at the center of everything they do. It's the data, it's the data that's most important. They're not trying to say, this is the rigid structure. We talked about a lot yesterday, how Splunk is going to let you use the data where you want it, when you want it. How do you look at what Splunk does, the Splunkers out there, all the people coming to them? Compare and contrast against the data scientists. >> Well this is definitely one of the big challenges. To me, the role of a Splunker, they're IT operations people, they're people in the security knock, and Splunk is a tool for them, to make them more productive, and they've fallen in love with it. You've seen the guys running around with the fez, and that's pretty cool. They've created a whole new class of skill sets in the organization. I see the data scientists as, again, becoming a Splunker and using the tools. Splunk are giving the data scientists tools, that they perhaps didn't have before, and giving them a way to collaborate. I'll come back to that a little bit. If I go through the announcements, I see some challenges here, Stu. Splunk next for the LLB. Is it really as easy as Splunk has shown? As time will tell, we're going to have to just talk to people and see how quickly it gets adopted. Can Splunk democratize data for the line of business? Well on the IOT side, it's all about the operations technology professionals. How does Splunk reach those people? It's got to reach them through partnerships and the ecosystem. It's not going to do a belly to belly direct sales, or it's not going to be able to scale. We heard that from Susan St. Ledger yesterday. She didn't get into IOT because it hadn't been announced yet, but she hinted at that. So that's going to be a big thing. The OT standards, how is Splunk going to adopt those. The other thing is, a lot of the operations technology data is analog. There's a headwind there, which is the pace at which the engineers are going to digitize. Splunk really can't control that in a big way. But, there's a lot of machine data and that's where they're focusing. I think that's really smart of Splunk. The other thing, generally, and I don't know the answer to this Stu, is how does Splunk get transaction data into the system? They may very well may do it, but we heard yesterday, data is messy. There is no such thing as unstructured data. We've heard that before. Well there's certainly a thing as structured data, and it's in databases, and it's in transaction systems. I've always felt like this is one of IBM's advantages, as they got the mainframe data. Bringing transaction data and analytic data together, in real time, is very important, whether it's to put an offer in front of the customer before you lose that customer, to provide better customer service. Those transaction systems and that data are critical. I just don't know the answer to how much of that is getting into the Splunk system. And again, as I said before, is it really that easy as Spark and TensorFlow integration enough? It sounds like the developers will be able to handle it. NLP will evolve, we talked about that as a headwind. Those are some of the challenges I see, but I don't think they're insurmountable at all. I think Splunk is in a really good position, if not the best position to take advantage of this. Why? Because digital transformation is all about data, and Splunk is data. They're all about data. They don't have to go find the data, obviously they have to ingest the data, but the data's there. If you're a Splunker, you have access to that data. All the data? Not necessarily, but you can bring that through their API platforms, but a lot of the data that you need is already there. That's a huge, huge advantage for Splunk. >> Well, Dave, this is one of the best conferences I've been at, with data at the core. It's been so great to talk to the customers. We really appreciate the partnership of Splunk. Splunk events team, grown this from seven years ago, when we started a 600 person show, to almost 10,000 now. So for those of you that don't know, there's so much that goes on behind the scenes to make something like this go off. Really appreciate the partnership and the sponsorship that allows us to help us document this, bring it out to our communities. The analysis segments that we do, we actually bring in podcast form. Go to iTunes or Spotify, your favorite podcast player, look for theCUBE insights. Of course go to theCUBE.net for the video. SiliconANGLE.com for all of the news. Wikibon.com for the research, and always feel free to reach out with us, if you've got questions, or want to know what shows we're going to be in next. For my cohost, Dave Vellante who is Dvellante on Twitter. I'm Stu Miniman, at stu on Twitter, and thanks so much for watching theCUBE. (techno music)

live from Orlando Florida it's the cube coverage conf 18 got to you by spunk welcome back to Splunk kampf 18 hashtag Splunk conf 18 you watching the cube the leader in live tech coverage we go out to the events we extract the signal from the noise I'm Dave Volante with my co-host Stu many men we love to talk to the customers too we've had seven out of ten of our interviews today have been with the customers Tony Alessandra was here as the chief architect at the co-operators group limited insurance company up in Canada leader in that field Tony thanks so much for coming on the yeah it's great to be here thanks for having me so we were talking off-camera about some of the innovation that's going on in Toronto and want to get to that innovation is actually in your long title yeah there's the time but tell us about your role as chief architect and then some of the other areas that you touch yes certainly so my primary role at the co-operators group is to serve as chief architect for the group of companies and so it's a fancy term to mean that I influence how we invest in technology and process for our strategy and for our operational imperatives I also have responsibility for information security within our organization so I have a great team led by a C so at the co-operators group and essentially our role is to to protect the data of our clients right we have a million unique clients across Canada that entrust us with a lot of personal and confidential data we have thousands of financial advisers throughout the company and so we have retail outlets throughout the entire geography of Canada and essentially we collect a lot of data and and with respect to policies for commercial businesses for private clients for subscribers etc and I also manage an innovation portfolio for the organization and so it's actually I'll work with our business stakeholders within the organization to figure out how we could accelerate new businesses accelerate new capabilities with the use of technology who's excited that's a big big big role that you have if I want to send the the regime you have for security say the seaso reports to you yes sir and there's a set CIO there right there is yeah so I report to the to the executive vice president and CIO of the co-operators group of companies and and my responsibility within the organization is to report back to our CIO on all the responsibilities that I talked to you about okay so this the C so technically reports up through the CIO and C so reports up through me into the CIO yeah which is that's a whole other interesting discussion maybe if we have time we could talk about that absolutely um so a lot of data I mean we think about insurance company regulated you got your claim systems which are critical you have your agent systems which are also critical different types of data both data on customers but when you talk about the data that you guys collect where's it come from what are you trying to do with with that data yes so so you know I'll start I'll start with the motive right the problem that we're trying to solve and so I'll say first and foremost we're an insurance company we offer assurance and protection to our clients right and so in the process of offering assurance and protection to our clients you know they entrust us with massive amounts of data like you know as we as we mentioned before but we'll also need to set a good example because a lot of the assurance some of the assurance that we offer to our clients is also cyber protection we offer cyber insurance to our clients we need to set a good example we need to demonstrate resilience right Splunk is a primary tool in our Arsenal where we're showing our clients that we have good resilience to be able to detect and respond to security threats when they happen that's part of our mandate right so our responsibility with respect to using Splunk is to collect data from all of our major systems within our organization we use Blonk to monitor we use Blanc to detect and we also use Splunk to respond when something is going on what is this is really interesting you're being proactive about from your you know from an actuarial standpoint you rate your risk you're being very proactive when many if not most insurance companies would do is say ok what what's the history yeah and are there any high-profile breaches and yeah as opposed to what you're doing like sounds like you're really inspecting what the policies and the procedures and the technology of your clients is I think you hit on an important point right and so the important point is that you know the the the art of actuarial science is to rely on a lot of history in the past you know to predict the risks of the future but the reality is that model is falling apart very quickly because there is very little history for cyber threats and the other aspect of it is its inconsistent its evolving and it's changing on a regular basis right and so that's why you use platforms like Splunk use platforms like spunk to detect new threats and to end to in sort of to advance new correlations what should we be concerned about which threats are relevant to us which ones can we ignore and unless you have good platforms to do correlation unless you have good automation you're gonna need a large army of people to chase things that may not be relevant to either you or your clients so Tony your industry usually has quite a bit of M&A as to kind of fund the growth that's going on curious how does Splunk in your data strategy fit into M&A type a quiz yeah yeah and so I think that's one of the biggest potential uses of Splunk for us right and so the way that insurance is evolving right now is insurance companies are all trying to figure out how they get involved in the loss prevention game right in the past it's all been about assurance right it's all been about protection and so when you think about the Internet of Things is one of the biggest untapped opportunities for insurance companies it's all about data right so smart homes smart buildings cars outfitted with telematics so it's every history you wearing wearable devices so in terms of health and you know a health insurance and life insurance protection etc all of this data is meaningful to offer value to clients beyond what we've been able to do in the past one of the things we've looked at I know the industry is looking at is well how do you value that data is that something your company's gotten into yeah absolutely and so you know part of what we need to figure out is how to model that data to give the right level of engagement to the customer so to create that two-way engagement with the customer right how am i doing how am i driving is the weather a threat for me in in the in the foreseeable future in terms of things that I need to protect is there a hailstorm coming you know should I should I you know have alerts and and and you know provide you know ask clients to move some of their valuables indoors I mean all of these are things that will increase that engagement with our clients because face it with insurance your clients engage with you two times a year right two major time policy renewal and if they're unfortunate enough to have a claim right we need to have a but we need to have a better game much more proactive game with them so you're in other ways a risk consultant with your your clients right yeah so describe that so you client comes to you says they're interested or you go to them they're interested in in in in a security you know insurance where does it start do you ask them you have Splunk do you advise them as to what are you going to look at their policies and procedures well how does it work so so I think you know Splunk is one of those valuable assets that enables the capability right insurance you know the game is becoming all about data having massive amounts of data and being able to use that data to help assess the risks for a client properly right because without having good data everything is a great guest these days I mean with climate change with cyber risks evolving with customers preferences changing data is going to be the meaningful difference in terms of understanding what risks a client has what the probability is and how to write a meaningful policy for them where they're engaged and they understand it well enough as well understand it well enough to prevent some of their losses and that's really the issue that we're trying to figure out how do we help clients understand their risks and then prevent losses prevent or minimize losses for them and and what role does Splunk play in that you you know your your your client are you a an advisor or you encourage your customers to use belong counters at all so we're talking about our future roadmap right now and this is what we're trying to figure out what's blanc this is where we see the strategic opportunities with blah right and so when we look at the co-operators the way that co-operators has been using Splunk in the past is for their security sim we were one of the very first large companies in Canada to put our security sim on Splunk we were the very first large company in Canada to put our sim in Splunk clout right and so we we you know we're very proud with being able to work with Splunk for for charting that course right for setting the example our next course is how do we leverage a platform as powerful as Splunk now to give value to our customers we're protecting our customers data assets and now it's about returning valuable insights back to the customers in terms of loss prevention that's our forward-thinking approach in terms of how we stay ahead in terms of leveraging this as a unique asset as a unique capability so your leader you've got street cred you can now extend that to your client base I mean for an insurance company risk you know chaos is just cash as I like to say it's opportunity for you guys and to the extent that you can help clients mitigate that risk to win-win it's essentially for them the reduction in expected loss it can actually hate to say this but could actually pay for the insurance which is let's take attractive it's a massive win and I think you know the other part you know that people need to think differently about is the way that people consume insurance will change dramatically as well in the next tenure so and so where you think now that you know your typical home and auto insurance you will buy an annual policy well the reality is that Home Sharing car sharing ride-sharing insurance will change to what we call episodic oh right and so essentially you'll be consuming insurance for an activity right and the only way that you'll be able to sort of drive that activity in a meaningful way is to have a lot of data on that activity right where are you driving how did you drive you know what what are the risks associated to when you're driving in the geography that you're driving where are you renting out your home what are the rooms to which client and so understanding all of those elements give us the best opportunity at giving you just in time insurance for the right risks surance as a service I love it personalized for me I mean the model generally item as a consumer is broken it's very bespoke my insurance company doesn't know who I am it's just to check a bunch of boxes off and they sent me another form every year and advised some new things and I don't even know what half the time they are that's exactly right right then the and the only way you're able to personalize is to have all of that data on an individual on a company on an event right so we give you insurance for you based on your needs based on your risks Tony we know there's a lot of AI happening up in the Toronto area yeah maybe our audience might not know tell them a little bit about that and how you're thinking about AI and what interest you have and what's Blanc's talking about when they talk about AI yeah you're absolutely right I mean there's a loop there's a massive amount of artificial intelligence activity in the Toronto Kitchener corridor within southern Ontario I would say it's early days for insurance in terms of how we leverage AI I think you know some of the early wins for us have been what we refer to as chat BOTS or virtual assistants right helping clients so this is basically speed and convenience for clients right clients need to know something very quickly very predictive short-tailed answers we're there for customers who choose to do that where it's going next is helping clients assess risk and predict outcomes associated to risks right and so there's a lot of different use cases that we're working there partnerships with startups partnerships with mainstream organizations like Splunk is an important partner for us in this area and of course academic institutions that are investing right this is all part of it for the sales channel for the risk channel for claims processing so imagine being able to submit a claim on a mobile device gathering all that data being able to correlate that data to say we've seen this before right based on the correlation here's your damages we could processes as quickly here's the experts you need to go to here's the restoration facilities that you'll engage those are massive opportunities for client service and for an ability for an insurance company to settle things quickly right we're talking about weather before it's obviously a changing dynamic has a change variable and maybe it's it's model Abel I don't know but but clearly weather incidents are on the rise have caught companies and probably insurance companies you know a little bit off guard you know climate change etc the boiling seas this we've heard yeah what do you guys what's your position on that how do you accommodate that and pass it on to your customers and well I think this is what we're well known for right and so first of all we're not gonna be able to control the weather but what we'd be able to do is prevent it from getting worse right and so when you'll hear the leadership within our organization talk especially our CEO our CEO is very passionate about building resilient communities and that starts with making sure that we're building communities in the right spots not in flood plains not in areas of high risk of forest fires or or other things that you could you know potentially prevent you know within a certain geography and so that's first and foremost right and so we're a leader in this space in Canada how do you become a leader in this area you collect data understand the geography understand the trends associated to the understand the future risks associated to those geographies based on weather trends and then lobby governments builders entrepreneurs everybody land development consortiums to say we need to build communities in better places we need to build more resilient communities and then thereafter it's making sure that you're leveraging data to be able to predict and minimize losses for clients in those areas right and that's what you'll use weather data for right who do I need to alert we have threats on the way what can we prevent how do we minimize these losses for Canadians I think the big risk that we all need to understand if the weather continues to change at the same pace are our you know people will not be able to afford the risks right and so the insurance will rise exponentially and and you know will we we won't have a sustainable model for the future so it's clear for you guys it's really all about the data one of the challenges that a lot of companies in your industry have is the data it's about the data for them to insurance companies you could argue our you know IT companies in many respects they develop products that are put together by technologists but a lot of the data is in silos yeah as Splunk allowed you to break down those silos and and is that yet part while you're a leader well like I could talk about what's where Splunk has been able to to offer us that that that ability is with security right and so we have data we have information security log data associated to our systems and our application everywhere on Prem our partner sites in our agency offices on different endpoint devices in the cloud with our different service providers so what Splunk has been able to do is us to be able to aggregate that data consume that data build valid use cases and to correlate that and raise proper alerts right that's our main priority right now is to build resilience with information security that knowledge will take us to these other areas that we want to do in offering now the value back to our clients right embed that value into our product offerings is our next logical step awesome Tony thanks very much for coming on the cube really appreciate it you're welcome it's good to meet you in the pleasure have the leaves changed in Toronto its Toronto by the way stew no tea it's coming it's coming fast Dave a lot a force to Minutemen thanks for watching we'll be right back after this short break you're watching the cube from Splunk Kampf 18 [Music]

>> Live from Orlando, Florida, it's theCUBE. Covering .conf18, brought to you by Splunk. >> Welcome back to Orlando everybody, home of Disney World, and this week, home of theCUBE. I'm Dave Vellante and he's Stu Miniman. Steven Hatch is here, he's the manager of Enterprise Logging Services at Cox Automotive. Steven, thanks for coming on theCUBE. >> Thank you. >> So, you've been with Splunk for a while, we're here at conf18. Logging services, enterprise logging services. When you think of Splunk, their roots, Splunk go back to, sort of, log files, analyzing log files, it's in your title. (laughs) You must be pretty intimately tied to, as a practitioner, to this capability, but talk about your role and what you do at Cox. >> Primarily, the role is to be the evangelist, the enabler, and the center of excellence when it comes down to getting those best practices propergated within the enterprise. >> So people come to you for advice, council, you play, sort of, internal consultant. What qualified you to do that? You were a practitioner prior to this, so you got your hands dirty and you kind of now, elevated to-- >> My prior role was a Site Operations, or Site Reliability Engineer, and then Manager. And so, having that background, I've been in IT since '96, so I'm a little old in the game, but basically, having that operational knowledge, and knowing how to think big picture when things are happening or transpiring, or the reverse and go back and find that root cause analysis. >> '96, just a pup, my friend, okay? (both laugh) So, talking to Stu, we were talking off camera, about the number of brands that Cox Automotive has, Cox at Kelley Blue Book and at numerous others, like dozens, each of these is kind of it's own data silo. How do you guys go about using Splunk? Are you able to break down some of those silos? Maybe you could share that with us. >> Yeah, so we have been successful on a lot of the big three really, at Kelley Blue Book, Manheim, as well as Auto Trader, to really break in. A lot of that was because of our, already previous, relationships with team members and leaders. On the other side of the coin is the newly acquired companies that are not in Atlanta, Georgia. That are in places like Groton, Connecticut, South Jordan, Utah, Upstate New York, as well as the Toronto area in Canada. And so, WebEx joined me, email just won't cut it. You actually have to sit down with these people and really showcase your business case, your model, and what you're trying to bring to the table. But of course, the approach is always important. >> And are you using Splunk to do that? As a collaboration tool as well? >> Yes sir, yep. >> Explain that a little bit if you would. >> So, a lot of times, as you mentioned, the silos, as a bigger brand now, it's no longer an excuse for you to only be responsible for your data and not showcase it, or share that data. Because we're thinking about the entire life-cycle of Cox Automotive, and this entity of Cox Automotive, that's important to us now. So for you to hold tight, or to hoard your data, or your metrics and not share them, that's not good business anymore. >> Yeah, so Steven, we talked to a lot of companies that do M&A, and it's usually like, well, this is the products we use, these are the structures that we have. One of the things we hear from Splunk is that you can get to your data, your way. How does the Splunk modeling, and how you look at the data, fit into that M&A? Is that an enabler for you to be able to get that in. >> Yeah, and so, when you can showcase the ability of how the data comes in and, quickly. Key word, right? To showcase how that data can be very valuable to them, especially to their stakeholders, that's when light bolts will go off. And, again, it's the stakeholders, and then champions, that we need to bring to the table to make sure that we can get full adoption. >> Yeah, we've also-- Dave's been to the show a few times, it's my first time, and what I've really heard a bunch of is the people that know how to use Splunk, they're super valuable inside of the company. They get training, people inside the company, they look to get hired, tell us a little about what you've seen, what it means to your role inside the company, and as you network with your peers here. >> It's a lot of exposure. A lot of people are very anxious to get some type of insights into their world, their infrastructure, their applications, their business tools. A lot of times, there are people out there that are very savvy from a business perspective, that have a bunch of KPIs in their head, but no one has actually extracted that information from them, and so, our job is to align with their KPIs. You know, over the last couple of years, that's what we've-- the journey that we've been on, is to now revisit the data that we've just ingested. That's the basic foundation. We want to elevate now and really get more mature, and to align with those business KPIs. >> Meaning they got this tribal knowledge in their head, and you want to codify that so that it can be shared. >> Correct. >> How do you go about doing that? Is it sitting in a whiteboard and understanding that? >> It can be a whiteboard, it can be over a coffee. If I need to get on a plane and go see them in person, and to really just listen and ask the questions when it's time but, again, listen and really understand what's important to them, what is important to their business, to their function, to their silos? Cox Automotive has five, of what we call, pillars, where there's international, finance, marketing, retail, or media, and each one of those owners, over time, wants the specific value. >> So if you go and have a chalkboard session, whiteboard session, with one of these folks, how do you operationalize it? You got to figure out where the data exists, so that you can align with what's in their head? Is that right? And then, how do you do that? How do you scale it? >> Well, so, again, you have to start from the top. If you start from the bottom, you'll be in the weeds until the end of time. So that the more efficient manner is to start from the top and realize those KPIs from those leaders, those stakeholders, and then from there, a tool like ITSI, which is basically built around services, entities, and aligning to their service decomposition model, and that right there allows you to stay consistent and efficient on getting that information. >> So you start top down, but ultimately, people are going to want granularity. So you start-- is it top down, bottom up, type of approach? Where you actually drill, drill, drill, drill, drill, and then get to the point where you can answer all those granule questions? And then, by doing that, if I understand it correctly, it sums to the top line, is that fair? >> Yeah, yeah, there's a point in time where you say, you know what? I could really now enhance or enrichen the data by a dataset that I know where it is. So the keypal will get you to a certain point, and then, to find that happy medium, or that common denominator from the data that you already have on premise, or from your apps, wherever they reside, that's where you can meet the gap. >> Otherwise you're never get it done. You'll end up boiling the ocean. >> That's correct, yes sir. >> All right, so, when we talked to you two years ago, you were using Splunk Cloud, you know? And when we talked to practitioners it's-- the things that they're managing, a lot of times now, most of it's not what they own, and so, how do I get the right information? How do I manage that environment? Talk to us a little bit about what you've seen in the maturation of Splunk and Splunk Cloud, if there's anything in 7.2, or Splunk Next, that's exciting you, to help you do your job even better. >> Oh man, so of course, the keynote today, the DSP, the processing layer that's in front of the Cloud, or in front of the indexes now. Where in real time, I can now route data, specifically from a security standpoint. If there's some type of event, without having to go through all the restarts and configuration management and everything else, I can simply put something in there, right there, and move the data, or mask the data. The ability with the infrastructure app, that's exciting to me, as well as all the feature updates for ITSI, enterprise security, as well as the Cloud itself. >> Can we do a little Splunk 101 for my benefit? So I heard today, from one of the product folks, that it used to be when you added another indexer, you had to add storage and compute simultaneously, whether or not you needed the storage, you had to add it, or vise versa. So an indexer is what, is it, essentially, a Splunk node? >> No, it can be a, basically, a Linux host, that actually has the agent running as an indexer with the attached disk. >> Right, okay, and it used to be you had to buy that in chunks, kind of like HCI, right? And you couldn't scale storage independent of compute? >> That's correct. >> What that meant is you were paying for stuff that you might not need. >> Right. >> So, with 7.2, I guess it is, you can split those and you get more granule, or what does that mean for you? >> Well, being a, now four year customer of Splunk Cloud, and anytime we went to the next version of, or license, the next step up, currently we're on about six terabytes. When we go up to eight, that the entailed more indexes being added to the cluster, which meant more time for the replication of search factors to be met, which can take however long, and then, or if there's any kind of issue with the indexer, where one had to be pulled out and another one introduced. How long does that take? Now, with the decoupling of the compute from the storage, it's minutes, and so it's a fraction of the time. >> And if I understand, I understood it real well when it's an appliance, but it's the same architecture if it's done in the Cloud, is that correct? >> It's, essentially, actually, it's a new architecture in my mind, where now it's able to scale more, and then there's-- I'm not sure how much they talked about it, but there's a potential of the elasticity of it. And so, now, I don't have to be so fixed, I can, on certain times, expand the cluster, you know, for search performance, or bring it back down when it's not needed. >> Some of the promise of Cloud. >> Yes, sir, Splunk Cloud. >> So it's like the Billy Dean, the five tool star. You've got the cost, you've got availability, you got speed, you got flexibility, and you've got business value, ultimately, which is what's driving here. So, I take it, I'm inferring here, you'd expect to use this capability in the near future? >> Very much so. >> Great. What else is on your horizon? What are the cool stuff you're working on? And things you want to share with us? >> Well, in addition to our leveraging Splunk Cloud for four years, next year we plan to move away from our current sim tool, into enterprise security. So it's very exciting to hear that they're continually updating that product, and so our security team has been knocking on my door for the last six months to really get that started. So, once we get there, we'll start the migration efforts and get Splunk Cloud now, enabled with the enterprise security, to really empower our security team, and stay ahead of our threats. >> So, I've been around a long time, and, ever since I can remember being in this business, customers have wanted to consolidate the number of vendors with whom they work. But the allure of best of breed always sucks them in to, oh, lets try this, or you get shadow IT. It sounds like, with Splunk, you're approaching this as a platform that you can use for a variety of different use cases. >> That is correct. >> Now, whether or not you reduce the number of vendors is, maybe a separate conversation, but I guess the question I have is, how are you using Splunk in new ways? It sounds like its permutating a line of business, SecOps, etc, is that an accurate picture? If you could describe it. >> Yeah, so Splunk itself, the core is the platform for so many different other functions within the business. You have security, you have the development group, DevOps, where, from a CICD perspective, now they can measure the metrics or the latency in between, when they create a car, say in rally, all the way to the very end of the line, what are all those metrics that are there, that they can leverage to increase their productivity? Obviously, infrastructure. As we consolidate all of our data centers down, wouldn't it be nice to know if these specific low bouncers or switchers are still having traffic to verse them? And to actually get a depiction of the consolidation effort. From a virtualization standpoint, isn't it powerful to know how many devices E6 hosts are actually fully being utilized, and how many are actually vacant? And how much money can be saved if we were actually to turn down those specifics blades or hosts? Or VMs that aren't being leveraged, but they're sitting there, taking up valuable resources. >> I remember when Splunk, right around the time they went public, I remember two instances, maybe three. There was a MPP database company, there was a large three letter firm, and there was an open-source specialist, and I heard the same thing from each of them, was we have the Splunk killer, this was like, five, six years ago. It seems like this Splunk killer was Splunk. And it really never happened. Why is it? Why is Splunk so effective? You obviously see, you know, you're independent, you want to use the best thing for Cox Automotive. What is it about Splunk that sets them apart, puts them in the lead? >> The scale capabilities, having this type of environment with the conferences and the sales group and the support groups, very intentional about listening. Having workshops where they come on premise to help us out on our use cases, to really educate their users, because the more their users are elevated from a knowledge standpoint, the more they will then exercise the application. If they all stay basic, why would I need another component of Splunk? Why would I need enterprise security? Why would I need to expand my subscription into the Cloud? The more I can exercise it, the more I'll need. >> So this is kind of a give, get. They come in knowing that if they expose you to other best practices, you'll going to be more effective in the use of Splunk and you might apply it in to other parts of your business. >> My appetite will grow and my users appetite will grow. >> And these are freebies that they're doing? Services freebies, or are they paid for services? >> Oh yeah, they have no problem coming in, supplying the necessary ammunition, or food, to entice, to have folks come in, but it's powerful to have all the engineers in there to really show us how things work. 'Cause, again, it's a win, win. >> And you're a football fan, I understand? >> Oh, yes, sir. >> Chiefs are your team, right? >> That's correct. >> Were you a football player? >> For a little while, yes. Now I coach, so that's my-- >> And you coach, what? >> Little girls. >> Kiddie football, huh, awesome. Is that Pop Warner these days, still? >> I guess you call it that. >> Flag football or tackle? >> Tackle football >> Really? >> Yep. >> Eight years old? >> Yes, my son is eight and he's playing full back right now, I'm very excited, happy father. >> Is he a big boy, like his dad? >> He's going to be bigger, I think, than his father, yes, sir. (both laugh) >> That's awesome. Well, listen, thanks very much, Steven, for coming on theCUBE, it's really a pleasure meeting you. >> That's appreciated, thank you very much. All right, keep it right there everybody. Stu and I will be back with our next guest. We're live from Splunk .conf18, you're watching theCUBE.

live from Orlando Florida it's the cube covered conf 18 got to you by Splunk welcome back to our land Oh everybody I'm Dave Volante with my co-hosts two minima and you're watching the cube the leader in live tech coverage we're brought here by Splunk toises Splunk off 18 hashtag spunk conf 18 Susan st. Leger is here she's the president of worldwide field operations at Splunk Susan thanks for coming on the cube thanks so much for having me today so you're welcome so we've been reporting actually this is our seventh year we've been watching the evolution of Splunk going from sort of hardcore IT OPSEC ops now really evolving in doing some of the things that when everybody talked about big data back in the day and spunk really didn't they talked about doing all these things that actually they're using Splunk for now so it's really interesting to see that this has been a big tailwind for you guys but anyway big week for you guys how do you feel I feel incredible we had you know we've it announced more innovations today just today then we have probably in the last three years combined we have another big set of innovations to announce tomorrow and you know just as an indicator of that I think you heard Tim today our CTO say on stage we to date have 282 patents and we are one of the world leaders in terms of the number of patents that we have and we have 500 pending right so if you think about 282 since the inception of the company and 500 pending it's a pretty exciting time for spunk people talk about that flywheel we were talking stew and I were talking earlier about some of the financial metrics and you know you have a lot of a large deal seven-figure deals which which you guys pointed out on your call let's see that's the outcome of having happy customers it's not like you turn to engineer that you just serving customers and that's what what they do I talk about how Splunk next is really bringing you into new areas yeah so spike next is so exciting there's really three three major pillars if you will design principles to spunk next one is to help our customers access data wherever it lives another one is to get actionable outcomes from the data and the third one is to allow unleash the power spunk to more users so there really the three pillars and if you think about maybe how we got there we have all of these people within IT and security that are the experts on Splunk the swing ninjas ful and their being they see the power of spunk and how it can help all these other departments and so they're being pulled in to help those other departments and they're basically saying Splunk help us help our business partners make it easier to get there to help them unleash the power spunk for them so they don't necessarily need us for all of their needs and so that's really what's what next is all about it's about making it again access data easier actionable outcomes and then more users and so we're really excited about it so talk about those new users I mean obviously the ITA ops they're your peeps so are they sort of advocating to you into the line of business or are you probably being dragged into the line of business what's that dynamic like yeah it's definitely we're customer success first and we're listening to our customers and they're asking us to take them that should go there with them right there being pulled that they know that what we what we say with our customers what are what our deepest customers understand about us is everybody needs funk it's just not everyone knows it yet and I said they're teaching their business why they need it and so it's really a powerful thing and so we're partnering with them to say how do we help them create business applications more which you'll see tomorrow in our announcements to help their business users you know one of the things that strikes us if we were talking it was the DevOps gentleman when you look at the companies that are successful with so-called digital transformation they have data at the core and they have sort of I guess I don't want to say a single data model but it's not a data model of stovepipes and that's what he described and essentially if I understand the power of Splunk just in talking to some of your customers it's really that singular data model that everybody can collaborate on with get advice from each other across the organization so not this sort of stovepipe model it seems like a fundamental linchpin of digital transformation even though you guys haven't been using that overusing that term thank you sort of a sign of smug you didn't use the big data term when big data was all hot now you use it same thing with digital transformation you're a fundamental it would seem to me to a lot of companies digital transformation that's exactly if you think about we started nineteen security but the reason for that is they were the first ones to truly do digital transformation right those are just the two the two organizations that started but exactly the way that they did it now all the other business units are trying to do it and that same exact platform that same exact platform that we use there's no reason we can't use it for those other areas those other functions but but if we want to go there faster we have to make it easier to use spunk and that's what you're seeing with spunk next you know I look at my career the last couple of decades we've been talking about oh well there's going to we're gonna leverage data and there's go where we want to be predictive on the models but that the latest wave of kind of AI ml and deep learning what I heard what you're talking about and in the Splunk next maybe you could talk a little bit about why it's real now and why we're actually going to be able to do more with our data to be able to extract the value out of it and really enable businesses sure so I think machine learning is that is at the heart of it and you know we we actually do two things from a machine learning perspective number one is within each of our market groups so IT security IT operations we have data scientists that work to build models within our applications so we build our own models and then we're hugely transparent with our customers about what those models are so they can tweak them if they like but we pre build those so that they have them in each of those applications so that's number one and and that's part of the actionable outcomes right ml helps drive actionable outcomes so much faster the second aspect is the ML TK right which is we give the our customers in ml TK so they can you know build their own algorithms and leverage everything all of the models that are out there as well so I think that two-fold approach really helps us accelerate the insights that we give to our customers Susan how are you evolving your go-to-market model as you think about Splunk next and just think about more line of business interactions so what are you doing on the go-to-market side yeah so the go to market when you think about reaching all of those other verticals if you will right it's very much going to be about the ecosystem all right so it's it's going to be about the solution provider ecosystem about the ISV ecosystem about the big the si is both boutique and the global s is to help us really Drive Splunk into all the verticals and meet their needs and so that will be one of the big things that you see we will obviously still have our horizontal focus across IT and security but we are really understanding what are the use cases within financial services what are the use cases within healthcare that can be repeated thousands of times and if you saw some of the announcements today in particular the data stream processor which allows you to act on data in motion with millisecond response that now puts you as close to real-time as anything we've ever seen in the data landscape and that's going to open up just a series of use cases that nobody ever thought of using spoil for so I wonder what you're hearing from customers when they talk about how do they manage that that pace of change out there I really like I walked around the show floor stuff I've been hearing lots people talking about you know containers and we had one of the your customers talking about how kubernetes fits into what they're doing seems like it really is a sweet spot for spunk that you can deal with all of these different types of information and it makes it even more important for customers to come to you yeah as you heard from Doug today in our keynote our CEO and the keynote it is a messy world right and part of the message just because it's a digital explosion and it's not going to get any slower it's just going to continue to get faster and I know you met with some of our customers earlier today and if'n carnival if you think about the landscape of NIF right I mean their mission is to protect the arsenal of nuclear weapons for the country right to make them more efficient to make them safer and if you think about all of it they not only have traditional IT operations and security they have to worry about but they have this landscape of lasers and all these sensors everywhere and that and when you look at that that's the messy data landscape and I think that's where Splunk is so uniquely positioned because of our approach you can operate on data in motion or at rest and because there is no structuring upfront I would I want to come back to what you said about real-time because that you know I oh I've said this now for a couple years but never used to use the term when Big Data was at its the peak of what does a gardener call it the hype cycle you guys didn't use that term and and so when you think about the use cases and in the Big Data world you've been hearing about real time forever now you're talking about it enterprise data warehouse you know cheaper EDW is fraud detection better analytics for the line of business obviously security and IT ops these are some of the use cases that we used to hear about in Big Data you're doing like all these now and sort of your platform can be used in all of these sort of traditional Big Data use cases am i understanding that problem 100% understanding it properly you know Splunk has again really evolved and if you think about again some of the announcements today think about date of fabric search right rather than saying you have to put everything into one instance or everything into one place right we're saying we will let you operate across your entire landscape and do your searches at scale and you know spunk was already the fastest at searching across your global enterprise to start with and when we were two to three times faster than anybody who compete it with us and now we improve that today by fourteen hundred percent I don't I don't even know where like you just look at again it ties back to the innovations and what's being done in our developer community within our engineering and team in those traditional use cases that I talked about in big data it was it was kind of an open source mess really complex zookeeper is the big joke right and always you know hive and pig and you know HBase and blah blah blah and we're practitioners of a lot of that stuff that's it's very complex essentially you've got a platform that now can be used the same platform that you're using in your traditional base that you're bringing to the line of business correct okay right it's the same exact platform we are definitely putting the power of Splunk in in the users hand so by doing things like mobile use on mobile and AR today and again I wish I could talk about what's coming tomorrow but let's just say our business users are going to be pretty blown away by what they're going to see tomorrow in our announcements yeah so I mean I'm presuming these are these are modern it's modern software micro services API base so if I want to bring in those open source tool tools I can in fact what you'll actually see when you understand more about the architecture is we're actually leveraging a lot of open-source and what we do so you know capabilities a spark and flink and but what we're doing is we're masking the complex the complexity of those from the user so instead of you having to do your own spark environment your own flink environment and you know having to figure out Kafka on your own and how you subscribe to what we're giving you all that we're we're masking all that for you and giving you the power of leveraging those tools so this becomes increasingly important my opinion especially as you start bringing in things like AI and machine learning and deep learning because that's going to be adopted both within a platform like use as yours but outside as well so you have to be able to bring in innovations from others but at the same time to simplify it and reduce that complexity you've got to infuse AI into your own platform and that's exactly what you're doing it's exactly what we're doing it's in our platform it's in our applications and then we provide the toolkit the SDK if you will so users can take it to another level all right so you've got 16,000 customers today if I understand the vision of SPARC next you're looking to get an order of magnitude more customers that you of it as addressable market talk to us about the changes that need to happen in the field is it just you're hitting an inflection point you've got those you know evangelists out there and I you know I see the capes and the fezzes all over the show so how is your field get ready to reach that broader audience yeah I think that's a great question again once again it will I'll tell you what we're doing internally but it's also about the ecosystem right in order to go broader it has to be about this this Splunk ecosystem and on the technology side we're opening the aperture right it's micro services it's ap eyes it's cloud there's there's so much available for that ecosystem and then from a go-to-market perspective it's really about understanding where the use cases are that can be repeated thousands of times right that the the the big problems that each of those verticals are trying to solve as opposed to the one corner use case that you know you could you could solve for one customer and that was actually one of the things we found is when we did analysis we used to do case studies on Big Data number one use case that always came back was custom because nothing was repeatable and that's how we were seeing you know a little bit more industry specific issues I was at soft ignite last week and you know Microsoft is going deep on verticals to get specific as to you know for IOT and AI how they can get specific in those environments I agreed I think again one of the things that so unique about Splunk platform is because it is the same platform that's at the underlying aspect that serves all of those use cases we have the ability in my opinion to do it in a way that's far less custom than anybody else and so we've seen the ecosystem evolve as well again six seven years ago it was kind of a tiny technology ecosystem and last year in DC we saw it really starting to expand now you walk around here you see you know some big booths from some of the SI partners that's critical because that's global scale deep deep industry expertise but also board level relationships absolutely that's another part of the the go-to markets Splunk becomes more strategic this is a massive Tam expansion that where we are potentially that we're witnessing with Splunk how do you see those conversations changing are you personally involved in more of those boardroom discussions definitely personally involved in your spot on to say that that's what's happening and I think a perfect example is you talk to Carnival today right we didn't typically have a lot of CEOs at the Splunk conference right now we have CEOs coming to the spunk conference right because it is at that level of strategic to our customers and so when you think about Carnival and yes they're using it for the traditional IT ops and security use cases but they're also using it for their customer experience and who would ever think you know ten years ago or even five years ago of Splunk as a customer experience platform but really what's at the heart of customer experience it's data so speaking of the CEO of Carnival Arnold Donald it's kind of an interesting name and and so he he stood up in the States today talking about diversity doubling down on diversity as an african-american you know you frankly in our industry you don't see a lot of african-americans CEOs you don't see a ton of women CEOs you don't see the son of women with with president in their title so he he made a really kind of interesting statement where he said something to the effect of forty years ago when I started in the business I didn't work with a lot of people like me and I thought that was a very powerful statement and he also said essentially look at if we're diverse we're gonna beat you every time your thoughts as an executive and in tech and a woman in tech so first of all i 100% agree with him and i can actually go back to my start i was a computer scientist at NSA so i didn't see a lot of people who looked like me and so from that perspective I know exactly where he's coming from and I am I'll tell you at Splunk we have a huge investment in diversity and not because it's a checkbox but because we believe in exactly what he says it's a competitive edge when you get people who think differently because you came from a different background because you're a different ethnicity because you were educated differently whatever it is whether it's gender whether it's ethnicity whether it's just a different approach to thinking all differentiation puts a different lens and and that way you don't get stove you don't have stovepipe thinking and I what I love about our culture at spunk is that we we call it a high growth mindset and if you're not intellectually curious and you don't want to think beyond the boundaries then it's probably not a good fit for you and a big part of that is having a diverse environment we do a lot of spunk to drive that we actually posted our gender diversity statistics last year because we believe if you don't measure it you're never going to improve it and it was a big step right to say we want to publish it we want to hold herself accountable and we've done a really nice job of moving it a little over 1% in one year which for our population is pretty big but we're doing really unique things like we have all job descriptions are now analyzed there's actually a scientific analysis that can be done to make sure that the job description does not bias whether men are women whether men alone or whether it's you know gender neutral so that that's exciting obviously we have a big women in technology program and we have a high potential focus on our top women as well what's interesting about your story Susan and we spent a lot of time on the cube talking about diversity generally in women in tech specifically we support a lot of WI t and we always talk him frequently we're talking about women and engineering roles or computer science roles and how they they oftentimes even when they graduate with that degree they don't come into tech and what strikes me about your path is your technical and yet now you've become this business executive so and I would imagine that having that background that technical background only helped in terms of especially in this industry so there are paths beyond just the technical role one hundred percent it first of all it's a huge advantage I believe it's the core reason why I am where I am today because I have the technical aptitude and while I enjoyed the business side of it as much and I love the sales side and the marketing side and all of the above the truth of the matter is at my core I think it's that intellectual curiosity that came out of my technical background that kept me going and really made me very I took risks right and if you look at my career it's much more of a jungle gym than a ladder and the way you know I always give advice to young people who generally it's young women who ask but oh sometimes it's the young men as well which is like how did you get to where you are how do I plan that how do I get and the truth of the matter is you can't if you try and plan it it's probably not going to work out the exactly the way you plan and so my advice is to make sure that you every time you're going to make a move your ask yourself what am I going to learn Who am I going to learn from and what is it going to add to my experience that I can materially you know say is going to help me on a path to where I ultimately want to be but I think if you try and figure it out and plan a perfect ladder I also think that when you try and do a ladder you don't have what I call pivots which is looking at things from different lenses right so me having been on the engineering side on the sales side on the services side of things it gives me a different lens and understanding the entire experience of our customers as well as the internals of an organization and I think that people who pivot generally are people who are intellectually curious and have intellectual capacity to learn new things and that's what I look for when I hire people I love that you took a nonlinear progression to the path that you're in now and it's speaking of you know the the technical I think if you're in this business you better like tech or what are you doing in this business but the more you understand technology the more you can connect the dots between how technology is impacting business and then how it can be applied in new ways so well congratulations on your careers you got a long way to go and thanks so much for coming on the queue so much David I really appreciate it thank you okay keep it right - everybody stew and I'll be back with our next guest we're live from Splunk Don Capcom 18 you're watching the cube [Music]

>> Narrator: Live from Orlando, Florida, it's theCUBE covering .conf18. Brought to you by Splunk. >> Welcome back to Orlando, everybody, of course home of Disney World. I'm Dave Vellante with Stu Miniman. We're here covering Splunk's Conf18, #conf, sorry, #splunkconf18, I've been fumbling that all week, Stu. Maybe by day two I'll have it down. But this is theCUBE, the leader in live tech coverage. Phillip Adams is here, he's the CTO and lead architect for the National Ignition Facility. Thanks for coming on. >> Thanks for having me. >> Super-interesting off-camera conversation. You guys are basically responsible for keeping the country's nuclear arsenal functional and secure. Is that right? >> Phillip: And effective. >> And effective. So talk about your mission and your role. >> So the mission of the National Ignition Facility is to provide data to scientists of how matter behaves under high pressures and high temperatures. And so what we do is basically take 192 laser beams of the world's largest laser in a facility about the size of three football fields and run that through into a target the size of a B.B. that's filled with deuterium and tritium. And that implosion that we get, we have diagnostics around that facility that collect what's going on for that experiment and that data goes off to the scientists. >> Wow, okay. And what do they do with it? They model it? I mean that's real data, but then they use it to model real-world nuclear stores? >> Some time back if you actually look on Google Earth and you look over Nevada you'll see a lot of craters in the desert. And we aren't able to do underground nuclear testing anymore, so this replaces that. And it allows us to be able to capture, by having a small burning plasma in a lab you can either simulate what happens when you detonate a nuclear warhead, you can find out what happens, if you're an astrophysicist, understand what happens from the birth of a star to full supernova. You can understand what happens to materials as they get subjected to, you know, 100 million degrees. (laughs) >> Dave: For real? >> Phillip: For real. >> Well, so now some countries, North Korea in particular, up until recently were still doing underground testing. >> Correct. >> Are you able to, I don't know, in some way, shape or form, monitor that? Or maybe there's intelligence that you can't talk about, but do you learn from those? Or do you already know what's going on there because you've been through it decades ago? >> There are groups at the lab that know things about things but I'm not at liberty to talk about that. (laughs) >> Dave: (chuckles) I love that answer. >> Stu: Okay. >> Go ahead, Stu. >> Maybe you could talk a little bit about the importance of data. Your group's part of Lawrence Livermore Labs. I've loved geeking out in my career to talk to your team, really smart people, you know, some sizeable budgets and, you know, build, you know, supercomputers and the like. So, you know, how important is data and, you know, how's the role of data been changing the last few years? >> So, data's very critical to what we do. That whole facility is designed about getting data out. And there are two aspects of data for us. There's data that goes to the scientists and there's data about the facility itself. And it's just amazing the tremendous amount of information that we collect about the facility in trying to keep that facility running. And we have a whole just a line out the door and around the corner of scientists trying to get time on the laser. And so the last thing IT wants to be is the reason why they can't get their experiment off. Some of these experimentalists are waiting up to like three, four years to get their chance to run their experiment, which could be the basis of their scientific career that they're studying for that. And so, with a facility that large, 66 thousand control points, you can consider it 66 thousand IOT points, that's a lot of data. And it's amazing some days that it all works. So, you know, by being able to collect all that information into a central place we can figure out which devices are starting to misbehave, which need servicing and make sure that the environment is functional as well as reproducible for the next experiment. >> Yeah well you're a case-in-point. When you talk about 66 thousand devices, I can't have somebody going manually checking everything. Just the power of IOT, is there predictive things that let you know if something's going to break? How do you do things like break-fix? >> So we collect a lot of data about those end-point devices. We have been collecting them and looking at that data into Splunk and plotting that over time, all the way from, like, capacitors to motor movements and robot behavior that is going on in the facility. So you can then start getting trends for what average looks like and when things start deviating from norm and set a crew of technicians that'll go in there on our maintenance days to be able to replace components. >> Phillip what are you architecting? Is it the data model, kind of the ingest, the analyze, the dissemination, the infrastructure, the collaboration platform, all of the above? Maybe you could take us inside. >> I am the infrastructure architect, the lead infrastructure architect, so I have other architects that work with me, for database, network, sys admin, et cetera. >> Okay, and then so the data, presumably, informs what the infrastructure needs to looks like, right, i.e. where the data is, is it centralized, de-centralized, how much is it, et cetera. Is that a fair assertion? >> I would say the machine defines what the architecture needs to look like. The business processes change for that, you know, in terms of like, well how do you protect and secure a SCADA environment, for example. And then for the nuances of trying to keep a machine like that continually running and separated and segregated as need be. >> Is what? >> As need be. >> Yeah, what are the technical challenges of doing that? >> Definitely, you know, one challenge is that the Department of Energy never really shares data to the public. And for, you know, it's not like NASA where you take a picture and you say, here you go, right. And so when you get sensitive information it's a way of being able to dissect that out and say, okay well now we've got to use our community of folks that now want to come in remotely, take their data and go. So we want to make sure we do that in a secure manner and also that protects scientists that are working on a particular experiment from another scientist working on their experiment. You know, we want to be able to keep swim lanes, you know, very separated and segregated. Then you get into just, you know, all of these different components, IT, the general IT environment likes to age out things every five years. But our project is, you know, looking at things on a scale of 30 years. So, you know, the challenges we deal with on a regular basis for example are protocols getting decommissioned. And not all the time because, you know, the protocol change doesn't mean that you want to spend that money to redesign that IOT device anymore, especially when you might have a warehouse full of them and then back-up, yeah. >> So obviously you're trying to provide access to those who have the right to see it, like you say, swim lanes get data to the scientists. But you also have a lot of bad guys who would love to get their hands on that data. >> Phillip: That's right. >> So how do you use, I presume you use Splunk at least in part in a security context, is that right? >> Yeah, we have a pretty sharp cyber security team that's always looking at the perimeter and, you know, making sure that we're doing the right things because, you know, there are those of us that are builders and there are those that want to destroy that house of cards. So, you know, we're doing everything we can to make sure that we're keeping the nation's information safe and secure. >> So what's the culture like there? I mean, do you got to be like a PhD to work there? Do you have to have like 15 degrees, CS expert? I mean, what's it like? Is it a diverse environment? Describe it to us. >> It is a very diverse environment. You've got PhD's working with engineers, working with you know, IT people, working with software developers. I mean, it takes an army to making a machine like this work and, you know, it takes a rigid schedule, a lot of discipline but also, you know, I mean everybody's involved in making the mission happen. They believe in it strongly. You know, for myself I've been there 15 years. Some folks have been there working at the lab 35 years plus, so. >> All right, so you're a Splunk customer but what brings you to .conf? You know, what do you look to get out of this? Have you been to these before? >> Ah yes, you know, so at .conf, you know, I really enjoy the interactions with other folks that have similar issues and missions that we do. And learning what they have been doing in order to address those challenges. In addition staying very close with technology, figuring out how we can leverage the latest and greatest items in our environment is what's going to make us not only successful but a great payoff for the American taxpayer. >> So we heard from Doug Merritt this morning that data is messy and that what you want to be able to do is be able to organize the data when you need to. Is that how you guys are looking at this? Is your data messy? You know, this idea of schema on read. And what was life like, and you may or may not know this, kind of before Splunk and after Splunk? >> Before Splunk, you know, we spent a lot of time in traditional data warehousing. You know, we spent a lot of time trying to figure out what content we wanted to go after, ETL, and put that data sets into rows and tables, and that took a lot of time. If there was a change that needed to happen or data that wasn't on-boarded, you couldn't get the answer that you needed. And so it took a long time to actually deliver an answer about what's going on in the environment. And today, you know one of the things that resonated with me is that we are putting data in now, throwing it in, getting it into an index and, you know, almost at the speed of thought, then being able to say, okay, even though I didn't properly on-board that data item I can do that now, I can grab that, and now I can deliver the answer. >> Am I correct that, I mean we talk to a lot of practitioners, they'll tell you that when you go back a few years, their EDW they would say was like a snake swallowing a basketball. They were trying to get it to do things that it really just wasn't designed to do, so they would chase intel every time intel came up with a new chip, hey we need that because we're starved for horsepower. At the same time big data practitioners would tell you, we didn't throw out our EDW, you know, it has its uses. But it's the right tool for the right job, the horses for courses as they say. >> Phillip: Correct. >> Is that a fair assessment? >> That is exactly where we're in. We're in very much a hybrid mode to where we're doing both. One thing I wanted to bring up is that the message before was always that, you know, the log data was unstructured content. And I think, you know, Splunk turned that idea on its head and basically said there is structure in log data. There is no such thing as unstructured content. And because we're able to rise that information up from all these devices in our facility and take relational data and marry that together through like DB Connect for example, it really changed the game for us and really allowed us to gain a lot more information and insight from our systems. >> When they talked about the enhancements coming out in 7.2 they talked about scale, performance and manageability. You've got quite a bit of scale and, you know, I'm sure performance is pretty important. How's Splunk doing? What are you looking for them to enhance their environment down the road, maybe with some of the things they talked about in the Splunk Next that would make your job easier? >> One of the things I was really looking forward to that I see that the signs are there for is being able to roll off buckets into the cloud. So, you know, the concept of being able to use S3 is great, you know, great news for us. You know, another thing we'd like to be able to do is store longer-lived data sets in our environment in longer time series data sets. And also annotate a little bit more, so that, you know, a scientist that sees a certain feature in there can annotate what that feature meant, so that when you have to go through the process of actually doing a machine-learning, you know, algorithm or trying to train a data set you know what data set you're trying to look for or what that pattern looks like. >> Why the S3, because you need a simple object store, where the GET PUT kind of model and S3 is sort of a de facto standard, is that right? >> Pretty much, yeah, that and also, you know, if there was a path to, let's say, Glacier, so all the frozen buckets have a place to go. Because, again, you never know how deep, how long back you'll have to go for a data set to really start looking for a trend, and that would be key. >> So are you using Glacier? >> Phillip: Not very much right now. >> Yeah, okay. >> There are certain areas my counterparts are using AWS quite a bit. So Lawrence Livermore has a pretty big Splunk implementation out on AWS right now. >> Yeah, okay, cool. All right, well, Phillip thank you so much for coming on theCUBE and sharing your knowledge. And last thoughts on conf18, things you're learning, things you're excited about, anything you can talk about. >> (laughs) No, this is a great place to meet folks, to network, to also learn different techniques in order to do, you know, data analysis and, you know, it's been great to just be in this community. >> Dave: Great, well thanks again for coming on. I appreciate it. >> Thank you. >> All right, keep it right there, everybody. Stu and I will be right back with our next guest. We're in Orlando, day 1 of Splunk's conf18. You're watching theCUBE.