>>Hello and welcome back to the cubes coverage of Splunk dot com virtual. I'm john Kerry host of the cube we are here in the Splunk studios in Silicon Valley where all the execs are here, it's basically a spunk studio. It's everyone's here telling the stories. We also got some remote guests coming in, customers partners and other Splunk execs. We've got Katie bianchi senior vice president of customer success. Welcome back to the cube. Thank great to see you. >>Thanks john Great to be here. >>Yeah, I love the customer success stories because at the end of the day customers vote with their wallet and when basically like solutions, they'll this customer examples and customer testimonials. There's one thing I've learned covering Splunk over the past decade and done in many dot coms. It's you guys have very happy customers and over the years have continuing to have great customer success organically now have to high end on the enterprise now with cloud scale lots changing, lots growing the world that's going completely cloud. Um, and again, data is at the center of the value proposition as it always was more important than ever. So what's new with the customers? What are some of the successful is that you're seeing what's new in your world? >>Yeah, Thanks for thanks for asking, john I think, You know, we've been talking about how things have been changing over the past 18 months. And if I over simplify our customer obsession means that everything we do is designed to make sure we're helping customers get the most out of their investment was flunk every single day. So we do this across our global team and our partner ecosystem who are providing both the right adoption and technical services and were architected and deploying thousands of Splunk environments to help our customers get to ongoing value. But in the world that we're living with today, I talked to so many customers who are doing amazing things with Splunk but dealing with really tough challenges right? So through the pandemic, everyone is dealing with more complexity, more change in the velocity that we have never seen before. And on top of all this, shifting to a fully digital business model, there's whole new challenges to effectively monitoring infrastructure and applications and maintaining security posture with this to customers that I'm talking to are also having to figure out ways to do a lot more with less. I think we all know it's an incredibly competitive talent market out there. So our customers are relying on Splunk and customer success more and more to make it easier and faster to get to value, to investigate, to monitor, to detect and to remediate. So that pace and all that change of what's happening means that we have to continually check ourselves to be that right strategic partners that can move at the pace of our customers because customers are counting on us to provide right services at the right time for every stage of their journey with us. >>Great point, great insight there. I want to ask you because Splunk has always had this kind of in their D. N. A. Because when Splunk started was always something new and it wasn't a new thing. That new thing never seen before. Now as the world can you guys continue to do that? You bring something new to the market, you operationalize, you bring value to customers then it happens again and again and again. But now more than ever the data rolls of cloud and and customer applications is new for customers. So you have a diverse customer base. I know you're obsessed with customer service but how do you how do you have a customer success? How do you deal with the fact that sometimes things are so new and there may or may not be a benchmark there and you can't go with the proven former. Sometimes you can sometimes you can't how do you solve? It's new to me problem that customers want this new thing. >>Yeah, I think you know a lot of what we see today is that the power as long as a data platform to bring in complex data allows customers to do many different things. Whether it's infrastructure monitoring, whether it's security, use cases or whether its application performance monitoring and all of that is new for our customers. So oftentimes like you said we grew up having customers use us for single use case when we're bringing this much data into the platform and they see what can be unlocked through the value of Splunk, what we have to make sure that they can do is most seamlessly move from use case and value point. So that means from a C. S. Perspective we have to continually make sure that we're doing what customers are asking us to do which is having the right services that deliver the right outcomes that are as prescriptive as possible and that we're doing that across the domain of all of our empire portfolio. So we spend a lot of time making sure that our technical services are scaling to the needs of customers but also everything that we do around success planning and adoption and use case guidance and best practices as well as our education and enablement are as prescriptive as possible for customers whether they are new to Splunk or whether they are scaling Splunk across multiple use cases and multiple areas of their business. >>Certainly a lot of not of multi vendor, multi vendor activities. Modern application development, security is a big part of it. So I have to ask you given all that, what are the top things, top three things for instance that your customers are asking from you guys from C. S perspective customer success >>perspective great question. So I think over, I think what we hear the most frequently is give me a more seamless buying experience with services that are really easy to consume and speed my time to value second and I just mentioned this is I need services that aren't task, just task based to work. I need services that deliver the outcome that I need for the business problem or business opportunity that I am trying to solve for. So make sure that your portfolio lines up with our outcomes And I think 3rd is all about more prescriptive guidance. The world is hard, the world is complex, data is only getting more complex while the opportunity is big, our role is all about prescription and making it as easy as possible. >>So I have to ask you the question that I'm observing, many people are in the industry as well is that Splunk is changing as a company. Um everyone knows the vibe of Splunk is very cool, very chill, very organic, big community vibe, good customer success, everything's going great. You continue to knock it out of the park over the years, but now you're mature company now, Scale is coming in, your customers are getting bigger and bigger. You have existing customers getting new customers, you have new offerings. There's a whole another Splunk coming another level. >>Yeah. How do you, how >>do you view that from a custom respect and you can, you share your reaction to that? >>Yeah, I, you know, I think it's an honor to be part of a company that has such a strong culture and has such great partnership with our customers and it really is all because of who our customers are and I think who are people are internally. But I think growing and scaling and making sure that we are able to deliver the right services at scale is a critical component of what we have to do to help customers along this journey. So the role of you keep saying this, but the role of customer success is to make the complex easy and we do that by making sure that we as an organization have the right data, the right prescription, the right way to serve our customers and the right coverage model no matter where customers are on the journey or who they are and getting and getting the most prescription to them at the right time. And that's that's quite frankly how we scale. But also what our customers asked for. They're asking for more module arised content and they're asking us for more ways that they can drive best practices and use case guidance from right within the product. And those are things that we are working on to help continue to scale out what we're able to do. >>That's a great point. Taking the complexity, make it simple and enable them to be successful. I think data does that you guys are offering that platform which is a great business model by the way, if you can provide those kind of value that's always a winning formula, Make things easy, reduce the steps it takes to do things and make it fast and simple. Uh I have to ask because you mentioned earlier, the top of this interview about digital business, we're here Splunk canceled the conference now is virtual. Were coming in remotely here on site at the studio. They they have a virtual student there now in the media business, which is a data business. You know, you guys are now doing tv with CUBA's here. Um everyone is realizing the pandemic. That digital business now is standard. You're seeing the impact of the instrumentation you mentioned. So as the digital business transformation is accelerated here and this time, not for everybody, it's going to change how customers are behaving. What have you what have you observed at the pandemic? Because it's kind of panel has cleared the runway a little bit for people to to do this properly because you can see what's not working. So what's your thoughts on this whole digital business? Everyone's connected and data is at the center of it. What's your thoughts? >>Yeah, absolutely. I I look, I think, you know what we have seen over the last 12-18 months with this acceleration to a digital business model, is that things and the other dynamics going on or that things are only getting more complex. Right? So strong customers can come to Splunk cloud because we know it reduces complete with complexity in their moves because we are that data platform that allows them to search, investigate and monitor across cloud across multi cloud and across hybrid environments but that's complex. Over the last year we've seen customers get too much quicker value um, in in Splunk cloud right there going through large complex transformation. One of the easiest things you can do is shed the amount of time and money you're spending, managing, monitoring your infrastructure. So coming to Splunk cloud helps accelerate time to value for them in that way. But let's make no mistake, that is really complex. And so part of what we are doing is ramping up our level of focus on those modernization services for customers. So customers who are choosing to come to Splunk cloud for those benefits. We are there from planning and cut over and beyond with more prescriptive tools, more automation and how we move data, more resources and more experts to get customers to Splunk cloud more seamlessly. And that for us from a modernization perspective is one thing that we are hearing clearly customers asking asking for specific in the space so they can take more advantage and move more quickly. >>One of the trends that we're reporting on and I'll get to the headline in silicon angle in a minute, what's reporting on this event is there's more, more surface area, there's more data, there's more tools and tools are important for helping people automate but at the same time if you have more tools you have more blind spots or silos. So when you get into this world of architecture, customers are struggling that we talked to around trying to find the ideal equation of okay balancing architecture platform and tools that's equilibrium if you will by getting access to the data. What's your reaction to that? Because this becomes one of those decisions. I think Splunk shines where you can kind of have the best of a platform at the same time use tooling where relevant to accelerate whether it's automation or other other jobs versus buying tools for everything. >>Yeah and I and so I think part of the part of the thing that we continue to see is with the proliferation of data and data sources and a different degree of complexity in tooling the decisions around what's important and what's not important become much more much more complex for customers and much more difficult for customers to make. So we're changing a lot on the product and pricing side to sort of facilitate that piece. But I think when you're talking about how do I get the most value immediately, what we do across our go to market organization is make sure that we're partnering with customers to say what are the outcomes that you want from you want a need as a priority from a monument infrastructure monitoring for an application performance security perspective and then how do we make sure that we're prioritizing your maturity journey very prescriptively to say here the use cases that are most material here are the data sources that are most material and here's a success plan that helps you get deployed to your priorities so you can start the journey with us and build on that as we go. So again, it's really about how do we make the complex really easy through higher degrees of prescription but really making sure that we're doing our job and tying the prescription to what our customers need most when they need it. >>That's a great segment of my next question. In fact, my final question because because you know the headline on silicon angle dot com that we're reporting for this event is I'll read it to you. Splunk doubles downs on multi cloud data access, observe ability and security at its annual summit. Okay, so balancing the shiny new toy in the North Star Direction vision to practical prescriptive customer journeys is always a balance because you want to talk to customers about the future. Multi cloud, obviously observe ability super important. And honestly if security gonna be built in, okay, we all know that back to the mainstream customer, you're in the customer success. So you want to show them the North Star, show them the headroom, whatever metaphor you want to use at the same time they're dealing with problems and things that they're trying to solve right now. What's your what's your thoughts on on customer success knowing that there's a lot of cool new things coming. >>Yeah, I think our job like I excited, I'll start and in the same sort of started in the same way. Um our job at the end of the day is to help customers get the most out of their current investment was blank and that does and that is all about working on what that maturity journey looks like, prioritizing outcomes that our customers care about and starting and starting that journey. So there's foundational work that needs to be done aligned to priorities. That's where we start and then if we're doing what we need to be doing, creating those prescriptive plans and those success plans, then all of how we deliver to that value is prioritized through what customers need the most when they need it and that is our role and then we believe that by doing that and moving as quickly as we can with customers to get to that value, then we're enabling them to continue on that journey for all the new stuff that's out there that they can explore and get more value from. >>Its always good to have that North star and that china new toy, new technology. So, I have to ask your final final question because I have you here, what have you learned during the pandemic that you could share with other practitioners that are watching or maybe watching this as they look at the best practice because we've seen a lot of evidence where some people have fallen to the side or failed. Didn't weren't prepared. People who were in the cloud experimenting got that tailwind and survived and thrived somewhere re factoring new business were emerging. So you kind of see a pattern, is there anything that you've noticed on your end um that you can share with, you know how to lean into something new? So you don't be left out in the cold if uh the wave comes, a new trend comes that they need to take advantage of like date at the edge or cloud scale. What are some of the things you've you've observed and learned? >>Yeah, that's a great question. So I think, you know, I think for me, my personal learning through the pandemic has been like, we always need to be looking around corners and planning specifically to for our customers and thinking for them in terms of what problems that they will have and we have to anticipate that so that we can pivot and create the right services that help them leverage to do what they need. So very early on. Um even very early on in the pandemic, our professional services team flipped within a two week period doing fully remote and virtual deployments because we knew we couldn't stop time to value given the shift to remote work, our customers were relying on us to deploy so that they could monitor infrastructure um and monitor work from home usage. And I think along with that as we started to see in through the back half digital transformations really pick up and customers move to cloud. We've been working across across the last really 12 to 15 months to really start to plan around what does it take to create the right services and the right capability, not just within Splunk but within our partner ecosystem to effectively move customers to Splunk cloud and help them navigate uh hybrid, multi cloud world with much more speed. And so for me, those are the two things that we really leaned into hard because we were always looking around corners and saying what's next for our customers based on what we're seeing happened in the external environment. >>Great insight, Katie, thank you for coming on the cube. That's awesome. And I think, you know, customers are seeing success formulas and the new ones are emerging and you guys are going the next level is always fun to talk about the future and today at the same time so great to have you on. And certainly at the end of the day the customers, the ones who are deploying and create the innovation with software and data. So thanks for sharing. >>Yeah. Thanks john um really, really happy to spend the time. There's nothing I like to do more than talk about our customers and to all of our customers, huge thank you to you for your partnership and all you're doing to continue to power the world with data. >>It's always good to have a lot of customers to tell the story for you, but I appreciate you. Coming on, congratulations on your success. It's the cube we are here live in the studio of Splunk Studios for their virtual event uh with the remote interview. We're talking all the people in the, in the industry. We can, we're bringing it in. We're going, we're doing the interviews here in person as well as a hybrid event. I'm john for the cube. Thanks for watching. Mm >>mm. Mhm.

>> Announcer: Live from Las Vegas, it's theCUBE! Covering Splunk .conf19. Brought to you by Splunk. Okay, welcome back, everyone. This is day three live CUBE coverage here in Las Vegas for Splunk's .conf. Its 10 years anniversary of their big customer event. I'm John Furrier, theCUBE. This is our seventh year covering, riding the wave with Splunk. From scrappy startup, to going public company, massive growth, now a market leader continuing to innovate. We're here with the CEO, Doug Merritt of Splunk. Thanks for joining me, good to see you. >> Thank you for being here, thanks for having me. >> John: How ya feelin'? (laughs) >> Exhausted and energized simultaneously. (laughs) it was a fun week. >> You know, every year when we have the event we discuss Splunk's success and the loyalty of the customer base, the innovation, you guys are providing the value, you got a lot of happy customers, and you got a great ecosystem and partner network growing. You're now growing even further, every year it just gets better. This year has been a lot of big highlights, new branding, so you got that next level thing goin' on, new platform, tweaks, bringing this cohesive thing. What's your highlights this year? I mean, what's the big, there's so much goin' on, what's your highlights? >> So where you started is always my highlight of the show, is being able to spend time with customers. I have never been at a company where I feel so fortunate to have the passion and the dedication and the enthusiasm and the gratitude of customers as we have here. And so that, I tell everyone at Splunk this is similar to a holiday function for a kid for me where the energy keeps me going all year long, so that always is number one, and then around the customers, what we've been doing with the technology architecture, the platform, and the depth and breadth of what we've been working on honestly for four plus years. It really, I think, has come together in a unique way at this show. >> Last year you had a lot of announcements that were intentional announcements, it's coming. They're coming now, they're here, they're shipping. >> They're here, they're here. >> What is some of the feedback you're hearing because a lot of it has a theme where, you know, we kind of pointed this out a couple of years ago, it's like a security show now, but it's not a security show, but there's a lot of security in there. What are some of the key things that have come out of the oven that people should know about that are being delivered here? >> So the core of what we're trying to communicate with Data-to-Everything is that you need a very multifaceted data platform to be able to handle the huge variety of data that we're all dealing with, and Splunk has been known and been very successful at being able to index data, messy, non-structured data, and make sense of it even though it's not structured in the index, and that's been, still is incredibly valuable. But we started almost four years ago on a journey of adding in stream processing before the data gets anywhere, to our index or anywhere else, it's moving all around the world, how do you actually find that data and then begin to take advantage of it in-flight? And we announced that the beta of Data Stream Processor last year, but it went production this year, four years of development, a ton of patents, a 40 plus person, 50 plus person, development team behind that, a lot of hard engineering, and really elegant interface to get that there. And then on the other end, to complement the index, data is landing all over the place, not just in our index, and we're very aware that different structures exist for different needs. A data warehouse has different properties than a relational database which has different properties than a NoSQL column store in-memory database, and data is going to only continue to be more dispersed. So again, four plus years ago we started on what now is Data Fabric Search which we pre-announced in beta format last year. That went production at this show, but the ability to address a distributed Splunk landscape, but more importantly we demoed the integration with HTFS and S3 landscapes as the proof point of we've built a connector framework, so that this really cannot just be a incredibly high-speed, high-cardinality search processing engine, but it really is a federated search engine as well. So now we can operate on data in the stream when it's in motion. We obviously still have all the great properties of the Splunk index, and I was really excited about Splunk 8.0 and all the features in that, and we can go get data wherever it lives across a distributed Splunk environment, but increasingly across the more and more distributed data environment. >> So this is a data platform. This is absolutely a data platform, so that's very clear. So the success of platforms, in the enterprise at least, not just small and medium-sized businesses, you can have a tool and kind of look like a platform, there's some apps out there that I would point to and say, "Hey, that looks like a tool, it's really not a platform." You guys are a platform. But the success of a platform are two things, ecosystem and apps, because if you're in a platform that's enabling value, you got to have those. Talk about how you see the ecosystem success and the app success. Is that happening in your view? >> It is happening. We have over 2,000 apps on our Splunkbase framework which is where any of our customers can go and download the application to help draw value of a Palo Alto firewall, or ensure integration with a ServiceNow trouble ticketing system, and thousands of other examples that exist. And that has grown from less than 300 apps, when I first got here six years ago, to over 2,000 today. But that is still the earliest inning, for earliest pitch and your earliest inning journey. Why are there 20,000, 200,000, two million apps out there? A piece of it is we have had to up the game on how you interface with the platform, and for us that means through a stable set of services, well-mannered, well-articulated, consistently maintained services, and that's been a huge push with the core Splunk index, but it's also a big amount of work that we've been doing on everything from the separation between Phantom runbooks and playbooks with the underlying orchestration automation, it's a key component of our Stream Processor, you know, what transformations are you doing, what enrichments are you doing? That has to live separate than the underlying technology, the Kafka transport mechanism, or Kinesis, or whatever happens in the future. So that investment to make sure we got a effective and stable set of services has been key, but then you complement that with the amazing set of partners that are out here, and making sure they're educated and enabled on how to take advantage of the platform, and then feather in things like the Splunk Ventures announcement, the Innovation Fund and Social Impact Fund, to further double down on, hey, we are here to help in every way. We're going to help with enablement, we're going to help with sell-through and marketing, and we'll help with investment. >> Yeah, I think this is smart, and I think one of the things I'll point out is that feedback we heard from customers in conversations we had here on theCUBE and the hallway is, there's a lot of great feedback on the automation, the machine learning toolkit, which is a good tell sign of the engagement level of how they're dealing with data, and this kind of speaks to data as a value... The value creation from data seems to be the theme. It's not just data for data's sake, I mean, managing data is all hard stuff, but value from the data. You mentioned the Ventures, you got a lot of tech for good stuff goin' on. You're investing in companies where they're standing up data-driven companies to solve world problems, you got other things, so you guys are adjusting. In the middle innings of the data game, platform update, business model changes. Talk about some of the consumption changes, now you got Splunk Cloud, what's goin' on on (laughs) how you charge, how are customers consuming, what moves did you guys make there and what's the result? >> Yeah, it's a great intro on data is awesome, but we all have data to get to decisions first and actions second. Without an action there is no point in gathering data, and so many companies have been working their tails off to digitize their landscapes. Why, well you want a more flexible landscape, but why the flexibility? Because there's so much data being generated that if you can get effective decisions and then actions, that landscape can adapt very, very rapidly, which goes back to machine learning and eventual AI-type opportunities. So that is absolutely, squarely where we've been focused, is translating that data into value and into actual outcomes, which is why our orchestration automation piece was so important. One of the gating factors that we felt has existed is for the Splunk index, and it's only for the Splunk index, the pricing mechanism has been data volume, and that's a little bit contrary to the promise, which is you don't know where the value is going to be within data, and whether it's a gigabyte or whether it's a petabyte, why shouldn't you be able to put whatever data you want in to experiment? And so we came out with some updates in pricing a month and change ago that we were reiterating at the show and will continue to drive on a, hopefully, very aggressive and clear marketing and communications framework, that for people that have adjusted to the data volume metric, we're trying to make that much simpler. There's now a limited set of bands, or tiers, from 100 gigs to unlimited, so that you really get visibility on, all right, I think that I want to play with five terabytes, I know what that band looks like and it's very liberal. So that if you wind up with six and a half terabytes you won't be penalized, and then there's a complimentary metric which I think is ultimately going to be the more long-lived metric for our infrastructurally-bound products, which is virtual CPU or virtual core. And when I think about our index, stream processing, federated search, the execution of automation, all those are basically a factor of how much infrastructure you're going to throw at the problem, whether it's CPU or whether it's storage or network. So I can see a day when Splunk Enterprise and the index, and everything else at that lower level, or at that infrastructure layer, are all just a series of virtual CPUs or virtual cores. But I think both, we're offering choice, we really are customer-centric, and whether you want a more liberal data volume or whether you want to switch to an infrastructure, we're there and our job is to help you understand the value translation on both of those because all that matters is turning it into action and into doing. >> It's interesting, in the news yesterday quantum supremacy was announced. Google claims it, IBM's debating it, but quantum computing just points to the trend that more compute's coming. So this is going to be a good thing for data. You mentioned the pricing thing, this brings up a topic we've been hearing all week on theCUBE is, diverse data's actually great for machine learning, great for AI. So bringing in diverse data gives you more aperture into data, and that actually helps. With the diversity comes confusion and this is where the pricing seems to hit. You're trying to create, if I get this right, pricing that matches the needs of the diverse use of data. Is that kind of how you guys are thinkin' about it? >> Meets the needs of diverse data, and also provides a lot of clarity for people on when you get to a certain threshold that we stop charging you altogether, right? Once you get above 10s of terabytes to 100 terabytes, just put as much data in as you want. The foundation of Splunk, going back to the first data, is we're the only technology that still exists on the index side that takes raw, non-formatted data, doesn't force you to cleanse or scrub it in any way, and then takes all that raw data and actually provides value through the way that we interact with the data with our query language. And that design architecture, I've said it for five, six years now, is completely unique in the industry. Everybody else thinks that you've got to get to the data you want to operate on, and then put it somewhere, and the way that life works is much more organic and emergent. You've got chaos happening, and then how do you find patterns and value out of that chaos? Well, that chaos winds up being pretty voluminous. So how do we help more organizations? Some of the leading organizations are at five to 10 petabytes of data per day going through the index. How do we help everybody get there? 'Cause you don't know the nugget across that petabyte or 10 petabyte set is going to be the key to solving a critical issue, so let's make it easy for you to put that data in to find those nuggets, but then once you know what the pattern is, now you're in a different world, now you're in the structured data world of metrics, or KPIs, or events, or multidimensional data that is much more curated, and by nature that's going to be more fine-grained. There's not as much volume there as there is in the raw data. >> Doug, I notice also at the event here there's a focus on verticals. Can you comment on the strategy there, is that by design? Is there a vertical focus? >> It's definitely by design. >> Share some insight into that. >> So we launched with an IT operations focus, we wound up progressing over the years to a security operations focus, and then our doubling down with Omnition, SignalFx, VictorOps, and now Streamlio is a new acquisition on the DevOps and next gen app dev buying centers. As a company and how we go to market and what we are doing with our own solutions, we stay incredibly focused on those three very technical buying centers, but we've also seen that data is data. So the data you're bringing in to solve a security problem can be used to solve a manufacturing problem, or a logistics and supply chain problem, or a customer sentiment analysis problem, and so how do you make use of that data across those different buying centers? We've set up a verticals group to seed, continue to seed, the opportunity within those different verticals. >> And that's compatible with the horizontally scalable Splunk platform. That's kind of why that exists, right? >> That the overall platform that was in every keynote, starting with mine, is completely agnostic and horizontal. The solutions on top, the security operations, ITOps, and DevOps, are very specific to those users but they're using the horizontal platform, and then you wind up walking into the Accenture booth and seeing how they've taken similar data that the SecOps teams gathered to actually provide insight on effective rail transport for DB cargo, or effective cell tower triangulation and capacity for a major Australian cell company, or effective manufacturing and logistics supply chain optimization for a manufacturer and all their different retail distribution centers. >> Awesome, you know, I know you've talked with Jeff Frick in the past, and Stu Miniman and Dave Vellante about user experience, I know that's something that's near and dear to your heart. You guys, it has been rumored, there's going to be some user experience work done on the onboarding for your Splunk Cloud and making it easier to get in to this new Splunk platform. What can we expect on the user experience side? (laughs) >> So, for any of you out there that want to try, we've got Splunk Investigate, that's one of the first applications on top of the fully decomposed, services layered, stateless Splunk Cloud. Mission Control actually is a complementary other, those are the first two apps on top of that new framework. And the UI and experience that is in Splunk Investigate I think is a good example of both the ease of coming to and using the product. There's a very liberal amount of data you get for free just to experiment with Splunk Investigate, but then the onboarding experience of data is I think very elegant. The UI is, I love the UI, it's a Jupyter-style workbook-type interface, but if you think about what do investigators need, investigators need both some bread crumbs on where to start and how to end, but then they also need the ability to bring in anybody that's necessary so that you can actually swarm and attack a problem very efficiently. And so when you go back and look at, why did we buy VictorOps? Well, it wasn't because we think that the IT alerting space is a massive space we're going to own, it's because collaboration is incredibly important to swarm incidents of any type, whether they're security incidents or manufacturing incidents. So the facilities at VictorOps gave, on allowing distributed teams and virtual teams to very quickly get to resolution. You're going to find those baked into all products like Mission Control 'cause it's one of the key facilities of, that Tim talked about in his keynote, of indulgent design, mobility, high collaboration, 'cause luckily people still matter, and while ML is helping all of us be more productive it isn't taking away the need for us, but how do you get us to cooperate effectively? And so our cloud-based apps, I encourage any of you out there, go try Splunk Investigate, it's a beautiful product and I think you'll be blown away by it. >> Great success on the product side, and then great success on the customer side, you got great, loyal customers. But I got to ask you about the next level Splunk. As you look at this event, what jumps out at me is the cohesiveness of the story around the platform and the apps, ecosystem's great, but the new branding, Data-to-Everything. It's not product-specific 'cause you have product leadership. This is a whole next level Splunk. What is the next level Splunk vision? >> And I love the pink and orange, in bold colors. So when I've thought about what are the issues that are some of the blockers to Splunk eventually fulfilling the destiny that we could have, the number one is awareness. Who the heck is Splunk? People have very high variance of their understanding of Splunk. Log aggregation, security tool, IT tool, and what we've seen over and over is it is much more this data platform, and certainly with the announcements, it's becoming more of this data fabric or platform that can be used for anything. So how do we bring awareness to Splunk? Well, let's help create a category, and it's not up to us to create the category, it's up to all of you to create the category, but Data-to-Everything in our minds represents the power of data, and while we will continue internally to focus on those technical buying centers, everything is solvable with data. So we're trying to really reinforce the importance of data and the capabilities that something like Splunk brings. Cloud becomes a really important message to that because that makes it, execution to that, 'cause it makes it so much easier for people to immediately try something and get value, but on-prem will always be important as well 'cause data has gravity, data has risk, data has cost to move. And there are so many use cases where you would just never push data to the cloud, and it's not because we don't love cloud. If you have a factory that's producing 100 terabytes an hour in a area where you've got poor bandwidth, there's no option for a cloud connect there of high scale, so you better be able to process, make sense of, and act on that data locally. >> And you guys are great in the cloud too, on-premise, but final word, I want to get your thoughts to end this segment, I know you got to run, thanks for your time, and congratulations on all your success. Data for good. There's a lot of tech for bad kind of narratives goin' on, but there's a real resurgence of tech for good. A lot of people, entrepreneurs, for-profit, for-nonprofit, are doing ventures for good. Data is a real theme. Data for good is something that you have, that's part of the Data-to-Everything. Talk about the data for good real quick. >> Yeah, we were really excited about what we've done with Splunk4Good as our nonprofit focused entity. The Splunk Pledge which is a classic 1-1-1 approach to make sure that we're able to help organizations that need the help do something meaningful within their world, and then the Splunk Social Impact Fund which is trying to put our money where our mouth is to ensure that if funding and scarcity of funds is an issue of getting to effective outcomes, that we can be there to support. At this show we've featured three awesome charities, Conservation International, NetHope, and the Global Emancipation Network, that are all trying to tackle really thorny problems with different, in different ways, different problems in different ways, but data winds up being at the heart of one of the ways to unlock what they're trying to get done. We're really excited and proud that we're able to actually make meaningful donations to all three of those, but it is a constant theme within Splunk, and I think something that all of us, from the tech community and non-tech community are going to have to help evangelize, is with every invention and with every thing that occurs in the world there is the power to take it and make a less noble execution of it, you know, there's always potential harmful activities, and then there's the power to actually drive good, and data is one of those. >> Awesome. >> Data can be used as a weapon, it can be used negatively, but it also needs to be liberated so that it can be used positively. While we're all kind of concerned about our own privacy and really, really personal data, we're not going to get to the type of healthcare and genetic, massive shifts in changes and benefits without having a way to begin to share some of this data. So putting controls around data is going to be important, putting people in the middle of the process to decide what happens to their data, and some consequences around misuse of data is going to be important. But continuing to keep a mindset of all good happens as we become more liberal, globalization is good, free flow of good-- >> The value is in the data. >> Free flow of people, free flow of data ultimately is very good. >> Doug, thank you so much for spending the time to come on theCUBE, and again congratulations on great culture. Also is worth noting, just to give you a plug here, because it's, I think, very valuable, one of the best places to work for women in tech. You guys recently got some recognition on that. That is a huge accomplishment, congratulations. >> Thank you, thank you, we had a great diversity track here which is really important as well. But we love partnering with you guys, thank you for spending an entire week with us and for helping to continue to evangelize and help people understand what the power of technology and data can do for them. >> Hey, video is data, and we're bringin' that data to you here on theCUBE, and of course, CUBE cloud coming soon. I'm John Furrier here live at Splunk .conf with Doug Merritt the CEO. We'll be back with more coverage after this short break. (futuristic music)

>> Live from Las Vegas, it's theCUBE, covering AWS re:Invent 2018, brought to you by Amazon Web Services, Intel, and their ecosystem partners. >> And welcome back here to Las Vegas. We're in the Sands expo, we're in Hall D. If you happen to be at the show or dropping in just to watch, come on by and say hi to us. Love to see you here on theCUBE, as we continue our coverage, day two. And along with Justin Warren, I'm John Walls. And now we're joined by a couple of gents from HUB International, Seth Morrell, who's the vice president of enterprise, architecture and design. Seth, good morning to you. >> Good morning. >> And Jeremy Embalabala, who is the director of security architecture and engineering, also at HUB International. Good morning, Jeremy. >> Good morning. >> Seth, by the way, playing hurt, broken finger with a snowblower in Chicago on Monday. >> On Monday. >> Yeah, good luck though with the winter. >> Yeah, yeah, yeah, it started off well. >> Sorry to see that, but thanks for coming regardless. >> No problem. >> All right, tell us about HUB International a little bit, about primary mission and then the two of you, what you're doing for them primarily. >> Right, right, so HUB International is an insurance brokerage. Personal, commercial, we do employee benefits, retirement as well. We're based in the US in Chicago, operate in US and Canada. 500 plus locations, 12,000 employees. >> Okay, and then primary responsibilities between the two of you? >> Well, I'm the director of security architecture. I'm responsible for all things technical with regards to security, both on the architecture side, engineering and operations. >> All right, so yesterday we were talking about this early, you did a session, you're big Splunk guys, right? So let's talk about what you're doing with that, how that's working for you in general, if you would. >> Yeah, yeah, go ahead. >> Yeah, the reason Splunk Enterprise Security, the on-premise version we actually, people always ask me, are you using Splunk Cloud or Splunk On Prem? And I always joke, well we're using Splunk On Prem in the cloud in AWS. But for us, we're really focused on Splunk as a SIEM, to enable our security operations center to provide insights into our environment and help us detect and understand threats that are going on in the environment. So we have a manage partner that runs our security operations center for us. They also manage our Splunk environment. It helps us keep an eye on both our AWS environment that we have, our Azure environment, and our on-premise data center as well. >> A few people have sort of gotten wary of the idea of a SIEM. People have tried to use SIEMs and they haven't been very successful and they go, "Oh SIEM's a bit of a dirty word." But it sounds like SIEM's actually working for you really well. >> Yeah, I really view a SIEM as a cornerstone of security program. Specifically if you have a mature security operation center, it's really hard to operate that without a SIEM. SIEMs are tricky, they're tricky to implement, they're generally very costly and they require a lot of tuning, a lot of love, care, and feeding in order to be effective. Quite frankly, if you don't get that right, it can actually be detrimental to your security program. But if you put the proper care and feeding into a SIEM, it will be very beneficial to your organization. >> Okay, so what's some of the things that you've been able to do now that you've got Splunk in there and it's helping you manage the security? Because I saw some statistics earlier this morning, where security is basically the second biggest, most popular term here at AWS and at re:Invent. It's clearly front of mind for a lot of enterprises. So what is it that Splunk in helping you to achieve that you wouldn't have been able to go otherwise? >> The biggest thing for us is the aggregation of all of our logs, our data sources in AWS, data sources on prem, our Windows file servers, our network traffic flow data, all of that's aggregated into Splunk. And that allows us to do some correlation with third-party threat intelligence feeds. Take indicators of compromise that are streamed, that are observed out there in the real world, and apply those to data that we're seeing on our actual data sources in our environment. It allows us to detect threats that we wouldn't have been able to detect otherwise. >> Right, how does that translate through to what you're actually doing as a business? I mean, this is a very sort of technology-centric thing, but you're an insurance agent. So how does this investment in security translate into the business value? >> One, it just gives us visibility into the environment, and we can proactively identify potential threats and remediate them before they actually cause an impact to the business. Without these tools and without these capabilities, it'd be a much riskier endeavor. And so it's helped us throughout, and we've been good partners with Splunk, they're been good partners with us. And coupled with all the other things that we're doing in the security space and in the cloud space, we're able to build a nice secure environment for our customers and ourselves. >> We're also a very highly regulated industry, so we have regulations that we have to comply with for security. And our customers also care about security very, very deeply. So it allows us to be able to protect our customers' data and really assure our customers that their data is safe with us, whether that data is hosted on-prem or it's in the cloud. >> What about that battle? There's often a battle between private enterprise and regulation, just in general, right? It's making sure the policy makers understand capabilities and real threats as opposed to maybe perceptions or whatever. What do you see in terms of the federal regulatory environment and what you deal with in a Balkanized system where you're dealing with 50 states and Canada. So you've got your hands full, I assume. >> So at HUB, we view security and compliance a little differently. Instead of trying to build security programs and achieve compliance by abiding by all the regulations, we do the right thing from a security perspective. We make the right investments. We put the right controls into our environment. When those new regulations come out for provincial law in Canada or different states or GDPR in Europe, that we'll be 95% of the way there, by just building the right controls into our environment at a foundational level. Then we have to just spend our efforts just kind of aligning ourselves with the other 5% that vary from regulation to regulation. >> Was that a shift in management philosophy at all? Because quite often or maybe in the past, it's like, I'm only going to do something. I'm not saying HUB, but in general, when I have to. As opposed to you appear to be preemptive. Right, you're doing things because you should. So there's a different mindset there, right? >> It sounds like a much more strategic view of security rather than a tactical reactive kind of security. How long has that been the philosophy at HUB? >> So we really built out our a security program starting the beginning of last year. There's all new leadership that came in, Seth came in, myself came in, all new leadership across the organization. And that's really where that mindset came from. And the need and recognition to make an investment in security. We view security as a driver of business, not just a cost center. It's a way we can add to the bottom line and be able to generate revenue for the business by being able to show our customers that we really care about their data, and we're going to do our best to take of them. So with that mindset, we can actually help market, and use that as a marketing tool to be able to help drive business. >> So what are some of the things that you've seen here at the show that you're thinking about, well actually that will support my strategy? Some of the more longer term things. Is there anything that's sort of stuck out to you as sort of going, ooh, that's something that we should actually take back? >> Yeah, well, there's some tactical announcements that are very important to us. The announcement of Windows File Server support. File Server support is big deal for us. We're a heavy File Server organization. And having that native within AWS is very interesting. There's been some other announcements with SFTP. Other items that we're going to be trying to take advantage of in a fairly quick fashion. And we're excited about that. We've been on our journey to cloud since essentially the summer of 2017 through now. And we're kind of ready for the next steps, the next set of capabilities. And so, a conference like this and all these announcements, we're excited to take a look at the menu and start picking out what we want to eat. >> It's a great buffet. >> Yeah, yeah. >> In a city that's famous for it. >> That's true, that's true. >> All you can eat. >> Yeah. >> All right, so let's talk about the journey then. You said 2017, so it's been a year, year plus into that. And you're excited about what's coming, but what do you need? So I know you got this great buffet that you're looking at, but maybe you don't want the pork. Maybe you want the turkey. What do you need, what do you want the most, you think, to service your clients? >> Right, so, we spent most of our migration just essentially moving what we had over to the cloud. And so, what our next steps are, let's really understand our workloads, let's be smarter about how we're running them, let's take advantage of the appropriate technology, the menu items that are out there, per work load, just to be smarter. We're going to be spending much more time this year looking at more automation, orchestration, and basically maturing our cloud capabilities so that we're ready for the next big thing. And as we acquire another company or there's a new business need, we're working to be more proactive and being able to anticipate those needs with building a platform that we can really extend and build upon. >> I'm sorry, go ahead. >> I have a question on the choosing of workloads then. So are you going to be moving everything to the cloud? Or do you think that there'll be some things that will actually remain on-prem or is it going to be a hybrid cloud? >> Our goal is to go from a data center to a network closet. >> Right. >> So we have moved almost all of our application workloads out of our data center right now. We have a large VDI environment we're looking to move as well. Once that's done, we'll be down to our phone system and a couple other legacy applications that we're trying to determine what we actually want to do with strategically. >> Right, okay. That's a pretty common sort of story. There's a lot of people who are moving as much as they possibly can, and then there's a few little bits that just sort of sit there that you need to decide, do we rewrite this, do we actually need this at all, maybe we just turn it off. >> Right. >> Yeah. >> Are there any capabilities specific to your industry that you need or that you'd like to have refined? Something that would allow you to do your job, specifically in the insurance space, that would be unique to you? Anything floating out there that you say, if we had that, that'll fine-tune this to a better degree or a greater degree? >> So for us, it's all about flexibility. We grow very, very rapidly through our mergers and acquisitions. We bought 52 companies last year and we're on pace to do almost 70 companies this year. So for us, the cloud really enables us to be able to absorb those organizations that we acquire, bring them in much, much faster. Part of the story of our cloud migration, we were able to move the integration time for mergers and acquisitions from six months down to under 90 days. Because we're now able to move those workloads in much, much quicker with the clouds. For us that's really a key capability. >> Well you guys are used to writing checks, dinner's on them tonight, right? >> Definitely. >> Seth, Jeremy, thanks for being with us. >> Thank you. >> Glad to be here. >> We appreciate the time. Good luck with the winter, I think you might need it. >> Yeah, yeah, exactly. >> All right, we'll be back with more from AWS re:Invent. You're watching theCUBE from Las Vegas. (snappy techno music)

>> Announcer: Live from Orlando, Florida, it's theCUBE, covering .conf2018. Brought to you by Splunk. >> Welcome back to .conf2018 everybody, this is theCUBE the leader in live tech coverage. I'm Dave Vellante with Stu Miniman, wrapping up day one and we're pleased to have Bina Khimani, who's the global head of Partner Ecosystem for the infrastructure segments at AWS. Bina, it's great to see you, thanks for coming on theCUBE. >> Thank you for having me. >> You're very welcome. >> Pleasure to be here. >> It's an awesome show, everybody's talking data, we love data. >> Yes. >> You guys, you know, you're the heart of data and transformation. Talk about your role, what does it mean to be the global head Partner Ecosystems infrastructure segments, a lot going on in your title. >> Yes. >> Dave: You're busy. (laughing) >> So, in the infrastructure segment, we cover dev apps, security, networking as well as cloud migration programs, different types of cloud migration programs, and we got segment leaders who really own the strategy and figure out where are the best opportunities for us to work with the partners as well as partner development managers and solution architects who drive adoption of the strategy. That's the team we have for this segment. >> So everybody wants to work with AWS, with maybe one or two exceptions. And so Splunk, obviously, you guys have gotten together and formed an alliance. I think AWS has blessed a lot of the Splunk technology, vice versa. What's the partnership like, how has it evolved? >> So Splunk has been an excellent partner. We are really joined hands together in many fronts. They are fantastic AWS marketplace partner. We have many integrations of Splunk and AWS services, whether it is Kinesis data, Firehose, or Macy, or WAF. So many services Splunk and AWS really are well integrated together. They work together. In addition, we have joined go to market programs. We have field engagement, we have remand generation campaigns. We join hands together to make sure that our customers, joint customers, are really getting the best value out of it. So speaking of partnership, we recently launched migration program for getting Splunk on prem, Splunk Enterprise customers to Splunk Cloud while, you know, they are on their journey to Cloud anyway. >> Yeah, Bina let's dig into that some, we know AWS loves talking about migrations, we dig into all the databases that are going and we talk at this conference, you know Splunk started out very much on premises but we've talked to lots of users that are using the Cloud and it's always that right. How much do they migrate, how much do they start there? Bring us instead, you know, what led to this and what are the workings of it. >> So what, you know if you look at the common problems people have customers have on prem, they are same problems that customers have with Splunk Enterprise on prem, which is, you know, they are looking for resiliency. Their administrator goes on vacation. They want to keep it up and running all the time. They help people making some changes that shouldn't have been made. They want the experts to run their infrastructure. So Splunk Cloud is run by Splunk which is, you know they are the best at running that. Also, you know I just heard a term called lottery proof. So Splunk Cloud is lottery proof, what that means the funny thing is, that you know, your administrator wins lottery, you're not out of business. (laughs) At the same time if you look at the the time to value. I was talking to a customer last night over dinner and they were saying that if they wanted to get on Splunk Enterprise, for their volume of data that they needed to be ingested in Splunk, it would take them six months to just get the hardware in place. With Splunk Cloud they were running in 15 minutes. So, just the time to value is very important. Other things, you know, you don't need to plan for your peak performance. You can stretch it, you can get all the advantages of scalability, flexibility, security, everything you need. As well as running Splunk Cloud you know you are truly cost optimized. Also Splunk Cloud is built for AWS so it's really cost optimized in terms of infrastructure costs, as well as the Splunk licensing cost. >> Yeah it's funny you mentioned the joke, you know you go to Splunk cloud you're not out of a job, I mean what we've heard, the Splunk admins are in such high demand. Kind of running their instances probably isn't, you know a major thing that they'd want to be worrying about. >> Yes, yes, so-- >> Dave: Oh please, go. >> So Splunk administrators are in such a high demand and because of that, you know, not only that customers are struggling with having the right administrators in place, also retaining them. And when they go to Cloud, you know, this is a SAS version, they don't need administrators, nor they need hardware. They can just trust the experts who are really good at doing that. >> So migrations are a tricky thing and I wonder if we can get some examples because it's like moving a house. You don't want to move, or you actually do want to move but it's, you have be planful, it's a bit of a pain, but the benefits, a new life, so. In your world, you got to be better, so the world that you just described of elastic, you don't have to plan for peaks, or performance, the cost, capex, the opex, all that stuff. It's 10 X better, no debate there. But still there's a barrier that you have to go through. So, how does AWS make it easier or maybe you could give us some examples of successful migrations and the business impact that you saw. >> Definitely. So like you said, right, migration is a journey. And it's not always easy one. So I'll talk about different kinds of migration but let me talk about Splunk migration first. So Splunk migration unlike many other migration is actually fairly easy because the Splunk data is transient data, so customers can just point all their data sources to Splunk Cloud instead of Splunk Enterprise and it will start pumping data into Splunk Cloud which is productive from day one. Now if some customers want to retain 60 to 90 days data, then they can run this Splunk Enterprise on prem for 60 more days. And then they can move on to Splunk Cloud. So in this case there was no actual data migration involved. And because this is the log data that people want to see only for 60 to 90 days and then it's not valuable anymore. They don't really need to do large migration in this case it's practically just configure your data sources and you are done. That's the simplest part of the migration which is Splunk migration to Splunk Cloud. Let's talk about different migrations. So... you have heard many customers, you know like Capital One or many other Dow-Jones, they are saying that we are going all in on AWS and they are shutting down their data centers, they are, you know, migrating hundreds of thousands of applications and servers, which is not as simple as Splunk Cloud, right? So, what AWS, you know, AWS does this day in and day out. So we have figured it out again and again and again. In all of our customer interactions and migrations we are acquiring ton of knowledge that we are building toward our migration programs. We want to make sure that our customers are not reinventing the wheel every time. So we have migration programs like migration acceleration program which is for custom large scale migrations for larger customers. We have partner migration programs which is entirely focused on working with SI partners, consulting partners to lead the migrations. As well as we're workload migration program where we are standardizing migrations of standard applications like Splunk or Atlassian, or many of their such standard applications, how we can provide kind of easy button to migrate. Now, when customers are going through this migration journey, you know, it's going to be 10 X better like you said, but initially there is a hump. They are probably needing to run two parallel environments, there is a cost element to that. They are also optimizing their business processes there is some delay there. They are doing some technical work, you know, discovery, prioritization, landing zone creations, security, and networking aspects. There are many elements to this. What we try to do is, if you look at the graph, their cost is right now where this and it's going to go down but before that it goes up and then goes down. So what we try to do is really provide all the resources to take that hump out in terms of technical support, technical enablement, you know, partner support, funding elements, marketing. There are all types of elements as well as lot of technical integrations and quick starts to take that hump out and make it really easy for our customers. >> And that was our experience, we're Amazon customer and we went through a migration about, I don't know five or six years ago. We had, you know, server axe and a cage and we were like, you know, moving wires over and you'd get an alert you'd have to go down and fix things. And so it took us some time to get there, but it is 10 X better now though. >> It is. >> The developers were so excited and I wanted to ask you about, sort of the dev-ops piece of it because that's really, it became, we just completely eliminated all the operational pieces of it and integrated it and let the developers take care of it. Became, truly became infrastructure as code. So the dev-ops culture has permeated our small organization, can't imagine the impact on a larger company. Wonder if you could talk about that a little bit. >> Definitely. So... As customers are going through this cloud migration journey they are looking at their entire landscape of application and they're discovering things that they never did. When they discover they are trying to figure out should I go ahead and migrate everything to AWS right now, or should I a refactor and optimize some of my applications. And there I'm seeing both types of decisions where some customers are taking most of their applications shifting it to cloud and then pausing and thinking now it is phase two where I am on cloud, I want to take advantage of the best of the breed whatever technology is there. And I want to transform my applications and I want to really be more agile. At the same time there are customers who are saying that I'm going to discover all my workload and applications and I'm going to prioritize a small set of applications which we are going to take through transformation right now. And for the rest of it we will lift and shift and then we will transform. But as they go through this transformation they are changing the way they do business. They are changing the way they are utilizing different technology. Their core focus is on how do I really compete with my competition in the industry and for that how can IT provide me that agility that I need to roll out changes in my business day in day out. And for that, you know, Lambda, entire code portfolio, code build, code commit, code deploy, as well as cloud trail, and you know all the things that, all the services we have as well as our partners have, they provide them truly that edge on their industry and market. >> Bina, how has the security discussion changed? When Stu and I were at the AWS public sector summit in June, the CIO of the CIA stood up on stage in front of 10,000 people and said, "The cloud on my worst day from a security perspective "is better than my client server infrastructure "on a best day." That's quite an endorsement from the CIA, who's got some chops in security. How has that discussion changed? Obviously it's still fundamental, critical, it's something that you guys emphasize. But how has the perception and reality changed over the last five years? >> Cloud is, you know, security in cloud is a shared responsibility. So, Amazon is really, really good at providing all the very, very secure infrastructure. At the same time we are also really good at providing customers and business partners all of the tools and hand-holding them so that they can make their application secure. Like you said, you know, AWS, many of the analysts are saying that AWS is far more secure than anything they can have within their own data center. And as you can see that in this journey also customers are not now thinking about is it secure or not. We are seeing the conversation that, how in fact, speaking of Splunk right, one customer that I talked to he was saying that I was asking them why did you choose Splunk cloud on AWS and his take was that, "I wanted near instantaneous SOA compliant "and by moving to Splunk cloud on AWS "I got that right away." Even I'm talking to public sector customers they are saying, you know, I want fair DRAM I want in healthcare industry, I want HIPPA Compliance. Everywhere we are seeing that we are able to keep up with security and compliance requirements much faster than what customers can do on their own. >> So they, so you take care of, certainly from the infrastructure standpoint, those certifications and that piece of the compliance so the customer can worry about maybe some of the things that you don't cover, maybe some of their business processes and other documentation, ITIL stuff that they have to do, whatever. But now they have more time to do that presumably 'cause that's check box, AWS has that covered for me, right? Is that the right thinking? >> Yes, plus we provide them all the tools and support and knowledge and everything so that they, and even partner support who are really good at it so that not only they understand that the application and infrastructure will come together as entire secure environment but also they have everything they need to be able to make applications secure. And Splunk is another great example, right? Splunk helps customer get application level security and AWS is providing them infrastructure and together we are working together to make sure our customers' application and infrastructure together are secure. >> So speaking about migrations database, hot topic at a high level anyway, I wonder if you could talk about database migrations. Andy Jassy obviously talks a lot about, well let's see we saw RDS on Prim at VMworld, big announcement. Certainly Aurora, DynamoDB is one of the databases we use. Redshift obviously. How are database migrations going, what are you doing to make those easier? >> So what we do in a nutshell, right for everything we try to build a programatic reputable, scalable approach. That's what Amazon does. And what we do is that for each of these standard migrations for databases, we try to figure out, that let's take few examples, and let's figure out Play Books, let's figure out runbooks, let's make sure technical integrations are in place. We have quick starts in place. We have consulting partners who are really good at doing this again and again and again. And we have all the knowledge built into tools and services and support so that whenever customers want to do it they don't run into hiccups and they have really pleasant experience. >> Excellent. Well I know you're super busy thanks for making some time to come on theCUBE I always love to have AWS on. So thanks for your time Bina. >> Thank you very nice to meet you both. >> Alright you're very welcome. Alright so that's a wrap for day one here at Splunk .conf 2018, Stu and I will be back tomorrow. Day two more customers, we got senior executives coming on tomorrow, course Doug Merritt, always excited to see Doug. Go to siliconangle.com you'll see all the news theCUBE.net is where all these videos live and wikibon.com for all the research. We're out day one Splunk you're watching theCUBE we'll see you tomorrow. Thanks for watching. >> Bina: Thank you. (electronic music)

>> Live from Orlando, Florida, it's theCUBE, covering .conf 18. Brought to you by Splunk. >> We're back in Orlando, everybody, at Splunk .conf18, #splunkconf18. I'm Dave Vellante with my co-host Stu Miniman. You're watch theCUBE, the leader in live tech coverage. We like to go out to the events. We want to extract the signal from the noise. We've been documenting the ascendancy of Splunk for the last seven years, how Splunk really starts in IT operations and security, and now we hear today Splunk has aspirations to go into the line of business, but speaking of security, Gary Mikula is here. He's a senior director of cyber and information security at FINRA, and he's joined by Siddharta "Sid" Dadana, who's the director of information security engineering at FINRA. Gentlemen, welcome back to theCUBE, Gary, and Sid, first-timer, welcome on theCUBE. So, I want to start with FINRA. Why don't you explain, I mean, I think many people know what FINRA is, but explain what you guys do and, sort of, the importance of your mission. >> Sure, it's our main aspiration is to protect investors, and we do that in two ways. We actually monitor the brokers and dealers that do trades for people, but more importantly, and what precipitated our move to the Cloud was the enormous amount of data that we have to pull in daily. Every transaction on almost every US stock market has to be surveilled to ensure that people are acting properly, and we do that at the petabyte scale, and doing that with your own hardware became untenable, and so the ability to have elastic processing in the Cloud became very attractive. >> How much data are we talking about here? Is there any way you can, sort of, quantify that for us, or give us a mental picture? >> Yeah, so the example I use is, if you took every transaction that Visa has on a normal day, every Facebook like, every Facebook update, and if you took every Twitter tweet, you added them altogether, you multiplied it by 20, you would still not reach our peak on our peak day. >> (laughs) Hence, Splunk. And we'll talk about that but, Sid, what's your role, you got to architect all this stuff, the data pipeline, what do you... >> So, my role is basically to work with the webs teams, application teams to basically integrate security in the processes, how they roll out applications, how they look at data, how they use the same data that security uses for them to be able to leverage it for the webs and all the performances. >> So, your mission is to make sure security's not an afterthought, it's not a bolt-on, it's a fundamental part of the development process, so it's not thrown over the fence, "Hey, secure this application." It's built in, is that right? >> Yes. >> Okay. Gary, I wonder if you could talk about how security has changed over the last several years. You hear a lot that, well, all the spending historically has been on keeping the bad guys out the perimeter. As the perimeter disappears, things change, and the emphasis changes. Certainly, data is a bigger factor, analytics have come into play. From your perspective, what is the big change or the big changes in security? >> So, it's an interesting question. So I've been through several paradigm changes, and I don't think anyone has been as big as the move the Cloud, and... The Cloud offers so much opportunity from a cost perspective, from a processing perspective, but it also brings with it certain security concerns. And we're able to use tools like Splunk to be able to do surveillance on our AWS environments in order to give us the confidence to be able to use those services up there. And so, we now are actually looking at how we're going to secure individual AWS services before we use them, rather than looking to bring stovepipe solutions in, we're looking to leverage our AWS relationship to be able to leverage what they've built out of the box. >> Yeah, people oftentimes, Stu, talk about Cloud security like it's some binary thing. "Oh, I don't want to go the Cloud, because Cloud is dangerous" or "Cloud security is better". It's not that simple, is it? I mean, maybe the infrastructure. In fact, we heard the CIA, Stu and I were in D.C. in December, we heard the CIO of the CIA say, "The Cloud, its worse day is better than my client's server from a security perspective." But he's really talking about the infrastructure. There's so much more to security, right? >> Absolutely, and, so I agree that the Cloud gives the opportunity to be better than you are on PRAM. I think the way FINRA's rolled out, we've shown that we are more secure in the Cloud than we have been on traditional data centers, and it's because of our ability to actually monitor our whole AWS environment. Everything is API-based. We know exactly what everybody's doing. There's no shadow IT anymore, and those are all big positives. >> Yeah, I'm wondering how you've, what KPIs you look at when you look at your Splunk environment. What we hear from Splunk, you know, it's scalability, cost, performance, and then that management, the monitoring of the environment. How are they doing? How does that make your job easier? >> So, I think we still look at the same KPIs that Splunk advertises all the time, but some of the reasons, from our perspective, we kind of look at it in terms of, how much value can we give it to not just one part of the company, but how can we make it much more enhanceable part for everyone in the organization. So, the more we do that, I think that makes it a much better ROI for any organization to use a product like this one. >> You guys talk about the "shift left" movement. What is "shift left" and what is the relevance to security? >> Yeah so, "shift left" is a concept where, instead of looking at security as a bolt-on, or an add-on, or a separate entity, we're looking to leverage what are traditional DevOp tools, what are traditional SDLC pipeline roles, and we're looking at how we integrate security into that, and we use Splunk to be able to integrate collection of data into our CDCI pipelines, and it's all hands-off. So, somebody hits a button to deploy a new VPC and AWS, automatically things are monitored and into our enterprise search, I'm sorry, enterprise security SIM, and automatically being monitored. There's no hands-on that needs to be done. >> So, on a scale of one to five, thinking of a maturity model in terms of, in a DevOps context, five being, you know, the gold standard and one being you're just getting started. Where would you put FINRA on that spectrum, I mean, just subjectively? >> So, I'll never say that we're a five because I think there's always, >> You're never done. >> You're never done and there's always room for improvement, but I think we're at least a strong four. We've embraced those concepts, and we've put them into action. >> And so, I thought so, and I want to ask you from a skill standpoint how you got there. So, you've been around a long time. You had a Dev team and an Ops team before the term DevOps even came around, right? And we talk about this a lot, Stu. What did you do with the Ops guys and the Dev guys? Is it OpsDev or DevOps? Did you retrain them? Did you fire them all and hire new people? How did you go through that transition? >> Yep, that's a fair thing. I went to my CISO John Brady a couple of years ago and I told him that we were going to need to get these new skill sets in, and that I thought I had the right person in Sid to be able to head that up, and we brought in some new talent, but we also retrained the existing talent because these were really bright people, and they still had the security skills. And what Sid's been able to do is to embrace that and create a working relationship with the traditional DevOps teams so that we can integrate into their tools. >> So, it does include a little bit work even on our end to do where you kind of learn how the DevOps forces work, so you've got to do it on your own to first figure out things and then you can actually relate to the problems which they will go through and then you work through problems with them, rather than you designing up a solution and then just say, "Hey, go and implement it out." So, I think that kind of relationship has helped us and in the long run, we hope to do a bit better work. >> Yes, Sid, can you bring us in a little bit, when you look at your Splunk deployment, FINRA'S got a lot of applications, how do you get all those various applications in there? You know, Splunk talks about, you can get access to your data your way, do you find that to be the reality? >> Yes, to a certain extent, so... Let's take a step back here. So our design is much more hybrid-oriented. So, we use Splunk Cloud, but that's primarily for our indexers whereas we host our own sort of class receptor. All the data basically goes in from servers from AWS components, from on-prem, basically it flows into our Splunk Cloud indexers, and we use a role-based access management to actually give everyone access to whatever data they need to be looking at. >> Alright. The number of enhancements from 702, updates, the Cloud, Gar-Gar, is there anything that's jumped out that's going to architecturally help your team? >> So, I think one of the interesting things is the new data pipeline, and to be able to actually mangle that data before I get it into my Splunk indexers is going to be really really life-changing for us. One of the hard parts is that developers write code and they don't necessarily create logs that are event-driven. They don't have date-time stamps, they do dumps. So, I'm going to be able to actually massage that before it hits the indexers, and it's going to speed up our ability to be able to provide quick searches because the indexers won't be working on mangling that data. >> And how big of a deal is it for you? They announced yesterday the ability to scale storage and compute separately in a more granular fashion, is that a big deal for you? >> So, I actually, I remember speaking to Doug Merritt probably three years ago. >> You started this! (laughing) >> And I said, "Doug", I said, "I really think that's the direction that you need to go. You're going to have to separate those two, eventually, because we're doing a petabyte scale, we realized very early that that'd need to be done. And so, it's really really refreshing to see, because it's going to be transformative to be able to do compute-on-demand after that. Because now we can start looking at API brokers, and we can start looking at containers, and all those other things can be integrated into Splunk. >> Love having customers on like you guys, so knowledgeable. I have to ask, switch gears a little bit, I want to ask you about your security regime. We had a customer on yesterday, and it was the CISO who reported to him. He was the EVP, and he reported to the CIO. A lot of organizations say, "You know what? We want the CISO to be separate from the CIO. Cause it's like the, you know, the fox in the henhouse kind of thing. And we want that a little bit of tension in there." How do you guys approach it? What's the regime you have for... >> That is a fair question, and I've heard that from many other CISOs that have that same sort of complaint. And I think it's really organization-based. And I think, do you have the checks and balances in place? First of all, our CIO, Steve Randich, is extremely, he cares a lot about security, and he is very good at getting funding for us for initiatives to help secure the environment. But more importantly, our board of directors bring up security at every board event. They care about it, they know about it, and that permeates through the organization. So there's a checks and balances to make sure that we have the right security in place. And it's a working relationship, not adversarial at all, so, having our CISO John Brady report to Steve Randich, the CIO, has not been a hindrance. >> And I think that's a change in the last several years, because that regime that I described, which was, there was sort of a wave there, where that became common, and I think you just hit on it. When security became a board-level issue, and for every Fortune 1000, Global 2000 company, it's a board-level issue. They talk about it every board meeting. When that occurred, I think there was an epiphany of, "We need the CIO to actually be on this." And you want the CIO to be responsible for that. And the change was, it used to be, "Hey, if I fail, I get fired." And I think boards now realize that "failure" in security doesn't mean you got breached. >> Sure. >> You know. Breaches are going to happen. It's how you respond to them and, you know, how you react to them that is becoming more important. So there's much more transparency around security in our view. I wonder if you agree with that. >> I think there's transparency. And the other thing is is that you have to put the decision-making where it makes the most sense. Most of the security breaches that we're talking about are highly technical in nature, where a CIO is better able to evaluate some of those decisions, not all companies have a CEO that came from a technology train in order to be able to make those decisions. So, I think it makes more sense to have the CISO report to somebody in the technology world. >> Great, thank you for that. Now, the other question I have for you is, in terms of FINRA's experience with Splunk, did it start with SecOps and security, or was it, sort of, IT operations, or...? >> It did, it started with security. We were disenfranchised with traditional SIMs that were out there, and we decided to go with Splunk, and we made the decision that security was going to own it, but we wanted it to be a corporate asset from day one. And we worked our tails off to integrate, through brown bags, through training. So we permeated through the organization. And, on any given week, we pull about 35-40% of all of technology is using Splunk at FINRA. >> So, I'm curious as to, we heard some announcements today, I don't know if you saw them, about, you know, Splunk Next, building on that, Splunk for the line of business, the business flow, they did a nice demo there. Do you see, because security sort of was the starting point, and your mission was always to permeate the organization, do you see that continuing to other parts of the organization more aggressively now given this sort of democratization of data for the business lines, and... Will you guys be a part of that, directly? >> We hope so. We hope we are part of that change, too. I mean, the more we can use the same data for even business users that will help them, that would relieve a lot of, and they made this point again and again in the keynote, too, that, the It Ops and SecOps are already burdened enough. So, how do we make life easy for business users who actually leverage the same data? So we hope to be able to put these tools up and see if it can make any difference to business users. >> So, you guys have put a lot of emphasis on integrating with Splunk and AWS Cloud. You have a presentation later on today at .conf18 around the AWS Firehose that you have with Splunk. What's that all about? What's the AWS Firehose? How are you integrating it? Why is it important? >> So, it is streaming and it allows me to get information from AWS that's typically in something called the CloudWatch Logs, that is really difficult to be able to talk to. And I want to get it into the Splunk so I can get more value from it. And what I'm able to do is put something called a subscription filter on it, and flow that data directly into Splunk. So, Splunk worked with AWS to create this integration between the two tools, and we think we've taken it to a high level. We use it for Lambda, to grab those logs, we use it for VPC Flow Logs, we're using it for SaaS Providers, provide APIs into their data, we use it for that, and finally, we're going to be doing database activity monitoring, all leveraging this same technology. >> Love it, I mean, you guys are on the forefront of Cloud and Splunk integration, Cloud adoption, DevOps, you guys have always been great about sharing your knowledge, you know, with others, and we really appreciate you guys coming on theCUBE. Thank you. >> Thanks for having us. >> You're welcome. Alright, keep it right there, everybody. Stu and I will be back. You're watching theCUBE from .conf18, Splunk's big user conference. We'll be right back. (electronic music)

>> Live from Orlando, Florida, it's theCUBE. Covering .conf18, brought to you by Splunk. >> Welcome back to Orlando everybody, home of Disney World, and this week, home of theCUBE. I'm Dave Vellante and he's Stu Miniman. Steven Hatch is here, he's the manager of Enterprise Logging Services at Cox Automotive. Steven, thanks for coming on theCUBE. >> Thank you. >> So, you've been with Splunk for a while, we're here at conf18. Logging services, enterprise logging services. When you think of Splunk, their roots, Splunk go back to, sort of, log files, analyzing log files, it's in your title. (laughs) You must be pretty intimately tied to, as a practitioner, to this capability, but talk about your role and what you do at Cox. >> Primarily, the role is to be the evangelist, the enabler, and the center of excellence when it comes down to getting those best practices propergated within the enterprise. >> So people come to you for advice, council, you play, sort of, internal consultant. What qualified you to do that? You were a practitioner prior to this, so you got your hands dirty and you kind of now, elevated to-- >> My prior role was a Site Operations, or Site Reliability Engineer, and then Manager. And so, having that background, I've been in IT since '96, so I'm a little old in the game, but basically, having that operational knowledge, and knowing how to think big picture when things are happening or transpiring, or the reverse and go back and find that root cause analysis. >> '96, just a pup, my friend, okay? (both laugh) So, talking to Stu, we were talking off camera, about the number of brands that Cox Automotive has, Cox at Kelley Blue Book and at numerous others, like dozens, each of these is kind of it's own data silo. How do you guys go about using Splunk? Are you able to break down some of those silos? Maybe you could share that with us. >> Yeah, so we have been successful on a lot of the big three really, at Kelley Blue Book, Manheim, as well as Auto Trader, to really break in. A lot of that was because of our, already previous, relationships with team members and leaders. On the other side of the coin is the newly acquired companies that are not in Atlanta, Georgia. That are in places like Groton, Connecticut, South Jordan, Utah, Upstate New York, as well as the Toronto area in Canada. And so, WebEx joined me, email just won't cut it. You actually have to sit down with these people and really showcase your business case, your model, and what you're trying to bring to the table. But of course, the approach is always important. >> And are you using Splunk to do that? As a collaboration tool as well? >> Yes sir, yep. >> Explain that a little bit if you would. >> So, a lot of times, as you mentioned, the silos, as a bigger brand now, it's no longer an excuse for you to only be responsible for your data and not showcase it, or share that data. Because we're thinking about the entire life-cycle of Cox Automotive, and this entity of Cox Automotive, that's important to us now. So for you to hold tight, or to hoard your data, or your metrics and not share them, that's not good business anymore. >> Yeah, so Steven, we talked to a lot of companies that do M&A, and it's usually like, well, this is the products we use, these are the structures that we have. One of the things we hear from Splunk is that you can get to your data, your way. How does the Splunk modeling, and how you look at the data, fit into that M&A? Is that an enabler for you to be able to get that in. >> Yeah, and so, when you can showcase the ability of how the data comes in and, quickly. Key word, right? To showcase how that data can be very valuable to them, especially to their stakeholders, that's when light bolts will go off. And, again, it's the stakeholders, and then champions, that we need to bring to the table to make sure that we can get full adoption. >> Yeah, we've also-- Dave's been to the show a few times, it's my first time, and what I've really heard a bunch of is the people that know how to use Splunk, they're super valuable inside of the company. They get training, people inside the company, they look to get hired, tell us a little about what you've seen, what it means to your role inside the company, and as you network with your peers here. >> It's a lot of exposure. A lot of people are very anxious to get some type of insights into their world, their infrastructure, their applications, their business tools. A lot of times, there are people out there that are very savvy from a business perspective, that have a bunch of KPIs in their head, but no one has actually extracted that information from them, and so, our job is to align with their KPIs. You know, over the last couple of years, that's what we've-- the journey that we've been on, is to now revisit the data that we've just ingested. That's the basic foundation. We want to elevate now and really get more mature, and to align with those business KPIs. >> Meaning they got this tribal knowledge in their head, and you want to codify that so that it can be shared. >> Correct. >> How do you go about doing that? Is it sitting in a whiteboard and understanding that? >> It can be a whiteboard, it can be over a coffee. If I need to get on a plane and go see them in person, and to really just listen and ask the questions when it's time but, again, listen and really understand what's important to them, what is important to their business, to their function, to their silos? Cox Automotive has five, of what we call, pillars, where there's international, finance, marketing, retail, or media, and each one of those owners, over time, wants the specific value. >> So if you go and have a chalkboard session, whiteboard session, with one of these folks, how do you operationalize it? You got to figure out where the data exists, so that you can align with what's in their head? Is that right? And then, how do you do that? How do you scale it? >> Well, so, again, you have to start from the top. If you start from the bottom, you'll be in the weeds until the end of time. So that the more efficient manner is to start from the top and realize those KPIs from those leaders, those stakeholders, and then from there, a tool like ITSI, which is basically built around services, entities, and aligning to their service decomposition model, and that right there allows you to stay consistent and efficient on getting that information. >> So you start top down, but ultimately, people are going to want granularity. So you start-- is it top down, bottom up, type of approach? Where you actually drill, drill, drill, drill, drill, and then get to the point where you can answer all those granule questions? And then, by doing that, if I understand it correctly, it sums to the top line, is that fair? >> Yeah, yeah, there's a point in time where you say, you know what? I could really now enhance or enrichen the data by a dataset that I know where it is. So the keypal will get you to a certain point, and then, to find that happy medium, or that common denominator from the data that you already have on premise, or from your apps, wherever they reside, that's where you can meet the gap. >> Otherwise you're never get it done. You'll end up boiling the ocean. >> That's correct, yes sir. >> All right, so, when we talked to you two years ago, you were using Splunk Cloud, you know? And when we talked to practitioners it's-- the things that they're managing, a lot of times now, most of it's not what they own, and so, how do I get the right information? How do I manage that environment? Talk to us a little bit about what you've seen in the maturation of Splunk and Splunk Cloud, if there's anything in 7.2, or Splunk Next, that's exciting you, to help you do your job even better. >> Oh man, so of course, the keynote today, the DSP, the processing layer that's in front of the Cloud, or in front of the indexes now. Where in real time, I can now route data, specifically from a security standpoint. If there's some type of event, without having to go through all the restarts and configuration management and everything else, I can simply put something in there, right there, and move the data, or mask the data. The ability with the infrastructure app, that's exciting to me, as well as all the feature updates for ITSI, enterprise security, as well as the Cloud itself. >> Can we do a little Splunk 101 for my benefit? So I heard today, from one of the product folks, that it used to be when you added another indexer, you had to add storage and compute simultaneously, whether or not you needed the storage, you had to add it, or vise versa. So an indexer is what, is it, essentially, a Splunk node? >> No, it can be a, basically, a Linux host, that actually has the agent running as an indexer with the attached disk. >> Right, okay, and it used to be you had to buy that in chunks, kind of like HCI, right? And you couldn't scale storage independent of compute? >> That's correct. >> What that meant is you were paying for stuff that you might not need. >> Right. >> So, with 7.2, I guess it is, you can split those and you get more granule, or what does that mean for you? >> Well, being a, now four year customer of Splunk Cloud, and anytime we went to the next version of, or license, the next step up, currently we're on about six terabytes. When we go up to eight, that the entailed more indexes being added to the cluster, which meant more time for the replication of search factors to be met, which can take however long, and then, or if there's any kind of issue with the indexer, where one had to be pulled out and another one introduced. How long does that take? Now, with the decoupling of the compute from the storage, it's minutes, and so it's a fraction of the time. >> And if I understand, I understood it real well when it's an appliance, but it's the same architecture if it's done in the Cloud, is that correct? >> It's, essentially, actually, it's a new architecture in my mind, where now it's able to scale more, and then there's-- I'm not sure how much they talked about it, but there's a potential of the elasticity of it. And so, now, I don't have to be so fixed, I can, on certain times, expand the cluster, you know, for search performance, or bring it back down when it's not needed. >> Some of the promise of Cloud. >> Yes, sir, Splunk Cloud. >> So it's like the Billy Dean, the five tool star. You've got the cost, you've got availability, you got speed, you got flexibility, and you've got business value, ultimately, which is what's driving here. So, I take it, I'm inferring here, you'd expect to use this capability in the near future? >> Very much so. >> Great. What else is on your horizon? What are the cool stuff you're working on? And things you want to share with us? >> Well, in addition to our leveraging Splunk Cloud for four years, next year we plan to move away from our current sim tool, into enterprise security. So it's very exciting to hear that they're continually updating that product, and so our security team has been knocking on my door for the last six months to really get that started. So, once we get there, we'll start the migration efforts and get Splunk Cloud now, enabled with the enterprise security, to really empower our security team, and stay ahead of our threats. >> So, I've been around a long time, and, ever since I can remember being in this business, customers have wanted to consolidate the number of vendors with whom they work. But the allure of best of breed always sucks them in to, oh, lets try this, or you get shadow IT. It sounds like, with Splunk, you're approaching this as a platform that you can use for a variety of different use cases. >> That is correct. >> Now, whether or not you reduce the number of vendors is, maybe a separate conversation, but I guess the question I have is, how are you using Splunk in new ways? It sounds like its permutating a line of business, SecOps, etc, is that an accurate picture? If you could describe it. >> Yeah, so Splunk itself, the core is the platform for so many different other functions within the business. You have security, you have the development group, DevOps, where, from a CICD perspective, now they can measure the metrics or the latency in between, when they create a car, say in rally, all the way to the very end of the line, what are all those metrics that are there, that they can leverage to increase their productivity? Obviously, infrastructure. As we consolidate all of our data centers down, wouldn't it be nice to know if these specific low bouncers or switchers are still having traffic to verse them? And to actually get a depiction of the consolidation effort. From a virtualization standpoint, isn't it powerful to know how many devices E6 hosts are actually fully being utilized, and how many are actually vacant? And how much money can be saved if we were actually to turn down those specifics blades or hosts? Or VMs that aren't being leveraged, but they're sitting there, taking up valuable resources. >> I remember when Splunk, right around the time they went public, I remember two instances, maybe three. There was a MPP database company, there was a large three letter firm, and there was an open-source specialist, and I heard the same thing from each of them, was we have the Splunk killer, this was like, five, six years ago. It seems like this Splunk killer was Splunk. And it really never happened. Why is it? Why is Splunk so effective? You obviously see, you know, you're independent, you want to use the best thing for Cox Automotive. What is it about Splunk that sets them apart, puts them in the lead? >> The scale capabilities, having this type of environment with the conferences and the sales group and the support groups, very intentional about listening. Having workshops where they come on premise to help us out on our use cases, to really educate their users, because the more their users are elevated from a knowledge standpoint, the more they will then exercise the application. If they all stay basic, why would I need another component of Splunk? Why would I need enterprise security? Why would I need to expand my subscription into the Cloud? The more I can exercise it, the more I'll need. >> So this is kind of a give, get. They come in knowing that if they expose you to other best practices, you'll going to be more effective in the use of Splunk and you might apply it in to other parts of your business. >> My appetite will grow and my users appetite will grow. >> And these are freebies that they're doing? Services freebies, or are they paid for services? >> Oh yeah, they have no problem coming in, supplying the necessary ammunition, or food, to entice, to have folks come in, but it's powerful to have all the engineers in there to really show us how things work. 'Cause, again, it's a win, win. >> And you're a football fan, I understand? >> Oh, yes, sir. >> Chiefs are your team, right? >> That's correct. >> Were you a football player? >> For a little while, yes. Now I coach, so that's my-- >> And you coach, what? >> Little girls. >> Kiddie football, huh, awesome. Is that Pop Warner these days, still? >> I guess you call it that. >> Flag football or tackle? >> Tackle football >> Really? >> Yep. >> Eight years old? >> Yes, my son is eight and he's playing full back right now, I'm very excited, happy father. >> Is he a big boy, like his dad? >> He's going to be bigger, I think, than his father, yes, sir. (both laugh) >> That's awesome. Well, listen, thanks very much, Steven, for coming on theCUBE, it's really a pleasure meeting you. >> That's appreciated, thank you very much. All right, keep it right there everybody. Stu and I will be back with our next guest. We're live from Splunk .conf18, you're watching theCUBE.

>> Narrator: Live from Las Vegas, it's theCUBE. Covering AWS re:Invent 2017. Presented by AWS, Intel, and our ecosystem of partners. >> Welcome back and we're live here in Las Vegas. This is 45,000 people here for Amazon Web Services re:Invent. This is theCUBE's exclusive coverage. I'm John Furrier with my co-host Stu Miniman. And our next guests are Barry Russell, general manager and business development of AWS Marketplace, and John Rooney, Vice President of product management for Splunk, partner of AWS. Also we cover Cube.com, Cube alumnis. Welcome back, good to see you. >> Thank you, it's wonderful to be back. >> So what's it like partnering with AWS? Because you guys got a big mention from Andy Jassy on my interview with him last week, really highlighting Splunk as a partner that's done so well on the platform, in the ecosystem. You guys were called out as just a real success story. Congratulations, what's the secret magic formula? Just can't be making great products? >> No, really, I think the secret formula is really about helping customers, and sort of what do customers need, and getting it to them. And there is this sort of virtuous cycle of the more AWS continues to innovate in how customers can build, deploy, manage services and applications, really build a whole business in the cloud, the more varied visibility needs there are. And that's what we provide. So it's a really good symbiotic relationship. It's a partnership that goes back years and years. I think I was here in 2012 on theCUBE re:Invent that year. And every year, it seems like there is no shortage of services. >> You and Jerry Chen have been on every year of AWS. >> I'm trying to dress better. That first year I wore a black Splunk t-shirt. And my Aunt Merry Jo was really upset. Like, "Can you please dress up?" So I'm wearing a sport jacket and shirt. So doing my best. >> Whatever you do, don't wear a tie. I'm boycotting the tie. >> I'll try not to. Yeah. >> Barry, we've been talking about the engagement and integrations that you've been doing. Talk about Splunk, the category that they're in, and why that's important in the marketplace. >> Yeah, well they've been great at innovating with us. In particular, they offer customers the ability to really deeply analyze what's happening in their environment. And as customers are migrating over, that's been super important for us. As a customer makes a decision to shut down data centers and migrate those application workloads over, they want to understand what's happening in their environment. They want security within that environment. And Splunk has been innovating around that. And for us, they've been a great partner because not only have they offered a traditional machine image-based software. But now they offer Splunk Cloud, which is a SAS based offering. Which we know many enterprise customers are moving to that model. >> What's the Splunk formula for the product? Because I hear there's a lot. And it's been debunked, but I'll bring it up because it's out there in people's minds. Whoa if we partner with Amazon I don't know they might take over our company. So I won't say there's a general fear, but I've heard that before. >> No, no, I think our relationship, again, with Amazon, it is around delivering the best possible service. the best possible products to our customers and we feel like the Amazon platform is, it's obviously best in industry, and best in class. Look around at the people that are here. And our customers are going there in droves. And they're looking at moving workloads. They're looking at starting. I mean, that's the other thing that's great. And the interesting thing, That we heard so much about serverless in the last couple of days and so much about sort of the next paradigm in building applications. That's all because the groundwork's been set in the cloud by Amazon for when the cloud in 2008, 2009, 2010 was all forklift a VM into the cloud and that sort of cloud. Well now we're completely re-architecting. We're really thinking about re-thinking the way applications and services are built. And again, that brings in new changes and challenges in visibility. I think the early, the sort of last decade or so at the early stage of, what were the concerns around the cloud? It's like, well, what about security and what about visibility? Obviously Verner talked today in the keynote about security is job one. Every developer needs to think about security. That's no longer a concern. That's not a blocker for cloud migration. Then obviously you have things like the Kinesis Firehose. All these other sources of information and sources of data so that customers who are moving their workloads to the cloud still have the same and probably better and more manageable visibility then they would have if they were pulling log files off disks in their data center. >> John you mentioned customers going through that transformation. I remember when we first started covering the Splunk conference with theCUBE. It was heavily virtualization environment. I mean, I first came across Splunk from the VMware community and the like. Customers are being pulled and going through those transformations. You mentioned Kinesis, you talk about, I think you've got an announcement for the Alexa for business also. You have a pretty broad spectrum. I mean, Splunk, how do you manage that portfolio internally and with customers? How do you manage the, I wouldn't say old guard for Splunk but you know manage the modernization and all these changes that are happening? >> Well, sort of the mental model for Splunk has always been, we'll go and get your data wherever it is and we'll pull it into Splunk so then you can correlate, visualize, search, and get value out of that data. And in some cases, that data is going to live, again, in the traditional distributed data center environment. Is going to be a log written to disk. There are still some industries where there are still mainframes. I know it seems crazy, but that is still a big piece and that's not necessarily going to go away tomorrow or the next day. But more importantly, I think increasingly, you're going to see, not just a, again, take an existing VM and forklift that into an IS environment. Lets re-architect an entire service. Lets rethink the way that we're delivering value to our customers. Those are the interesting opportunities for us It's a very close partnership with AWS. We're very closely aligned with the teams. So as they think about services, Cloud Trails, and the Kinesis Firehose, and Guard Duty. These things that they realize are valuable to their customers because they are here and their customers ask for it. We have just a good partnership that says, how can we plug in? How can we contribute to that initiative? >> Hey Barry, there's a word that John used that I want to ask you about. It's data. So you know when we interviewed Andy last year I put forth the premise, I think data is going to be the next flywheel for AWS. How does the marketplace look at that? You work with your partners, obviously integrations, the APIs but data is at the center of it. And how do you make sure that you are securing the data? Make sure that only the people have it but that partners can also help customers get more value out of it? >> Well you know all the applications we list in the catalog are put through security tests and we scan the applications themselves, the code, 24 hours a day seven days a week. It's part of the value we add. But working with ISVs like Splunk we also build API integration to services like Kinesis Firehose, like S3, like Aurora, so that customers have the opportunity to move their data over into AWS, which is where it's secure, and then leverage secure software to access and analyze that data. So I think he's exactly right in working in partnership with AWS. There's that connective tissue between a third party software and the native AWS service. >> Where's it go next for you guys? I mean, obviously, I think you're right about this whole partnership thing. Even though I brought that other question up. The growth is so massive. You can innovate with AWS. It's not like you're just partnering with them and putting it in a marketplace and hope someone buys it. There's growth. I think that's the nuance that people don't understand, is that you can do more with AWS. >> Well yeah I mean absolutely. I think the ability to be part of, the same way, again, in the keynote today, we talked about building in security from the get go. You start with security and with functionality. I think the notion of visibility and observability from a data standpoint. If you are building something, how do you know it's working? How can you provide the folks in operational roles and business roles the data and information that they need? So if you bake that in from the beginning, we now have an opportunity for Splunk to rethink our integration points. To rethink how we deliver value to customers. Again if you think about the Splunk origin story, we started with monitoring and troubleshooting in production environments. Right? Obviously, we built the company on that. We drink a lot of free soda in San Francisco based on those use cases. But if you think about now with DevOps and sort of the shift left movement that >> Your chair has grown significantly, big time because more services are available. >> More services are available but also people are rethinking the whole notion of product development and life cycle. And again I think DevOps, in many cases, the accelerant for DevOps has been cloud and obviously the accelerant for cloud has been AWS. >> Alright question for both of you guys because we've been talking about this on theCUBE and I've got Andy coming on in a few hours. We believe there is going to be a renaissance in software development. You mentioned software lifecycle. You can see it here. Verner's keynote about re-imagining architecture. He put the basic architecture slide up from a video streaming company, boxes and lines, normal architecture. Then S3 buckets, it looked completely different. So the question is with all the simplicity now, all this simplification in APIs. This is going to be a real boom for developers. We believe this is going to be a renaissance in software development, because it's not going to be you grandfather's software development lifecycle. Do you believe that, and how do you see software developers evolving? More craft? More artisanship? What do you see? >> I think that the confines of the scope of what a developer did five, ten, fifteen years ago is different. Developers didn't think about security. They didn't care about security. They didn't think about scalability. They didn't think about. What does elasticity of scale look like in my application? I don't know it worked in my dev environment. That now feels archaic. That's like leeches. Nobody does business like that anymore, right? And I think that's where the notion of >> Cloud9 was an impressive demo too. >> Absolutely. >> Things like that are coming down >> Yeah the idea that you have a fully powered IDE that includes interactivity in the cloud. Folks have sort of dreamt of that. If you think about how heavyweight the client based IDE has got to a certain point kind of in the late odds. Everyone went away from that and said nope we're just going to VI everything. I don't want to see, I don't want to plug in. I don't want to download anything. I just want to VI anything. Now it's sort of, we're back to. I have this full set of functionality. I have code completion, and I have all the things I need as a developer to help me. But its completely light weight. It's a service. It's a utility. It's like the faucet. So-- >> Here's what I would say. I would say that for the first time developers are going to have a rich set of options where they can choose how the customer deploys the software. Containers or serverless. API based or SAS. With the consumption model that matches that use case. Hourly, and metered, annual, or multi-year or consumed via an API service. >> It's going top be awesome and creative too. A lot of creativity. Final question because I know both of your companies very well. Both have really strong communities. The role of communities, certainly open source is growing exponentially. We're seeing that with the Linux Foundation and a variety of other places. With the cloud flywheel, with the open source flywheel, we believe communities are going to be very important. You guys both have strong communities, Splunk and AWS. What would you say to folks that aren't thinking about nurturing and building community into their products? >> I would say that our company was built by our early advocates. I mean again, our mission at the end of the day and from the very beginning was our core practitioners, our users. It's a little slightly different now AWS is sort of the classic developer but for us it was the sysadmin, the tier one and tier two SOC analysts and security. How do we help their lives? How do we make their job better? So we have to have an intimate understanding of what problems are they trying to solve? How do we solve that? How do we abstract away, essentially, the high-effort low-value parts of their job? Have the software do that, so they get to the point where their focus is on the. Essentially they get to apply their intellect, their expertise. Then they evangelize for us. So community is one hundred percent essential. It doesn't matter how great the mouse trap is if you are not connecting with people, if you are not making people part of that and allowing people to share ideas. >> So you had a strategy for community out of the gate. >> Yeah I think it's community first. >> Without community you don't get the feedback on how to improve your product. It's that simple. >> That simple, all right. Man, a great conversation. Marketplace is booming. General Manager of the Marketplace, Barry Russell. We got also John Rooney vice president of product marketing at Splunk. Very successful company. Gone from very small niche product, great community, to public company and now taking over the data world. Great to see you, John. Thanks for coming on. Barry, thanks for the commentary. >> Thank you. >> It' theCUBE 45,000 people here live in Vegas for re:Invent. I'm John Furrier and Stu. We'll be back with more coverage after this short break. (upbeat music)

>> Announcer: Live from Washington D. C., it's the CUBE. Covering .conf2017. Brought to you by Splunk. (electronic music) >> Welcome back to the nation's capitol everybody. This is the CUBE, the leader in live tech coverage. And we're here at day two covering Splunk's .conf user conference #splunkconf17, and my name is Dave Vellante, I'm here with with co-host, George Gilbert. As I say, this is day two. We just came off the keynotes. I'm over product orientation today. George, what I'd like to do is summarize the day and the quarter that we've had so far, and then bring you into the conversation and get your opinion on what you heard. You were at the analyst event yesterday. I've been sitting in keynotes. We've been interviewing folks all day long. So let me start, Splunk is all about machine data. They ingest machine data, they analyze machine data for a number of purposes. The two primary use cases that we've heard this week are really IT, what I would call operations management. Understanding the behavior of your systems. What's potentially going wrong, what needs to be remediated. to avoid an outage or remediate an outage. And of course the second major use case that we've heard here is security. Some of the Wall Street guys, I've read some of the work this morning. Particularly Barclays came out with a research note. They had concerns about that, and I really don't know what the concerns are. We're going to talk about it. I presume it's that they're looking for a TAM expansion strategy to support a ten billion dollar valuation, and potentially a much higher valuation. It's worth noting the conference this year is 7,000 attendees, up from 5,000 last year. That's a 40% increase, growing at, or above actually, the pace of revenue growth at Splunk. Pricing remains a concern for some of the users that I've talked to. And I want to talk to you about that. And then of course, there's a lot of product updates that I want to get into. Splunk Enterprise 7.0 which is really Splunk's core analytics platform ITSI which is what I would, their 3.0, which I would call their ITOM platform. UBA which is user behavior analytics 4.0. Updates to Splunk Cloud, which is a service for machine data in the cloud. We've heard about machine learning across the portfolio, really to address alert fatigue. And a new metrics engine called Mstats. And of course we heard today, enterprise content security updates and many several security-oriented solutions throughout the week on fraud detection, ransomware, they've got a deal with Booz Allen Hamilton on Cyber4Sight which is security as a service that involves human intelligence. And a lot of ecosystem partnerships. AWS, DellEMC was on yesterday, Atlassian, Gigamon, et cetera, growing out the ecosystem. That's a quick rundown, George. I want to start with the pricing. I was talking to some users last night before the party. You know, "What do you like about Splunk? "What don't you like about Splunk? "Are you a customer?" I talked to one prospective customer said, "Wow, I've been trying to do "this stuff on my own for years. "I can't wait to get my hands on this." Existing customers, though, only one complaint that I heard was your price is to high, essentially is what they were telling Splunk. Now my feeling on that, and Raymo from Barclays mentioned that in his research note this morning. Raymo Lencho, top securities analyst following software industry. And my feeling George is that historically, "Your price is too high," has never been a headwind for software companies. You look at Oracle, you look at ServiceNow, sometimes customers complain about pricing too high. Splunk, and those companies tend to do very well. What's your take on pricing as a headwind or tailwind indicator? >> Well the way, you always set up these questions in a way that makes answering them easy. Because it's a tailwind in the sense that the deal sizes feed an enterprise sales force. And you need an enterprise sales force ultimately to be pervasive in an organization. 'Cause you can't just throw up like an Amazon-style console and say, "Pick your poison and put it all together." There has to be an advisory, consultative approach to working with a customer to tell them how best to fit their portfolio. >> Right. >> And their architecture. So yes, the price helps you feed that what some people in the last era of enterprise software used to call the most expensive migratory workforce in the world., which is the sales, enterprise sales organization. >> Sure, right. >> But what's happened in the different, in the change from the last major enterprise applications, ERPCRM, and what we're getting into now, is that then the data was all generated and captured by humans. It was keyboard entry. And so there was no, the volumes of data just weren't that great. It was human, essentially business transactions. Now we're capturing data streaming off everything. And you could say Splunk was sort of like the first one out of the gate doing that. And so if you take the new types of data, customer interactions, there are about ten to a hundred customer interactions for every business transaction. Then the information coming out of the IT applications and infrastructure. It's about ten to a hundred times what the customer interactions were. >> Yeah. >> So you can't price the, Your pricing model, if it stays the same will choke you. >> So you're talking about multiple orders of magnitude >> Yes. >> Of more data. >> Yeah. >> And if you're pricing by the terabyte, >> Right. >> Then that's going to cross your customers. >> Right. But here's what I would argue though George. I mean, and you mentioned AWS. AWS is another one where complaints of high pricing. But if, to me, if the company is adding value, the clients will pay for it. And when you get to the point where it becomes a potential headwind, the company, Oracle is a classic at this, will always adjust its pricing to accommodate both its needs as a public organization and a company that has to make money and fund R & D, and the customers needs, and find that balance where the competition can't get in. And so it seems to me, and we heard this from Doug Merritt yesterday, that his challenge is staying ahead of the game. Staying, moving faster than the cloud guys. >> Yeah. >> In what they do well. And to the extent that they do that, I feel like their customers will reward them with their loyalty. And so I feel as though they can adjust their pricing mechanisms. Yeah, everybody's worried about 606, and of course the conversions to subscriptions. I feel as though a high growth, and adjustments to your pricing strategy, I think can address that. What do you think about that? >> It's... It sounds like one of those sayings where, the friends say, "Well it works in practice, "but does it work in theory?" >> No, no. But it has worked in practice in the industry hasn't it? So what's different now? >> Okay. So take Oracle, at list price for Oracle 12C, flagship database. The price per processor core, with all the features thrown in, is something like three hundred thousand, three hundred fifty thousand per core. So you take an average Intel high end server chip, that might have 24 cores, and then you have two sockets, so essentially one node server is 48 times 350. And then of course, Oracle will say, "But for a large customer, we'll knock 90% off that," or something like that. >> Yeah, well exactly. >> Which is exactly what the Splunk guys told me yesterday. But it's-- >> But that's what I'm saying. They'll do what they have to do to maintain the footprint in the customer, do right by the customer, and keep the competition out. >> But if it's multiple orders of magnitude different. If you take the open source guys where essentially the software's free and you're just paying for maintenance. >> (laughs) Yeah and humans. >> Yeah, yeah. >> Okay, that's the other advantage of Splunk, as you pointed out yesterday, they've got a much more integrated set of offerings and services that dramatically lower. I mean, we all know the biggest cost of IT is people. It's not the hardware and software but, all right, I don't want to rat hole on pricing, but that was a good discussion. What did you learn yesterday? You've sat through the analyst meeting. Give us the rundown on George Gilbert's analysis of .conf generally and Splunk as a company specifically. >> Okay, so for me it was a bit of an eye opener because I got to understand sort of, I've always had this feeling about where Splunk fits relative to the open source big data ecosystem. But now I got a sense for what their ambitions are, and what their tactical plan is. I've said for awhile, Splunk's the anti-Hadoop. You know, Hadoop is multiple, sort of dozens of animals with three zookeepers. And I mean literally. >> Yeah. >> And the upside of that is, those individual projects are advancing with a pace of innovation that's just unheard of. The problem is the customer bears the burden of putting it all together. Splunk takes a very different approach which is, they aspire apparently to be just like Hadoop in terms of platform for modern operational analytic applications, but they start much narrower. And it gets to what Ramie's point was in that Wall Street review, where if you take at face value what they're saying, or you've listened just to the keynote, it's like, "Geez, they're in this IT operations ghetto, "in security and that's a La Brea tar pit, "and how are they ever going to climb out of that, "to something really broad?" But what they're doing is, they're not claiming loudly that they're trying to topple the giants and take on the world. They're trying to grow in their corner where they have a defensible moat. And basically the-- >> Let me interrupt you. >> Yeah. >> But to get to five billion >> Yeah. >> Or beyond, they have to have an aggressive TAM expansion strategy, kind of beyond ITOM and security, don't they? >> Right. And so that's where they start generalizing their platform. The data store they had on the platform, the original one, is kind of like a data lake in the sense that it really was sort of the same searchable type index that you would put under a sort of a primitive search engine. They added a new data store this time that handles numbers really well and really fast. That's to support the metrics so they can have richer analytics on the dashboard. Then they'll have other data stores that they add over time. And for each one, you're able to now build with their integrated tool set, more and more advanced apps. >> So you can't use a general purpose data store. You've got to use the Splunk within data. It's kind of like Work Day. >> Yeah, well except that they're adding more over time, and then they're putting their development tools over these to shield them. Now how seamlessly they can shield them remains to be seen. >> Well, but so this is where it gets interesting. >> Yeah. >> Splunk as a platform, as an application development platform on which you can build big data apps, >> Yeah. >> It's certainly, conceptually, you can see how you could use Splunk to do that right? >> And so their approaches out of the box will help you with enterprise security, user, they call it user behavior analytics, because it's a term another research firm put on it, but it's really any abnormal behavior of an entity on the network. So they can go in and not sell this fuzzy concept of a big data platform. They said, they go in and sell, to security operations center, "We make your life much, much easier. "And we make your organization safer." And they call these curated experiences. And the reason this is important is, when Hadoop sells, typically they go in, and they say, "Well, we have this data lake. "which is so much cheaper and a better way "to collect all your data than a data warehouse." These guys go in and then they'll add what more and more of these curated experiences, which is what everyone else would call applications. And then the research Wikibon's done, depth first, or rather breadth first versus depth first. Breadth first gives you the end to end visibility across on prem, across multiple clouds, down to the edge. But then, when they put security apps on it, when they put dev ops or, some future big data analytics apps as their machine learning gets richer and richer, then all of a sudden, they're not selling the platform, because that's a much more time-intensive sale, and lots more of objectives, I'm sorry, objections. >> It's not only the solutions, those depth solutions. >> Yes, and then all of a sudden, the customer wakes up and he's got a dozen of these things, and all of a sudden this is a platform. >> Well, ServiceNow is similar in that it's a platform. And when Fred Luddy first came out with it, it's like, "Here." And everybody said, "Well, what do I do with it?" So he went back and wrote a IT service management app. And they said, "Oh okay, we get it." Splunk in a similar way has these depth apps, and as you say, they're not selling the platform, because they say, "Hey, you want to buy a platform?" people don't want to buy a platform, they want to buy a solution. >> Right. >> Having said that, that platform is intrinsic to their solutions when they deliver it. It's there for them to leverage. So the question is, do they have an application developer kit strategy, if you will. >> Yeah. >> Whether it's low code or even high code. >> Yeah. >> Where, and where they're cultivating a developer community. Is there anything like that going on here at .conf? >> Yeah, they're not making a big deal about the development tools, 'cause that makes it sound more like a platform. >> (laughs) But they could! >> But they could. And the tools, you know, so that you can build a user interface, you can build dashboards, you can build machine learning models. The reason those tools are simpler and more accessible to developers, is because they were designed to fit the pieces underneath, the foundation. Whereas if you look at some of the open source big data ecosystem, they've got these notebooks and other tools where you address one back end this way, another back end that way. It's sort of, you know, you can see how Frankenstein was stitched together, you know? >> Yeah so, I mean to your point, we saw fraud detection, we saw ransomware, we see this partnership with Booz Allen Hamilton on Cyber4Sight. We heard today about project Waytono, which is unified monitoring and troubleshooting. And so they have very specific solutions that they're delivering, that presumably many of them are for pay. And so, and bringing ML across the platform, which now open up a whole ton of opportunities. So the question is, are these incremental, defend the base and then grow the core solutions, or are they radical innovations in your view? >> I think they're trying to stay away from the notion of radical innovation, 'cause then that will create more pushback from organizations. So they started out with a google-search-like product for log analytics. And you can see that as their aspirations grow for a broader set of applications, they add in a richer foundation. There's more machine learning algorithms now. They added that new data store. And when we talked about this with the CEO, Doug Merritt yesterday at the analyst day, he's like, "Yes, you look out three to five years, "and the platform gets more and more broad. "and at some point customers wake up "and they realize they have a new strategic platform." >> Yeah, and platforms do beat products, and even though it's hard sell, if you have a platform like Splunk does, you're in a much better strategic position. All right, we got to wrap. George thanks for joining me for the intro. I know you're headed to New York City for Big Data NYC down there, which is the other coverage that we have this week. So thank you again for coming on. >> Okay. >> All right, keep it right there. We'll be back with our next guest, we're live. This is the CUBE from Splunk .conf2017 in the nation's capitol, be right back. (electronic music)

>> Narrator: Live from Washington D.C., it's theCUBE covering .conf2017 Brought to you by Splunk. (techno music) >> Well, welcome back to Washington D.C. We're at the Walter Washington Convention Center as we wrap up our coverage here of .conf2017. As Dave Vellante joins me, I'm John Walls here at theCUBE, coming to you live from our nation's capital. Joined by Team AWS here. With us we have rather, Ray Zhu rather, who is a senior product manager at AWS. And Roger Barga, who is the general manager of Amazon Kinesis Services. So gentlemen, thanks for being with us, we appreciate the time. >> Absolutely, thank you for the invitation. >> Dave: Oh, you're welcome. >> You bet. Alright, so let's just jump in. The streaming data thing, right? It's just blowing up. What's inspiring that popularity of the Cloud? What's kind of lit that fire and what's going to keep it burning? >> Yeah, I think over time, I think customers really do realize the value that you can get out of by collecting, analyzing, and reacting to data in real time. Cause that really provides a very differentiated experience to their customers, you know, for example you're able to analyze your user behavior data in real time, provide them with a much more engaging experience, much more relevant content. You're able to diagnosis your service, understand your law of data issues in real time, so that when you have an issue, you can fix that right away. So that really provides a very different customer experience. So I think our customers are realizing the value of real time processing, which is why we think streaming data is gaining more and more popularity. And this is why Cloud is all the good stuff that Cloud can offer and tell the customers. It's highly scalable, so you don't need to worry about if it's going to scale later on when I scale my business. It's a matter of sort of like click of a button. We scale the infrastructure for you and we got all the resource ready for you to go on streaming data. We got super, it's very cost effective, right? So that cause we price at very low. As we keep improving the efficiency of running the service, we reduce our cost structure, we return that back to our customers as a price cut. The third thing which I think is super important is agility, right cause you don't need to set up an infrastructure, install any software, make all the configurations. Starting up a Kinesis Stream is like 15 seconds on the average console, you're done. And it really allows the developers, the customers, to move fast and purely focus their resources and effort on the things that really differentiate their customer experience. >> So very AWS like, we love AWS, we're a customer, it's our favorite Cloud. We'll go on record of saying that, you know? (laughs) We're loyal to you guys. Crowd, our Crowd Chat App runs on it, basically run our whole company on Amazon, where we can. >> Roger: Great. >> In 2013, we got the preview of Kinesis. It was a lot of buzz. It was kind of before the whole streaming meme took over. We were talkin' about real time at the time, but so maybe you can take us through the evolution of Kinesis and where we are today. >> I'd be happy to. You know, when we first built Kinesis Stream, what the company was trying to do, is we had all of the AWS billing and metering records coming from all of our services, our EC2 incidences. This was a lot of data that had to be captured. And the way we were doing it was in batch. We were storing this data in S3 buckets. We were starting large EMR jobs up at the end of day actually to aggregate them by the customer account. So say this was your bill for the end of the day. But we had customers that said actually I'd like to know what I'm spending every hour, every few minutes. And frankly that batch processing wasn't scaling. So we had to innovate and create Kinesis Streams as a real time system that was constantly aggregating all of the billing and metering records that were coming in from our customer's accounts. Totalling them in near real time and we presented our customers with a new experience of billing and insights into their billing and even forecasts of what they were spending at any given time. But we had other teams that immediately looked at Kinesis and said hey, we're dealing with real time streaming data and our customers want it delivered and aggregated and provided, so Cloud watch logs and Cloud watch metrics built on top of us. And this was the start of something which continues to this day. Other services are looking at, and even customers, are looking at a Kinesis Stream and saying, that's a really useful abstraction that we can build a new service, a new experience for our customers. And today we have over a dozen AWS and Amazon retail services that build on top of Kinesis Streams as a fundamental abstraction to offer new experiences and new insights as three events. Cloud watch events, there's a host of services, which underneath Kinesis is running, but they're offering unique value building on top of it. Which is why Kinesis today is considered a foundational service and we can't build an AWS region without Kinesis being there for all these other services to build on top of. So that's been exciting to see that kind of adoption, different uses for this fundamental abstraction called a Kinesis Stream. And you know, it's also, and we can talk later about how it's transforming analytics, which is really exciting as well. >> Well, that's a great topic. I mean, why don't we talk about that. And one of the things that we've noted about AWS, and other Cloud providers, is obviously simplicity and delivering as a service is critical. We all know about the complexity of, for instance, the Hadoop Ecosystem And the challenges that a lot of customers have. Delivering that as a service has dramatically simplified their lives. That's why you see so many people going to the Cloud. We've always predicted that is what happened. Maybe talk about that a little bit. And then we can get into the analytics discussion. >> Yeah, so again, customers are always looking at ways to actually get insights into their data to better support their customers, to better understand what's going on in their business. And of course, Hadoop had managed EMR, had been a great benefit, cause customers could move their developers into the analytics that they want to do and not worry about this undifferentiated heavy lifting of operating these services. And the same is true for Kinesis Streams. But we're seeing customers, and if you stop for a moment and think about this, data never loses it's value. It always has it's historical value for machine learning, for understanding trends over time, but the insights that data has are actually very, very perishable and they can actually turn to zero within an hour if you can't extract those insights. That's the unique area where Kinesis Streams has kept adding value to our customers. Giving 'em the ability to get instant insights into what's going on in their business, their customers, their business processes, so they can take action and improve a customer experience, or capitalize on an opportunity. So what we're seeing and the role, I believe, that streaming data, at large, plays is about giving customers real time insights and then business opportunity to improve how they run their business. >> So. >> Go ahead, please. So who's using it? I mean or what's the if there's a sweet spot or a sweet spot for an industry or vertical to use that, I mean, in terms of whether it's in a minute, an hour, or whatever, what would that be? >> Yeah, so today, I'm really pleased to see, because we have watched this evolution since 2014, but today in virtually every market segment, where data is being continuously generated, we have customers that are actually taking advantage of the real time insights that they can get out of that data virtually every market segment. I'll pick a couple of examples which are kind of fun. One is Amazon Game Studios, near and dear to our heart. Now typically games are written, they're completely developed end to end. They're shipped in a box, made available to customers, and they hope that game and the engagement has the outcome that they want. Amazon Games Studios is actually writing that game in near real time ahead of their customers, so they release a new level of the game. They will actually watch the engagement. They'll look at how customers are dying, surviving, how long they're playing. And is it traveling in the direction they want? They stream all of the multi, all of the game data from their players in real time. And they build dashboards so they can see exactly how game play is going. And if they don't like it or they think they can make an improvement, they'll get right online, change the game itself, and re-deploy the game, so the customer experience is actually, within minutes it's being evolved. Another customer I like to talk about is Hertz Publishing. We all like to read. When Hertz started making the transition of their magazines, Cosmopolitan, Car and Driver, from print to digital form, they instrumented it so they could actually watch how long was a customer reading an article, how were their comments trending in Twitter and in Facebook. So they could actually get a sense of engagement with an article. Whether the article should be rebroadcast to other digital channels, other magazines. Should they change the article? Double down and write a new one. So again, they're engagement and then the business metrics by which they measure engagement and readers, readership have all increased because they have that intimate understanding of what's happening in real time. So again, every market segment, where there's data continuously generated, customers are using this to provide a better experience. >> That phrase undifferentiated heavy lifting we first heard it widely in the tech community in 2012 in Andy Jassy's keynote at Reinvent and it's become sort of a mantra. It probably was one well before that inside of AWS. And often times AWS doesn't talk about TCL but it's not the main reason why people go to the Cloud. You emphasized that a lot. And there's all this debate. Oh a cheaper on prem, oh no, Cloud is cheaper. But this idea of essentially eliminating labor that is doing that non-differentiated heavy lifting is something that you guys have really lived and popularized. We see that labor cost shifting from provisioning luns into other areas, up the stack, if you will. Application, digital business, analytics, et cetera. What are you guys seeing, in terms of how organizations, I mean, there's two types of organizations, right, the Cloud native guys who obviously didn't have the resources, but then enterprises that are bringing their business to the Cloud. Where are they shifting that undifferentiated heavy lifting labor towards? >> To. And they are in fact moving it up stream. We think about it very abstractly. You know, operating servers doesn't really bring any special IP that that company possesses to bear. It is about, you know, just managing servers, managing the software on it, figuring our how to scale. These are problems which we are able to take away. And we've often worked with customers and showed them the value of moving to our managed servers. And the excitement from the leadership, from their customers, is like wonderful. That project we couldn't, we aren't able to fund, if we can just onboard here, onto Kinesis for example, or any one of our managed services, then we can immediately move and get that fund project that we really wanted to fund, it would actually be unique value as move them over to that. So they're actually moving upstream as you said. And they're actually leveraging their unique understanding of their industry, their customer, to go ahead and add value there. So it is a distribution and I think in a very productive way. >> I want to ask about the data pipeline. So one of the values that AWS brings is simplification. When I look, however, at the data pipeline, it's very rich. If I look at the number of data services, Kinesis, Aurora, DYNAMO dv, EBS, S3, Glacier, each of these has a programming interface that is, I use the word primitive not in pejorative way but >> Roger: Yes, yes. >> But a deep level, low level. And so the data pipeline gets increasingly complex. There's probably a benefit of that, because I get access to the primitives, but it increases complexity. First of all, is that a fair assertion on my part? And how are your customers dealing with that? >> Be happy to take that one, yeah? >> Sure. >> Okay. >> Yep, so I think from our perspective all these different capabilities and technologies by customer choice. We build these services because our customers ask for them. And we order a wide variety so that people can choose for the developers who want to have full control over the entire staff, they have access to these lower level services. You know as you mentioned a few, DYNAMO dv, Kinesis Stream, S3, but we also build an abstraction layer on top of these different services. We also have a different set of customers asking for simplicity, just doing a specific type of things. I want you guys to take care of all the complexities, I just want that functionality. The example would be services like Kinesis Files, Kinesis Analytics, which is the abstraction layer we put on top. So for customers who are looking for simplicity, we also have these kind of capability for them. So I think at the end of the day, it's customer choice and demand. That's why we have this rich functionality and capabilities at AWS. >> So you guys have already solved that problem essentially, the one that I was sort of putting forth. >> So I won't say, I like Ray's answer. It's about listening to the customer. Cause in many cases if we would have, if we said, hey, we're going to go build a monolithic service that simplifies this, we would potentially disappoint many other customers. Say actually I really do want to have that low level control. >> Right. >> I'm used to having that. But when we hear customers asking for something which we can then translate to a service, we'll build a new service. And we will actually up level it and actually build a simpler abstraction for a targeted audience. So for us it's all about listening to the customers, build what they want, and if it means that we're going to actually bring two or three of our services together to work in concert for our customer, we'd do that in a heartbeat. >> Yeah that low level control also allows you to be presumably maybe not more agile but more responsive to the market demand. Because if you did build that monolithic service, you would essentially be locking yourselves in to a fossilized set of functions and services that you can't easily respond to market conditions. Is that a fair way to think about it? >> That is a fair statement, because basically our customers can look at these API's and together for these various services, realize how to use these API's in concert to get an end and done. And should we have precise feedback on a specific service, we can add a new API or tailor it over time. So it does give us a great deal of agility in working on these individual services. >> So Ray, you're a product guy and you're talking about listening to customers, right? And coming up with products, it's what you do. What are you hearing now? Where do people want to go now? Because I assume you've been in the market place for four years now with this, evolution is (clears throat), excuse me, perpetual, constant, so where do you want to take it? What's the next level or what's percolating in the back of your mind right now? >> Yeah, I think people always looking for different type of tools that they're familiar with or they want to use to analyze these data in real time and provide a differentiated customer experience. A concrete example I want to give is actually why we're here. At the Splunk Conference is at Kinesis we have a service called Kinesis Firehose. Based on customer demand when we launched Kinesis Streams, customers wanted to make sure they had access to data sooner than they used to do, but they want to use the tools they're familiar with. And apparently there's a diverse set of tools different customers want to use. We started with S3 for data lay, kind of storage, we used Reshift as a data warehouse. And overtime we heard from customers say, hey, we want you to use Splunk analyze the data. But we would like to use Kinesis Firehose and suggest a solution. Can you guys do something about it? So actually the two teams got together. We thought it's a strong customer value proposition, great capability for other customers. So we start this partnership. We're here actually earlier this day, today, we made the announcement actually, Kinesis Firehose is going to support Splunk as data of redestinations. And this integration is not in beta program. It's open for public sign up. Just go to the Kinesis Files website. You can sign up, get early access. So basically from today, you can use Kinesis Firehose in real time streaming (mumbles) service to get real data into your Splunk cluster. We're super excited about it. >> And okay, and I can access those Splunk services through the market place or what's the way in which I bring Splunk to? >> Good question. For this integration actually we're just a different version of Splunk. You can run Splunk on AWS using ECT extensions. You can access through the market place. You can have your, you can use native Splunk Cloud, which manage all the servers for you. You can also use Splunk on print in that regard. >> Okay. What have you guys learned since the orig, the first reinvent? I mean, I think, and again, I don't mean this as a pejorative but AWS is pretty dogmatic in its view of the world as you you are very strict (laughs) about your philosophy. But at the same time, as you learn about the enterprise, you've evolved. What have you learned about enterprise customers in that five, seven year journey of really getting intense with the enterprise? >> Yeah, that's a good question. But again, we're dogmatic about we always listen to our customers. We will never deviate from that. It's part of our culture. And the customers need to tell us where they want to go. And I'll tell you when we first started with Kinesis, just to answer your question, it was about low latency. We want to get that answer really fast, cause our ad tech customers are some of our very early customers, so it really was about that that extremely low latency response. As even our customers have started to look at Kinesis as a fundamental abstraction on which to put all of their business data in and now they're telling their customers well you should, if their IT customers within their company, if you want any business data, attach to the stream and pull it out. So now we're seeing less emphasis on low latency and to end processing, but increase request I want to be able to attach a dozen consumers, because this stream is actually supporting my entire enterprise. I want to have security. So we recently released encryption at rest. Our customers are asking for support for a VPC flow logs, which we hope to be talking with you about very soon. So now it's becoming actually very mainstream to actually, for the enterprise, and they want all the enterprise ready features, all the certifications, Fed Rep, Hippa, et cetera. So now we're actually seeing the Kinesis Stream itself being put into the enterprise as a fundamental building block for how they're going to run their business and how they're going to build their applications within the business. >> So that philosophy, I mean, you are customer driven first and there's a lot a, Andy Jassy says, there's a lot of ways to compete. You can be competitive oriented, but we're customer oriented. And I, it's clear, you guys do that. At the same time, customers sometimes don't know what they want, so you have to be good at decoding. >> Roger: Yes. >> If you listen to all your customers, you know, five years ago, they say, well we're not going to put any data in there. Sensitive data in the Cloud. Now everybody has sort of gotten over that. You said, alright, well we have to make it more secure. We have to get, you know, whatever certified, et cetera, et cetera. There's an art to this, listening to customers, isn't there? >> It gets back to one of our leadership principles of we always work customer backwards. We need to understand what they want, what experience they'd like to have. We have to anchor everything on that. But there is this element of invent and simplify. Because our customers may guess at what a solution is, but let's make sure we really understand what they want, what they need, the constraints under which that solution must offer. Then we go back to our engineering teams and other teams and we invent and simplify on their behalf. And we're not done there. We actually then bring these back to customers and in fact, why we're here today, we've spent two days talking to customers but even before this collaboration with Splunk began, we actually brought customers in and it turned out, their customers were often our customers. So we started talking, what is the problem? And we started with the very clear problem stain. And once both of our teams, we've loved working with Splunk, they work very customer backwards, like we do. And together once we understood this is the problem we are trying to address, and we had no preconception about how we're going to do it, but we worked backwards on what it would take to actually get that experience for our customers. And we're actually here beta testing it. And we're going to have a very aggressive two or three month beta test with customers, did we get it right? And we'll refine as well before we actually release it to the customer. So again, that working with the customer, work customer backwards. But invent and simplify on their behalf. Because many Splunk customers weren't aware of Firehose until we explained it to them as a potential solution. They're like ah, that will do it, thank you. >> So very outcome driven. I mean, I know you guys write press releases before you sometimes launch products. Sort of as you say, that's what you mean by working backwards, right? >> Roger: Yes, yes it is. It really is. >> Ray: You're good listeners. >> So far it's worked. (laughter) >> It's always fun at the company, when somebody says I have a customer, the entire room gets quiet and we all start listening. It's actually fun to see that, because that's the magic word. I have a customer and we all want to listen. What do they want? What are they challenged with? Cause that's where the innovation starts from which is exciting to be part of that. >> It's been a great formula, no doubt about that. >> It has, it has. >> Thank you both for being here. Didn't realize it was a big day. So congratulations >> Thank you. >> on your announcement as well. >> Absolutely. >> Ray, Roger, good to see you. >> It's great talking with you. >> Alright, you're watching theCUBE live here from Washington D.C. .conf2017. (techno music)