>> Live from Orlando, Florida, it's theCUBE. Covering .conf18, brought to you by Splunk. >> Welcome back to Orlando everybody, home of Disney World, and this week, home of theCUBE. I'm Dave Vellante and he's Stu Miniman. Steven Hatch is here, he's the manager of Enterprise Logging Services at Cox Automotive. Steven, thanks for coming on theCUBE. >> Thank you. >> So, you've been with Splunk for a while, we're here at conf18. Logging services, enterprise logging services. When you think of Splunk, their roots, Splunk go back to, sort of, log files, analyzing log files, it's in your title. (laughs) You must be pretty intimately tied to, as a practitioner, to this capability, but talk about your role and what you do at Cox. >> Primarily, the role is to be the evangelist, the enabler, and the center of excellence when it comes down to getting those best practices propergated within the enterprise. >> So people come to you for advice, council, you play, sort of, internal consultant. What qualified you to do that? You were a practitioner prior to this, so you got your hands dirty and you kind of now, elevated to-- >> My prior role was a Site Operations, or Site Reliability Engineer, and then Manager. And so, having that background, I've been in IT since '96, so I'm a little old in the game, but basically, having that operational knowledge, and knowing how to think big picture when things are happening or transpiring, or the reverse and go back and find that root cause analysis. >> '96, just a pup, my friend, okay? (both laugh) So, talking to Stu, we were talking off camera, about the number of brands that Cox Automotive has, Cox at Kelley Blue Book and at numerous others, like dozens, each of these is kind of it's own data silo. How do you guys go about using Splunk? Are you able to break down some of those silos? Maybe you could share that with us. >> Yeah, so we have been successful on a lot of the big three really, at Kelley Blue Book, Manheim, as well as Auto Trader, to really break in. A lot of that was because of our, already previous, relationships with team members and leaders. On the other side of the coin is the newly acquired companies that are not in Atlanta, Georgia. That are in places like Groton, Connecticut, South Jordan, Utah, Upstate New York, as well as the Toronto area in Canada. And so, WebEx joined me, email just won't cut it. You actually have to sit down with these people and really showcase your business case, your model, and what you're trying to bring to the table. But of course, the approach is always important. >> And are you using Splunk to do that? As a collaboration tool as well? >> Yes sir, yep. >> Explain that a little bit if you would. >> So, a lot of times, as you mentioned, the silos, as a bigger brand now, it's no longer an excuse for you to only be responsible for your data and not showcase it, or share that data. Because we're thinking about the entire life-cycle of Cox Automotive, and this entity of Cox Automotive, that's important to us now. So for you to hold tight, or to hoard your data, or your metrics and not share them, that's not good business anymore. >> Yeah, so Steven, we talked to a lot of companies that do M&A, and it's usually like, well, this is the products we use, these are the structures that we have. One of the things we hear from Splunk is that you can get to your data, your way. How does the Splunk modeling, and how you look at the data, fit into that M&A? Is that an enabler for you to be able to get that in. >> Yeah, and so, when you can showcase the ability of how the data comes in and, quickly. Key word, right? To showcase how that data can be very valuable to them, especially to their stakeholders, that's when light bolts will go off. And, again, it's the stakeholders, and then champions, that we need to bring to the table to make sure that we can get full adoption. >> Yeah, we've also-- Dave's been to the show a few times, it's my first time, and what I've really heard a bunch of is the people that know how to use Splunk, they're super valuable inside of the company. They get training, people inside the company, they look to get hired, tell us a little about what you've seen, what it means to your role inside the company, and as you network with your peers here. >> It's a lot of exposure. A lot of people are very anxious to get some type of insights into their world, their infrastructure, their applications, their business tools. A lot of times, there are people out there that are very savvy from a business perspective, that have a bunch of KPIs in their head, but no one has actually extracted that information from them, and so, our job is to align with their KPIs. You know, over the last couple of years, that's what we've-- the journey that we've been on, is to now revisit the data that we've just ingested. That's the basic foundation. We want to elevate now and really get more mature, and to align with those business KPIs. >> Meaning they got this tribal knowledge in their head, and you want to codify that so that it can be shared. >> Correct. >> How do you go about doing that? Is it sitting in a whiteboard and understanding that? >> It can be a whiteboard, it can be over a coffee. If I need to get on a plane and go see them in person, and to really just listen and ask the questions when it's time but, again, listen and really understand what's important to them, what is important to their business, to their function, to their silos? Cox Automotive has five, of what we call, pillars, where there's international, finance, marketing, retail, or media, and each one of those owners, over time, wants the specific value. >> So if you go and have a chalkboard session, whiteboard session, with one of these folks, how do you operationalize it? You got to figure out where the data exists, so that you can align with what's in their head? Is that right? And then, how do you do that? How do you scale it? >> Well, so, again, you have to start from the top. If you start from the bottom, you'll be in the weeds until the end of time. So that the more efficient manner is to start from the top and realize those KPIs from those leaders, those stakeholders, and then from there, a tool like ITSI, which is basically built around services, entities, and aligning to their service decomposition model, and that right there allows you to stay consistent and efficient on getting that information. >> So you start top down, but ultimately, people are going to want granularity. So you start-- is it top down, bottom up, type of approach? Where you actually drill, drill, drill, drill, drill, and then get to the point where you can answer all those granule questions? And then, by doing that, if I understand it correctly, it sums to the top line, is that fair? >> Yeah, yeah, there's a point in time where you say, you know what? I could really now enhance or enrichen the data by a dataset that I know where it is. So the keypal will get you to a certain point, and then, to find that happy medium, or that common denominator from the data that you already have on premise, or from your apps, wherever they reside, that's where you can meet the gap. >> Otherwise you're never get it done. You'll end up boiling the ocean. >> That's correct, yes sir. >> All right, so, when we talked to you two years ago, you were using Splunk Cloud, you know? And when we talked to practitioners it's-- the things that they're managing, a lot of times now, most of it's not what they own, and so, how do I get the right information? How do I manage that environment? Talk to us a little bit about what you've seen in the maturation of Splunk and Splunk Cloud, if there's anything in 7.2, or Splunk Next, that's exciting you, to help you do your job even better. >> Oh man, so of course, the keynote today, the DSP, the processing layer that's in front of the Cloud, or in front of the indexes now. Where in real time, I can now route data, specifically from a security standpoint. If there's some type of event, without having to go through all the restarts and configuration management and everything else, I can simply put something in there, right there, and move the data, or mask the data. The ability with the infrastructure app, that's exciting to me, as well as all the feature updates for ITSI, enterprise security, as well as the Cloud itself. >> Can we do a little Splunk 101 for my benefit? So I heard today, from one of the product folks, that it used to be when you added another indexer, you had to add storage and compute simultaneously, whether or not you needed the storage, you had to add it, or vise versa. So an indexer is what, is it, essentially, a Splunk node? >> No, it can be a, basically, a Linux host, that actually has the agent running as an indexer with the attached disk. >> Right, okay, and it used to be you had to buy that in chunks, kind of like HCI, right? And you couldn't scale storage independent of compute? >> That's correct. >> What that meant is you were paying for stuff that you might not need. >> Right. >> So, with 7.2, I guess it is, you can split those and you get more granule, or what does that mean for you? >> Well, being a, now four year customer of Splunk Cloud, and anytime we went to the next version of, or license, the next step up, currently we're on about six terabytes. When we go up to eight, that the entailed more indexes being added to the cluster, which meant more time for the replication of search factors to be met, which can take however long, and then, or if there's any kind of issue with the indexer, where one had to be pulled out and another one introduced. How long does that take? Now, with the decoupling of the compute from the storage, it's minutes, and so it's a fraction of the time. >> And if I understand, I understood it real well when it's an appliance, but it's the same architecture if it's done in the Cloud, is that correct? >> It's, essentially, actually, it's a new architecture in my mind, where now it's able to scale more, and then there's-- I'm not sure how much they talked about it, but there's a potential of the elasticity of it. And so, now, I don't have to be so fixed, I can, on certain times, expand the cluster, you know, for search performance, or bring it back down when it's not needed. >> Some of the promise of Cloud. >> Yes, sir, Splunk Cloud. >> So it's like the Billy Dean, the five tool star. You've got the cost, you've got availability, you got speed, you got flexibility, and you've got business value, ultimately, which is what's driving here. So, I take it, I'm inferring here, you'd expect to use this capability in the near future? >> Very much so. >> Great. What else is on your horizon? What are the cool stuff you're working on? And things you want to share with us? >> Well, in addition to our leveraging Splunk Cloud for four years, next year we plan to move away from our current sim tool, into enterprise security. So it's very exciting to hear that they're continually updating that product, and so our security team has been knocking on my door for the last six months to really get that started. So, once we get there, we'll start the migration efforts and get Splunk Cloud now, enabled with the enterprise security, to really empower our security team, and stay ahead of our threats. >> So, I've been around a long time, and, ever since I can remember being in this business, customers have wanted to consolidate the number of vendors with whom they work. But the allure of best of breed always sucks them in to, oh, lets try this, or you get shadow IT. It sounds like, with Splunk, you're approaching this as a platform that you can use for a variety of different use cases. >> That is correct. >> Now, whether or not you reduce the number of vendors is, maybe a separate conversation, but I guess the question I have is, how are you using Splunk in new ways? It sounds like its permutating a line of business, SecOps, etc, is that an accurate picture? If you could describe it. >> Yeah, so Splunk itself, the core is the platform for so many different other functions within the business. You have security, you have the development group, DevOps, where, from a CICD perspective, now they can measure the metrics or the latency in between, when they create a car, say in rally, all the way to the very end of the line, what are all those metrics that are there, that they can leverage to increase their productivity? Obviously, infrastructure. As we consolidate all of our data centers down, wouldn't it be nice to know if these specific low bouncers or switchers are still having traffic to verse them? And to actually get a depiction of the consolidation effort. From a virtualization standpoint, isn't it powerful to know how many devices E6 hosts are actually fully being utilized, and how many are actually vacant? And how much money can be saved if we were actually to turn down those specifics blades or hosts? Or VMs that aren't being leveraged, but they're sitting there, taking up valuable resources. >> I remember when Splunk, right around the time they went public, I remember two instances, maybe three. There was a MPP database company, there was a large three letter firm, and there was an open-source specialist, and I heard the same thing from each of them, was we have the Splunk killer, this was like, five, six years ago. It seems like this Splunk killer was Splunk. And it really never happened. Why is it? Why is Splunk so effective? You obviously see, you know, you're independent, you want to use the best thing for Cox Automotive. What is it about Splunk that sets them apart, puts them in the lead? >> The scale capabilities, having this type of environment with the conferences and the sales group and the support groups, very intentional about listening. Having workshops where they come on premise to help us out on our use cases, to really educate their users, because the more their users are elevated from a knowledge standpoint, the more they will then exercise the application. If they all stay basic, why would I need another component of Splunk? Why would I need enterprise security? Why would I need to expand my subscription into the Cloud? The more I can exercise it, the more I'll need. >> So this is kind of a give, get. They come in knowing that if they expose you to other best practices, you'll going to be more effective in the use of Splunk and you might apply it in to other parts of your business. >> My appetite will grow and my users appetite will grow. >> And these are freebies that they're doing? Services freebies, or are they paid for services? >> Oh yeah, they have no problem coming in, supplying the necessary ammunition, or food, to entice, to have folks come in, but it's powerful to have all the engineers in there to really show us how things work. 'Cause, again, it's a win, win. >> And you're a football fan, I understand? >> Oh, yes, sir. >> Chiefs are your team, right? >> That's correct. >> Were you a football player? >> For a little while, yes. Now I coach, so that's my-- >> And you coach, what? >> Little girls. >> Kiddie football, huh, awesome. Is that Pop Warner these days, still? >> I guess you call it that. >> Flag football or tackle? >> Tackle football >> Really? >> Yep. >> Eight years old? >> Yes, my son is eight and he's playing full back right now, I'm very excited, happy father. >> Is he a big boy, like his dad? >> He's going to be bigger, I think, than his father, yes, sir. (both laugh) >> That's awesome. Well, listen, thanks very much, Steven, for coming on theCUBE, it's really a pleasure meeting you. >> That's appreciated, thank you very much. All right, keep it right there everybody. Stu and I will be back with our next guest. We're live from Splunk .conf18, you're watching theCUBE.

you live from Orlando Florida it's the cube coverage conf 18 got to you by Splunk welcome back to comp 2018 this is the cube the leader in live tech coverage my name is Dave Volante I'm here with my co-host Stu minimun we're gonna start the day we're going to talk to some customers we love that John Morris here is the MIS program director at UConn the Huskies welcome to the cube good to see you and he's joined by Ryan O'Connor who's the senior advisory engineer at Splunk he's got the cool hat on gents welcome to the cube great to have you thank you thank you for having us so kind of a cool setting this morning is the Stu's first conf and I said you know when you see this it's kind of crazy we're all shaking our phones we had the horse race this morning we won so that was kind of orange yeah team are and team orange as well that's great you're on Team Orange so we're in the media section and the median guys were like sitting on their hands but Stu and I were getting into it good job nice and easy so Jon let's start with you start always left to start with the customer perspective maybe you describe your role and we'll get into it sure so as you mentioned I'm the director of our undergrad program Mis management information systems business technology we're in the school of business under the operations and information management department the acronym OPI M okay cool and gesture Ryan tell us about your role explain the Hat absolutely yeah so I'm a member of an honorary member of the Splunk trust now I recently joined Splunk about a month ago back in August and yeah and outside of my full-time job working at Splunk I'm also an adjunct professor at the University of Connecticut and so I helped John in teaching and you know that's that's kind of my role and where our worlds sort of meet so John we were to when I were talking about the sort of evolution of Splunk the company that was just you know okay log file analysis kind of on-prem perpetual license model and it's really evolved and its permanent permeating throughout you know many organizations but maybe you could take us through sort of the early days and it was UConn for a while what what was life like before Splunk what prompted you to start playing around with Splunk and where have you taken it what's your journey look like so about three years ago we started looking at it through kind of an educational lens started to think of how could we tie it into the curriculum we started talking to a lot of the recruiters and companies that many of our students go into saying what skillsets are you looking for and Splunk was definitely one of those so academia takes a while to change the curriculum make that pendulum swing so it was how can we get this into students hands as quickly as possible and also make it applicable so we developed this initiative in our department called OPI M innovate which was all based around bringing emerging technology skills to students outside of the general curriculum we built an innovation space a research lab and really focused in bringing students in classes and incorporating it that way we started kind of slowly different parts of some early classes about three years ago different data analytics predictive analytics courses and then that really built into we did a few workshops with our innovate initiative which Ryan taught and then from there it kind of exploded we started doing projects and our latest one was with the Splunk mobile team okay you guys had some hard news around now well today right yeah maybe take us through that absolutely wanted sure yeah I'll take that so we we teach a course on IOT industrial IOT at the University of Connecticut and so we heard about the mobile projects and you know the basically they were doing a beta of the mobile and application so we we partnered with them this summer and they came in you know we have a Splunk Enterprise license through Splunk for good so we're able to actually ingest Splunk data and so as part of that course we can ingest IOT data and use Splunk mobile to visualize it all right right right maybe you could explain to our audience that might not know spun for good absolutely yeah so spun for good is a great initiative they offer a Splunk pledge license they call it to higher education institutions and research initiatives so we're able to have a 10 gig license for free that we can you know run our own Splunk enterprise we can have students actually get hands-on experience with it and in addition to that they also get free training so they can take Splunk fundamentals one and two and actually come out of school with hands-on experience and certifications when they go into the job market that's John name you know we talk so much about them the important role of data and you know that the tools change a lot you know when we talk about kind of the next generation of jobs you're right at that intersection maybe you can give you know what what are what are the students what are they looking for what are the people that are looking for them hoping that they come out of school with you know yeah it's it's um you have two different types of students I would say those that know what they're looking for and those that don't that I really have the curiosity they want to learn and so we we try to build this initiative around both those that maybe they're afraid of the technology and the skills so how do we bring them in how do we make a very immersive environment kind of have that aha moment quickly so we have a series of services around that we have what's called tech kits the students come in they're able to do something applicable right away and it sparks an interest and then we also kind of developed another path for those that were more interested in doing projects or they had that higher level skill set but we also wanted to cultivate an environment where they could learn more so a lot of it is being able to scaffold the learning environment based off of the different student coming in so it's interesting my son's a junior in college at GW and he's very excited he's playing around with date he says I'm learning are I'm learning Tablo I'm like great what about Splunk and he said what's that yes so yeah then though it's a little off-center from some of the more traditional visualization tools for example so it's it's interesting and impressive that you guys sort of identified that need and actually brought it to two students how did that all how what was in an epiphany or was that demand from the students how'd that come about it was a combination of a lot of things you know we were lucky Ryan and I have known each other for a long time as the director of the program trying to figure out what classes we should bring in how to build out the curriculum and we have our core classes but then we have the liberty to build out special topics things that we think are irrelevant up-and-coming we can try it out once if it's good maybe teach it a few more times maybe it becomes a permanent class and that's kind of where we were able to pull Ryan in and he had been doing consulting for Splunk for a number of years I said I think you know this is our important skill set is it something that you could help bring to the students sure yeah yeah I mean one of the big courses we looked at was a data analytics course and we were already teaching with a separate piece of software not gonna name names but essentially I looked at it one for one like what key benefits does this piece of software have you know what are the students trying to get out of it and then just compared to one for one to Splunk like could Splunk actually give them the same learning components and all that and it could and and with this one for swum for a good license and all that stuff we could give them the hands-on experience and augment our teaching with that free training so and they come out of school they have something tangible they can say you know I have this and so that would kind of snowball once that course worked then we could integrate it into multiple other courses so you were able to essentially replicate the value to the students of the legacy software and but also have a modern platform exactly exactly yep yeah you know that and that was a what was like a Doug was talking about making jokes about MDM and codifying business processes and yeah it's a little bit more of an antiquated piece of software essentially you know and I mean it was nice it did a great job but there wasn't when we were talking to recruiters and stuff it wasn't a piece of software that recruiters were actually looking at so we said we were hearing Splunk over and over again so why not just bring it into the classroom and give them that so in the keynote this morning started to give a vision I believe they call it Splunk next and mobile things like augmented reality are fitting in you know how do you look at things like this what what how's the mobile going to impact you especially I would think yeah so when we kind of came up with our initiative we identified five tracks that both skill sets we believe the students needed and that and companies were kind of looking for a lot of that was our students would go into internships and say hey you know the the set skills that were learning you know they're asking us to do all this other work in AWS and drones and VR so as again it's part of this it was identifying let's start small five tracks so we started with 3d printing virtual reality microcontrollers IOT and then analytics kind of tying that all together so we had already been building an environment to try and incorporate that and when we kind of started working with the spunk mobile team there's all these different components we wanted to not only tie into the class but tied into the larger initiative so the goal of the class is not to just get these students the skills interesting interested in it but to spread that awareness the Augmented part is just kind of another feature was the next piece that we're looking in to build activities and it just had this great synergy of coming in at the right time saying hey look at this sensor that we built and now you can look at data in an AR it's a really powerful thing to most people so yeah they showed that screenshot of AR during the keynote and one of the challenges that we have at the farm so we're teaching that this is the latest course that we're talking about on an industrial IOT one of the challenges we have at that farm is we don't have a desk we don't have a laptop but we do have a phone in our pocket and we have we can put a QR code or NFC tag anywhere inside that facility so we can actually have we have students go around and you know they can put an iPhone upto a sensor or scan a QR code and see actual live real-time data of what those sensors are doing which is it's an invaluable tool inside the classroom and in an environment like that for sure so it's interesting able to do things we never would have been able to do before I want to ask you about come back to mobile yeah as you you just saying it was a something that people have wanted for a long time it took a while yeah presumably it's not trivial to take all this data and present it in a format and mobile that's simple number one and number two is a lot of spunky users are you know they're at the command center right and they're on the grid yep so maybe that worked to your advantage a little bit and that you know you look at how quickly mobile apps become obsolete hmm so is that why it took so long because it was so complicated and you had a user profile that was largely stationary yeah and how is that change yes honestly I'm not sure in the full history of the mobile app I know there previously was a new mobile app and I are there was an old mobile app and this new one though is you use it the new one yes oh so when we're talking about augmented reality that might be we may not been clear on that augmented reality is actually part of its features and then in addition we have the Apple TV app is in our lab we have a dashboard displayed on a monitor so not only can we teach this class and have students setting up sensors and all this but we can live display it for everyone to come in and look at all the time and we know that it's a secure connection to our back-end people walk into the lab and the first thing I see is this live dashboard Splunk data from the Apple TV based off of project we've been working on what's that well that's a live feed from a farm five miles off campus giving us all these data points and it's just a talking point people are like wow how did you do that and you know it kind of goes from there yeah and the farm managers are actively looking at it too so they can see when the doors are open and closed to the facility you know the temperature gets too high all these metrics are actually used by the you know that was the important part to actually solve a business problem for them you know we we built a proof of concept for the class so the students could see it then their students are kind of replicating another final project in the class class is still ongoing but where they have to build out a sensor for for plants to so it's kind of the same type of sensor kit but it's they're more stationary plant systems and then they have to figure out how to take that data put it into Splunk and make sense of it so there's all these different components and you get for the students get the glam factor you can put it in a fishbowl have the Apple TV up there exactly and that's I mean part of it when we when we started to think about in ishutin you know it was recruitment you know how do we get students beyond that fear of technology especially kind of coming into a business school but it really went well beyond that we aligned it with the launch of our analytics minor which was open to anyone so now we're getting students from outside the school a bit liberal arts students creating very diverse teams and even in the class itself we have engineers business psychology student history student that are all looking to understand data and platforms to be able to make decisions so there's essentially one Splunk class today instead of a Splunk 101 there this semester there's there's a couple classes that are actually using Splunk inside the classroom and I mean depends on the semester how many we have going on that are actually there's three the semester I sorry I misspoke there we have a another professor as well who's also utilizing it so so yeah we have three three classes that are essentially relying on Splunk to teach different components or you know is it helped us understand is it part of almost exclusively part of the analytics you know curriculum or is it sort of permeate into other Mis and computer science or right now it's within our kind of Mis purview trying to you know build all their partners within the university and the classes they're not it's not solely on spunk spunk is a component of you the tool so it's like for example the particular industrial IOT course it is understanding microcontrollers understanding aquaponics and sustainability understanding how to look at data clean data and then using Splunk as a tool to help bring that all together yeah it's kind of the backbone you know love it and then and I mean in addition to I just wanted to mention that we've had students already go out into the field which is great and come back and tell us hey we went out to a job and we mentioned that we knew Splunk and we were you know a shoo-in for certain things once it goes up on their LinkedIn profile and start getting yeah I mean I again I would think it's right up there with I mean even even more so I mean everybody says and right and our day it was SPSS now it's our yep tableau obviously for the VIS everybody's kind of playing around but spunk is a very you know specific capability that not everybody has except every IT department on the planet exactly coming out of school you take a little bit deeper you either you find you find that out yeah cool well great work guys really thank you guys coming on the cube it was great to meet you I appreciate it incoming all right you're welcome all right keep it right - everybody stew and I will be right back after this this is day one of cough 18 from Splunk this is the cube [Music]