>> Announcer: Live from Las Vegas, it's theCUBE. Covering Splunk.conf19, brought to you by Splunk. >> Okay, welcome back everyone. We are here inside for Splunk.conf, their 10th-year conference. We've been here seven years. I'm John Furrier, the host. Our next guest is Sherrie Caltagirone, founder and executive director of the Global Emancipation Network, a cutting-edge company and organization connecting different groups together to fight that battle combating human trafficking with the power of data analytics. We're in a digital world. Sherrie, thanks for coming in. >> Thank you so much for having me. >> So love your mission. This is really close to my heart in terms of what you're doing because with digital technologies, there's a unification theme here at Splunk, unifying data sets, you hear on the keynotes. You guys got a shout-out on the keynote, congratulations. >> Sherrie: We did, thank you. >> So unifying data can help fight cybersecurity, fight the bad guys, but also there's other areas where unification comes in. This is what you're doing. Take a minute to explain the Global Emancipation Network. >> Yeah, thank you. So what we do is we are a data analytics and intelligence nonprofit, dedicated to countering all forms of human trafficking, whether it's labor trafficking, sex trafficking, or any of the sub types, men, women, and children all over the world. So when you think about that, what that really means is that we interact with thousands of stakeholders across law enforcement, governments, nonprofits, academia, and then private sector as well. And all of those essentially act as data silos for human trafficking data. And when you think about that as trafficking as a data problem or you tackle it as a data problem, what that really means is that you have to have a technology and data-led solution in order to solve the problem. So that's really our mission here is to bring together all of those stakeholders, give them easy access to tools that can help improve their counter posture. >> And where are you guys based and how big is the organization? What's the status? Give a quick plug for where you guys are at and what the current focus is. >> Yeah, perfect, so I am based in San Luis Obispo, California. We have just started a brand new trafficking investigations hub out at Cal Poly there. They're a fantastic organization whose motto is learn by doing, and so we are taking the trafficking problem and the tangential other issues, so like we mentioned, cyber crime, wildlife trafficking, drugs trafficking, all of this sort of has a criminal convergence around it and applying technology, and particularly Splunk, to that. >> Yeah, and I just want to make a note 'cause I think it's important to mention. Cal Poly's doing some cutting-edge work. Alison Robinson, Bill Britton, who runs the program over there, they got a great organization. They're doing a lot of data-oriented from media analysis, data, big focus there. Cal Poly quite a big organization. >> They are, and they're doing some wonderful things. AWS just started an innovation hub called the DX Hub there that we are a part of, really trying to tackle these really meaty problems here that are very data-centric and technology-centric. And Cal Poly's the best place to do that. >> Great, let's get into some of the details. One of the things around the news, obviously seeing Mark Zuckerberg doing the tour, Capitol Hill, DC, Georgetown, free speech, data. Facebook has been kind of blamed for breaking democracy. At the same time, it's a platform. They don't consider themselves as an editorial outlet. My personal opinion, they are, but they hide behind that platform. So bad things have happened, good things can happen. So you're seeing technology kind of being pigeonholed as bad. Tech for bad, there's also a tech for good. Pat Gelsinger, the CEO of VMware, publicly said technology's neutral. We humans can shape it. So you guys are looking at it from shaping it for good. How are you doing it? What are some of the things that are going on technically from a business standpoint that is shaping and unifying the data? >> Yeah, I mean, it's absolutely certain that technology has facilitated human trafficking and other ills throughout the world. It's a way that people bring their product, in this case, sadly, human beings, to the market to reach buyers, right? And technology absolutely facilitates that. But, as you mentioned, we can use that against them. So actually here at Conf we are bringing together for a first time the partnership that we did with Splunk for Good, Accenture, and Global Emancipation Network to help automatically classify and score risky businesses, content, ads, and individuals there to help not only with mitigating risk and liability for the private sector, whether it's social media giants or if it's transportation, hospitality, you name it, but also help ease the burden of content moderators. And that's the other side of it. So when you live in this space day in and day out, you really exact a mental toll here. It's really damaging to the individual who sits and reads this material and views photos over and over again. So using technology is a way to automate some of those investigations, and the identification of that content could be helpful in a variety of ways. >> In a way, it's a whole other adversary formula to try to identify. One of the things that Splunk, as we've been here at Splunk Conference, they've been about data from day one. A lot of data and then grew from there, and they have this platform. It's a data problem, and so one of the things that we're seeing here is diverse data, getting at more data makes AI smarter, makes things smarter. But that's hard. Diverse data might be in different data sets or silos, different groups. Sharing data's important, so getting that diverse data, how difficult is it for you guys? Because the bad guys can hide. They're hiding in from Craigslist to social platforms. You name it, they're everywhere. How do you get the data? What's the cutting-edge ingestion? Where are the shadows? Where are the blind spots? How do you guys look at that? Because it's only getting bigger. >> Absolutely, so we do it through a variety of different ways. We absolutely see gathering and aggregating and machining data the most central thing to what we do at Global Emancipation Network. So we have a coalition, really, of organizations that we host their scrapers and crawlers on and we run it through our ingestion pipeline. And we are partnered with Microsoft and AWS to store that data, but everything goes through Splunk as well. So what is that data, really? It's data on the open web, it's on the deep web. We have partners as well who look at the dark web, too, so Recorded Future, who's here at Conf, DeepL as well. So there's lots of different things on that. Now, honestly, the data that's available on the internet is easy for us to get to. It's easy enough to create a scraper and crawler, to even create an authenticated scraper behind a paywall, right? The harder thing is those privately held data sets that are in all of those silos that are in a million different data formats with all kinds of different fields and whatnot. So that is where it's a little bit more of a manual lift. We're always looking at new technologies to machine PDFs and that sort of thing as well. >> One of the things that I love about this business we're on, the wave we're on, we're in a digital media business, is that we're in pursuit of the truth. Trust, truth is a big part of what we do. We talk to people, get the data. You guys are doing something really compelling. You're classifying evil. Okay, this is a topic of your talk track here. Classifying evil, combating human trafficking with the power of data analytics. This is actually super important. Could you share why, for people that aren't following inside the ropes of this problem, why is it such a big problem to classify evil? Why isn't it so easy to do? What's the big story? What should people know about this challenge? >> Yeah, well, human trafficking is actually the second-most profitable crime in the world. It's the fastest-growing crime. So our best estimates are that there's somewhere between 20 million and 45 million people currently enslaved around the world. That's a population the size of Spain. That's nothing that an individual, or even a small army of investigators can handle. And when you think about the content that each of those produce or the traffickers are producing in order to advertise the services of those, it's way beyond the ability of any one organization or even, like I said, an army of them, to manage. And so what we need to do then is to be able to find the signal in the noise here. And there is a lot of noise. Even if you're looking at sex trafficking, particularly, there's consensual sex work or there's other things that are a little bit more in that arena, but we want to find that that is actually engaging in human trafficking. The talk that you mentioned that we're doing is actually a fantastic use case. This is what we did with Splunk for Good and Accenture. We were actually looking at doing a deep dive into the illicit massage industry in the US, and there are likely over 10,000 illicit massage businesses in the US. And those businesses, massages and spas, that are actually just a front for being a brothel, essentially. And it generates $2 billion a year. We're talking about a major industry here, and in that is a very large component of human trafficking. There's a very clear pipeline between Korea, China, down to New York and then being placed there. So what we ended up needing to do then, and again, we were going across data silos here, looking at state-owned data, whether it was license applications, arrest filings, legal cases, that sort of thing, down into the textual advertisements, so doing NLP work with weighted lexicons and really assigning a risk score to individual massage businesses to massage therapist business owners and then, again, to that content. So looking, again, how can we create a classifier to identify evil? >> It's interesting, I think about when you're talking about this is a business. This is a business model, this business continuity. There's a supply chain. This is a bona fide, underground, or overt business process. >> Yeah, absolutely, and you're right on that too that it is actually overt because at this point, traffickers actually operate with impunity for the most part. So actually framing it that way, as a market economy, whether it's shadowy and a little bit more in the black market or completely out in the open, it really helps us frame our identification, how we can manage disruptions, who need to be the stakeholders at the table for us in order to have a wider impact rather than just whack-a-mole. >> I was just talking with Sonia, one of our producers, around inclusiveness and this is so obviously a human passion issue. Why don't we just solve it? I mean, why doesn't someone like the elite class or world organization, just Davos, and people just say they're staring at this problem. Why don't they just say, "Hey, this is evil. "Let's just get rid of it." What's the-- >> Well, we're working on it, John, but the good thing is, and you're absolutely right, that there are a number of organizations who are actually working on it. So not just us, there's some other amazing nonprofits. But the tech sector's actually starting to come to the table as well, whether it's Splunk, it's Microsoft, it's AWS, it's Intel, IBM, Accenture. People are really waking up to how damaging this actually is, the impact that it has on GDP, the way that we're particularly needing to protect vulnerable populations, LGBTQ youth, children in foster care, indigenous populations, refugees, conflict zones. So you're absolutely right. I think, given the right tools and technology, and the awareness that needs to happen on the global stage, we will be able to significantly shrink this problem. >> It's classic arbitrage. If I'm a bad guy, you take advantage of the systematic problems of what's in place, so the current situation. Sounds like siloed groups somewhat funded, not mega-funded. This group over here, disconnect between communications. So you guys are, from what I could tell, pulling everyone together to kind of create a control plane of data to share information to kind of get a more holistic view of everything. >> Yeah, that's exactly it. Trying to do it at scale, at that. So I mentioned that at first we were looking at the illicit massage sector. We're moving over to the social media to look again at the recruitment side and content. And the financial sector is really the common thread that runs through all of it. So being able to identify, taking it back to a general use case here from cyber security, just indicators as well, indicators of compromise, but in our case, these are just words and lexicons, dollar values, things like that, down to behavioral analytics and patterns of behavior, whether people are moving, operating as call centers, network-like behavior, things that are really indicative of trafficking. And making sure that all of those silos understand that, are sharing the data they can, that's not overly sensitive, and making sure that we work together. >> Sherrie, you mentioned AWS. Teresa Carlson, I know she's super passionate about this. She's a leader. Cal Poly, we mentioned that. Splunk, you mentioned, how is Splunk involved? Are they the core technology behind this? Are they powering the-- >> They are, yeah, Splunk was actually with us from day one. We sat at a meeting, actually, at Microsoft and we were really just white boarding. What does this look like? How can we bring Splunk to bear on this problem? And so Splunk for Good, we're part of their pledge, the $10 million pledge over 10 years, and it's been amazing. So after we ingest all of our data, no matter what the data source is, whatever it looks like, and we deal with the ugliest and most unstructured data ever, and Splunk is really the only tool that we looked at that was able to deal with that. So everything goes through Splunk. From there, we're doing a series of external API calls that can really help us enrich that data, add correlations, whether it's spatial data, network analysis, cryptocurrency analysis, public records look-ups, a variety of things. But Splunk is at the heart. >> So I got to ask you, honestly, as this new architecture comes into play for attacking this big problem that you guys are doing, as someone who's not involved in that area, I get wow, spooked out by that. I'm like, "Wow, this is really bad." How can people help? What can people do either in their daily lives, whether it's how they handle their data, observations, donations, involvement? How do people get involved? What do you guys see as some areas that could be collaborating with? What do you guys need? How do people get involved? >> Yeah, one that's big for me is I would love to be able to sit in an interview like this, or go about my daily life, and know that what I am wearing or the things that I'm interacting with, my phone, my computer, weren't built from the hands of slave labor. And at this point, I really can't. So one thing that everybody can do is demand of the people that they are purchasing from that they're doing so in a socially viable and responsible way. So looking at supply chain management as well, and auditing specifically for human trafficking. We have sort of the certified, fair-trade certified organic seals. We need something like that for human trafficking. And that's something that we, the people, can demand. >> I think you're on the right track with that. I see a big business model wave where consumer purchasing power can be shifted to people who make the investments in those areas. So I think it's a big opportunity. It's kind of a new e-commerce, data-driven, social-impact-oriented economy. >> Yep, and you can see more and more, investment firms are becoming more interested in making socially responsible investments. And we just heard Splunk announce their $100 million social innovation fund as well. And I'm sure that human trafficking is going to be part of that awareness. >> Well, I'll tell you one of the things that's inspirational to me personally is that you're starting to see power and money come into helping these causes. My friend, Scott Tierney, just started a venture capital firm called Valo Ventures in Palo Alto. And they're for-profit, social impact investors. So they see a business model shift where people are getting behind these new things. I think your work is awesome, thank you. >> Yeah, thank you so much, I appreciate it. >> Thanks for coming on. Congratulations on the shout-out on the keynote. Appreciate it. The Global Emancipation Network, check them out. They're in San Luis Obispo, California. Get involved. This is theCUBE with bringing you the signal from the noise here at .conf. I'm John Furrier, back with more after this short break. (upbeat music)

>> Announcer: Live from Washington D.C., it's the Cube. Covering .conf2017. Brought to you by Splunk. >> Welcome back, here on the Cube along with Dave Vellante, I am John Walls. We're live at .conf2017, as Splunk continues with day two of its get together here the nation's capital, Washington D.C. Home game for me, I love it. Dave's up the road in Boston, so, hey, you had to hit the road a little bit, but not as bad as it can be sometimes for you. >> No, I'll take D.C. over Vegas. Sorry, Vegas. >> Yeah, but you travel a lot, man, you do, you're on the road. Chris Kurtz travels a lot, too. He's come with us from Arizona State University, he's a systems architect out there. Chris, always good to see you, we had a chance to visit last year for the first time. >> Yep. >> A member of the Splunk trust. And a gentleman with quite a diverse background, I mean. You supported Mars missions. As far as the... >> The Spirit and Opportunity. >> Facilitated out in Phoenix. Working now, as you said, at Arizona State, but also the Trust. Let's talk about that a little bit, because there was some conversation yesterday from the keynote stage about expanding that group? >> Absolutely. >> Adding 14 new members. And for a lot of people at home, who might not be familiar with the Splunk trust, talk about the concept and how you put it into practice. >> Absolutely, so, the Splunk trust is the organization that Splunk set up as a community leader, as a community activist. Our, kind of, watch word is, is that, "We're not the smartest people in the room, "but we'll be the most helpful." and, so, our purpose is... >> John: I'm not sure about that first part, too, by the way. >> Thank you, very much. >> John: I think you're short-changing yourself. >> So, our organization preface is we act as members of the community to help direct community people who have issues and help them externally, but also, to help Splunk and what direction they should go. "Hey, we see this pain point from a lot of the customers, "this is something that maybe Splunk should concentrate on." We're often given access to betas or even earlier, or, you know, even potential products. It's, "How should we build this, is this something that "you would use? "Is this something that you would like?" Table data sets was a feature that I worked on for a year, that was released last year. You know, "Is this something that you would use, "is this something that you would want?" and, sometimes, you know, users fall through the cracks in the support system and they don't know how to get support help, or they don't know where to get directed, and we can volunteer and say, you know, "Show them where the Splunk answers group is very powerful." There's an app for that, we can show them Splunkbase and help them when those things fall through the cracks. So, we provide community enrichment and support, but we're not an official representative of Splunk, even though we're appointed by Splunk on a year-to-year basis. >> John: There aren't that many of ya, right? >> Well, there's a couple, 42 this time. And, you serve for a year and it can be renewed each year, you reapply. Or you can be volunteered, you know, somebody else can... >> Nominate you. >> Can nominate for us. And there's no guarantee. We, the members of the trust vote and then that goes to Splunk and Splunk makes the final decision. Some companies allow that, some don't, it depends. ASU is very generous and let's me participate and give them my time to the organization. >> And I said ASU, Arizona State University. >> That's what I was thinking. >> I never fully introduced that, I'm sorry. >> What do you have to do to qualify and what's the hurdle? >> So, be the most helpful person in the room, that's what you need to do to qualify. So you need to be a part... You can't work for Splunk, you have to be a partner or a customer, and you need to give to the community in some way. So, you need to give back to the community. You participate on Answers, which is the online, kind of, self-support forum. You need to speak in the community, maybe run a user group, a lot of us do run the user groups. I run the user group in Arizona. And, you need to be respected amongst the community and, people go, you know, "I want to go to them, "they'll help me or at least get me to the right person." >> Is it predominantly or exclusively technical practitioners, or not necessarily? >> This year, they divided us in to, kind of, organizational units, so there's architects, and practitioner, and developer. So, we're all technical, but, this year we're going to have the ability to focus a little more on a specific area. You know, "What do you do for a living, "what do you do with Splunk? "Do you architect with Splunk internally, "do you just provide Splunk practice? "Are you a Splunk developer that makes apps? "How do you use Splunk on a daily basis?" And, again, there are partners as well. So, Aplura and Defense Point, I think, are both tied with four members a piece. So that's one of those things that, you know, they're going out to individual customers and helping them everyday. >> So, it's really taking this notion of a customer advisory board to a whole another level. I mean, it's not a passive, you know, group of people that, maybe, meets once a year. >> Right. >> It's an ongoing, active, organic institution essentially. >> Absolutely, we have quarterly meetings online and at those meetings a different Splunk, sometimes executives, sometimes product managers or engineering managers, you know, come and speak to us. And it can be anything from, "Hey, we're developing this "internal product and are we interested, you know, "is that useful to you?" Or, "What enhancements do you feel the product need?" Or, you know, "This is a new feature we're working on "to look and feel." I was consulted about the conf logo. "Hey, Chris, you're an average customer, "which of these four logos do you think really, you know, "kind of helps set the mood?" And, you know, did they take my advice? Does it really matter, no, but they were willing to just... I'm not associated, I'm not in the bowels of the company. >> So this isn't your logo over here? >> That is actually the one that I chose. >> Oh, excellent, I would assume so, right. >> Who organizes the quarterly meetings? >> So, the quarterly meetings are organized by Splunk in the community. There's a community group that's underneath Brian Goldfarb, who's the Chief Marketing Officer. So, he organizes the quarterly meetings. He gets to herd all the cats, because we're all across the world. You know, you have to figure out a time zone, you have to figure out where, you have to figure out when. But, most of the time, there's some suggestions. "Hey, you know, the engineering manager "for section x would like to speak." But, sometimes it's like, "Yeah, we would like to talk "to the person in charge of Search Head Clustering," for example. "We see some pain points in the community," or something like that, so, it's wide-ranging. But, you know, we're not just a group to rubber stamp anything that Splunk does, but we're also not a group to just sit there and complain about things we don't like. It's really very much a give and take. Splunk is generous and open enough to give us that access, and we take that very seriously. To be able to help guide Splunk in making their product the best it can be. It's an amazing product, I'm an evangelist, have been since I started using it. But, also, to help the customers. If the customers are having a pain point, we're probably going to hear about that first. >> Dave: When did you start using? >> I've been using Splunk for about five years. And when I started using Splunk at ASU, it had been a 50GB license and they'd just bought another 100GB, and it needed re-working, it needed architecting. So, when I came in, our chief information security officer and our VP for operations are the ones who directed me. And I said, "What do you want to grow for?" And they said, "Architect it for a terabyte, "assume it's going to take us several years to get there." So, I rebuilt the current environment and we architected it for a terabyte and here we are, four-and-a-half, five years later, we're at a terabyte. And, we're still growing and we're looking at Cloud, you know, we're looking at other use-cases. I think the biggest ship for us is that, we talked about this briefly last year, is that I work for John Rome, who's the Deputy CIO for Arizona State, and he's in charge of business intelligence and analytics. So, it is an enterprise application for data at ASU. It is not part of the security office, it's not part of operations, it's not part of depth. Those are all customers. And, so, internally those are customers and I think that's an amazing opportunity to say that, "Those are customers of mine." So, I'm not beholden to, you know, building the system so it's only useful for security, or building it so it's only useful for operations. They're my customers, and we avoid any appearance of, "Oh, I don't want to put my data in a security product. "I don't want to put my data in an operations product." Nobody questions putting their data in the data warehouse, that's the appropriate place for the data to go. So, that's the beauty of the system that we've developed, is they're both customers of mine. >> All right, so let's talk about your work at Arizona State, little bit. I don't know the size now, I'm trying to think of it, a huge... >> Chris: We're the largest single university in the United States. >> Probably what, 60,000-70,000? >> Total enrollment 104-110,000. A lot of that's online, I think we have about 78,000 or more at the main campus. But, we're the single largest university in the U.S. There are groups like the University of California that's larger overall, but not single institution. >> So, you know... >> Massive. >> Big project, yeah. Where are you now, then? What have you been using Splunk for that maybe you weren't last year when you and I had a chance to visit? >> Yeah, so, we started using it as a security product. It was brought in to make security more agile in getting that information from the operations and the networking groups, firewalls was the first thing we were brought in for. Now, we're starting to look at other use-cases, we're starting to look at edge cases. "Are we using it for academic integrity?" So, the very beginning so that we're looking at, "If a student is taking a test, are they the person "taking the test?" We're looking at it to make sure the students' accounts are safe and not compromised. We're looking at rolling out multi-factor to the university and being able to protect that. And, we're taking a lot of those functions and pushing them down to our help desk, so the help desk has all of the tools they need to be able to support the student and take care of their issue on the first call. That's really important, we have an amazing help desk organization, amazing care organization. And that's the goal is, it doesn't matter how long the call takes, you do that on the first call. And Splunk is a key portion of that to be able to provide them with the right information. And they don't have to go and try to get somebody from network engineering just to solve the student problem, they can see what the problem is from the beginning. >> Academic integrity, explain that. >> Yeah, so, you know, I don't think that there's any student who doesn't want to do their own work and do the best possible thing they can. But, sometimes, students get in a position where they need some help and, maybe, that isn't always exactly what they should do. So, you need to make sure that the student is taking the test that they're signed up for, that they didn't have any assistance, especially in online classes. We need to keep our degree important and valid, and, obviously, none of our students want to, but occasionally you find somebody who hasn't done exactly what they're supposed to. And we need to be able to validate that. So, we need to be able to validate that someone did what they said they did or did the work that they said they did. It's just like, nobody wants to plagiarize, but, occasionally it does happen and we need to protect ourselves and protect the students. >> And you can do that with data? >> We can absolutely do. >> You can ensure that integrity, how? Explain that a little bit. >> A little bit, yeah. So, we look at where the student logs in from. If the login routinely from Tempe, Arizona and then, suddenly there's a login from someplace else. Oftentimes, that has nothing to do with academic integrity, that has to do with there is an account compromise. We need to protect the students' personal information, both HIPAA and FIRPA. We need to protect their privacy information, just generally available PII. So we look at when they logged in, where they logged in, how they logged in. Did the how-to factor worked? I think academic integrity is really a much smaller portion of that, I think the more thing is we need to protect those students. So, we look at how they logged in, when they logged in, what type of machine they logged in from. I mean, if you're using a Surface and you've been using a Surface to login for months and then, all of a sudden, you login from an iPhone, you might have gotten a new iPhone, but, you know, you might not have. So, we put all those pieces of information, all those launch together to build a case that, "Do we need to reset this user's password for safety?" >> But I think academic integrity's important from the brand as well, because the consumers of your students, the employers out there, they may be leery of online courses. So, to the extent that you can say, "Hey, we've got this covered, we actually can ensure "that academic integrity through data." That enhances the value of the degree and the ASU brand, right? >> Absolutely, we don't think that any student wants to do anything that they're not supposed to. It does happen, you know. >> But even if it's one, right, or even if it's the perception of the employer that it can happen? >> John: The possibility. >> Yeah, and I think that's a really good point, is that we need to protect that brand and we need to protect the students. I think protecting students is the number one thing, protecting employees is the number one thing. Everything else falls from that. >> Okay, what about other student behaviors? I mean, you're sort of trafficking around campus, maybe, food consumption, dorm living, I mean, all these kinds of things that with sensors or, what have you, you could extract reams of data? >> We're doing a lot of that. We're partnering with Amazon to look at the Amazon Echo and using them in dorms to provide them voice interface. "Echo, where is my next class?" Or, "What time does the Memorial Union open?" Or, "How late can I get a pizza," and that type of thing. We want to build an environment that's not only fun for the students, but very powerful, and uses the latest technology. >> Pricing, I want to talk pricing, all right? I dig for the one little wart in Splunk and it's hard to find. But, I've heard some chirping about pricing because pricing is a function of the volume of data. The data curve is growing, it's reshaping. What are your thoughts? What do you tell Splunk about pricing? >> So, a lot of people say, "Man, Splunk is expensive." And, I don't think Splunk is expensive. Once you've achieved a volume, it's got a good pricing structure. I think that anything that Splunk tries to do to change the pricing model is a bad direction. >> Dave: So you like it the way it is? >> I like it the way it is. I believe that we've made an investment in a perpetual-licensed product and I certainly don't think that what we're spending on it, for a maintenance year is a bad thing. And i think that we get a good value for the product. And we're going to continue to use it for years to come. >> I've always felt, like, "Your price is too high," has never been a deal-breaker for software companies. They've generally navigated through that criticism. And it's been, you know, ultimately an indicator of success more than anything else. But, your point is if the values there, you pay for it. Are you able to find ways to save money using Splunk that essentially pay for that premium? >> Absolutely, so one of the very first things we did with Splunk, is we looked at our employee direct deposit, we talked about this briefly last year. We looked at employee direct deposit and we were being targeted by a Malaysian hacking group who was using phishing emails to phish credentials from us. You know, you send an email that looks very much like a university login and says, "You need to login "and change your password or you're not going to be able "to work in an hour." A lot of employees, especially employees in areas that aren't high tech, you know, in the psychology department, they may fill-in that information and then the hackers login and change their direct deposit. And then the university ends up paying the employee again and eating those costs. Our original use-case was on-the-fly, we saved $30,000 in a single payroll run. Pretty easy to pay for Splunk when you do that. And so, that was our very original use-case. And that came from just looking at the data. "Is this useful, where are these people logging in from?" There's a change, you know, and I think that that's very important. The thing I love about Splunk is, because it's schema on demand, because there's no hard schema, and that it's use-case on demand. Is that, every single good use-case in the very beginning was standing around the water cooler, having a drink and saying, "I wonder if combine data set A, "we combine data set B, we come up with something that "nobody was asking about." And now when we something that we can help fix, we can help grow, we can make more efficient. To the question of how you deal with all that data is, you tune, you decide what data is important, you decide what data is unimportant, you clean up the logs that you don't care about. And we spent a year, we didn't buy Splunk for one year, we didn't buy a new license, or didn't buy an expansion license, because we took a year to compact and say, "Okay, all the data we're getting "from this firewall, is that all necessary, "is there anything redundant?" "Does it have redundant dates, does it have redundant "time stamps, et cetera." >> Right. >> And I pulled that information out and that just gave us a little bit of breathing room, and then we're going to turn around and take another chunk. >> Help. >> No schema on right sounds icky but it's profound. >> You mentioned the word, help, again, big word, key word. Chris Kurtz, one of the most helpful guys in the community of the Splunk. >> Thank you very much. >> Thanks for being with us, Chris Kurtz. Back with more, Dave and I are going to take a short break, about a half-hour, we'll continue our coverage here live at .conf2017. (upbeat music)

>> Announcer: Live from Washington, DC it's theCUBE. Covering .conf2017. Brought to you by Splunk. >> Welcome back here on theCUBE we continue our coverage of .conf2017 here at the Splunk event with about seven thousand plus Splunkers. Along with Dave Vellante, John Walls. I like that Splunkers. >> You a Splunker? >> Not sure I'd be qualified. >> I'm learning how. >> I'm not qualified. >> to be come one. >> I don't think. >> I think we're kind of in the cheap seats of Splukism right now. Certainly there's a definitely vibe and I think that there's this whole feeling of positivity amongst our community right, that is to get a sense of that here. >> Dave: Hot company, data centers booming. >> It's all happenin', so we are in the Walter Washington Convention Center day two of the convention. We're joined now by of Stephen Hunt who is the CIO of an organization called Team Rubicon. Stephen thanks for joining us here on theCUBE. Good to have you Sir. >> Thank you for having me. >> And CTO too correct? >> And CTO. >> So first off let's talk about Team Rubicon. Veterans based organization, you team up with disaster emergency responders, first responders, to come in a crisis management times of disasters I'm sure extremely busy right now. Gave birth to this organization back in 2010 after the Haiti earthquakes. So tell us a little bit more about your mission and what you're doing now I assume you're up to your ears and all kinds of work, unfortunately. >> Yeah so our, just speaking to our mission, our purpose is to leverage the skills a military vets and first responders in disaster. The capacity and skills that vets bring after active duty in the in the services, is remarkable resource that we've learned to tap to help people in need around the world. This is one of our or this is our busiest time right now. You know we're responding in the greater Houston area in Florida, the Florida Keys, British Virgin Islands, Puerto Rico, Mexico, Turks and Caicos. And it's just it's incredible what we're able to do and in aiding people from the point of search and rescue to recovery and resilience, there's a broad spectrum of activities that are our people engage in to make that all happen and across a diversity of locations. It's been truly remarkable and challenging in ways that we never imagined right now. >> And I should add that you're a veteran yourself. Paratrooper, 82nd Airborne, a reservist, but also have an engineering background MIT Lincoln Laboratories for 20 some plus years. So you've got this interesting combination of experiences that have brought you into a company that is also a beneficiary of the Splunk for Good Program part of the Splunk pledge Program. So are you bring a pretty interesting portfolio to the job here Stephen. >> It's a bit unusual I do understand how a lot of the world works, not because I'm the smartest person in the room, I have a bit of a head start there's a lot of experience there and so bringing my engineering skills to the field, as well as to the business office and how we operate. And working with companies like Splunk, you know I can see, pretty quickly, what's hard, what's easy. I understand that Splunk needs our requirements in order to deliver product that's meaningful to us and our mission. So tying that all together it is a bit unusual for an NGO to have someone like me around. I got involved simply to help people. When they told me at some point are that we're going to build a business to help people, I said I don't come here to build a business. And it took me a little while to get oriented around the fact that as we expand the brand as we bring it around the globe, it takes a strong business model and a strong technical model in how we project humanitarian aid in austere settings. >> In order to scale right. >> So Tell us more about the organization how large is the organization, you know, where do you get the resources, how is it funded. >> So we're almost a 100% privately funded. So corporations, foundations, individual donors from across the country and across the world. We have about sixty thousand members and these are volunteers in and globally, so how in the world do you do that? Well, it turns out we grew up at about the same time the cloud industry grew up, we've been around seven years. And I would like to say that I'm some kind of genius and I said well we should follow the cloud, it was a judgment call and it was what we could manage. Today we have about thirty five to forty cloud software products that drive everything from donor management, volunteer management, how we deal with our beneficiaries, as well as our employees. And and it's not just about product in mission it's about protection and seeing through what's happening at the company at scale. We have about anywhere from eight hundred to 15 hundred people sign up to join, to become a part of Team Rubicon every week. >> Dave: Every week? >> And we couldn't do that without scale, without cloud technology it's been truly remarkable. >> And the volunteers or or all veterans, is that right? >> About 80, 75 to 80% military vets, first responders and others. >> Okay, so they just they make time to take time off from work, or whatever it is and go volunteer. They'll get permission from whom ever. Their employers, their wives and husbands. >> The payment that we provide is a renewed sense of purpose. When you know you take off the uniform there is a certain part of your identity that goes on the hanger and people don't see in you that's missing and we get that back. Through service and being around like minded individuals it's just amazing when we bring all of our people together and they align to work to this common mission. >> So in the in the take a recent examples in Florida and Houston are they predominantly people that are proximate to those areas? Are you are you having to fly people in, how does that all work? We literally have people coming in from all over the world. Generally, with the way we run operations to keep them cost effective as we look first within 450 miles of an affected area, and and bring in people in close proximity. If there is need greater than that, then we expand the scope of the distance if you will. Logistically, where we bring folks in. we're all the way now to bring in people from Australia, Norway, Canada, as well as the UK and working alongside each other seamlessly and that's really due to our standards and training. You can imagine when we scale it's not just the technology but it's how you use it, in the field, and in the business environment in the office. >> Are they responsible for figuring out where they sleep, where they eat, I mean how does that all work. >> Yeah, we set that up, in the early days we kind of took care of it ourselves, you know we reach into our own pockets and the small groups run around the planet and help people. It was kind of a club, now it's a whole different story. When we're bringing in 500 people a day, we need to know how they're fed, is this safety, security and protection, not just physically, but also emotionally. You want to make sure that we're really looking after people before, during and after they deploy and help people. So we put them up, and typically it's not the Ritz, you know might be a cot in a warehouse somewhere. But I've stayed at hotels with Team Rubicon members and maybe sometimes eight in the room. My old job Wasn't like that, all these guys are fighting to see who's going to sleep on the floor. I mean it's it's a really interesting you know. >> You have very different dynamic I'm sure. So you talk about these global operations expanding what four or five countries you mentioned with thoughts of one larger. I know communications are huge part of that you have a partnership now with a a prominent satellite firm you know in Inmarsat and how is that coming to benefit your operations and does Splunk come in the play with that global communications opportunity? >> Inmarsat and Splunk have been truly remarkable impacting and working toward greater impact in how we deliver aid around the globe. And make a couple of very clear points and deliver a metric here. We're running maybe 15 simultaneous operations distributed across all those areas I just discussed earlier. And historically, in all the time that I've been with Team Rubicon we've always had outages when it comes to communicating with our staff in these austere settings. You know we have to life safety is everything. That's the most important thing on my list, is the welfare of the people I'm looking after, and our employees, volunteers and our beneficiaries. When we can't communicate if something goes wrong it's a problem Inmarsat has set us up with communications gear in such a way that even though running all these operations at our most challenging time, I haven't had one complaint. About not being able to communicate. And what's Splunk is doing, is integrating with the Inmarsat backend to provide us the status of all of that equipment and and so from a perspective where are they all located, what is the status of the you know the data usage to make sure that somebody doesn't get arbitrarily shut off, you know that strategic view of what's happening across the globe. And this was something that we've negotiated or Inmarsat asked us to do, and Splunk is stepping up to take care of that for us so that we can ensure life safety and coordination happen seamlessly. Just one more point about this, if you could communicate with everyone everyday you're planning team isn't sitting idle wondering what it needs to do next. So this tertiary effect, is really driven our planning team to perform in a way that guides material and resources that I didn't really think about, But it's quite remarkable. >> So, you please, I thought you finished, I apologize. >> No, it's OK. >> I'm excited. >> It's fantastic. >> So the tech let's get into the tech side of this. You got SaaS apps, you got logistics, you got comms, you got analytics stuff, you got planning, you got collaboration and probably a hundred other things that I haven't mentioned. Maybe talk about you put your CTO hat on. >> Oh no, absolutely, so one of the things I say to our people, you know the technology is important but people are more important. And and so how we work with technology, its adoption as a CIO is critical. I need to say that when we're provided quality top tier software technologies to support education and training, as I mentioned, volunteer management, information management and security. And they were adopted naturally and they take off like a fire on a dry day, it means Splunk and other companies produced a great product. And we've seen this time and again with our ecosystem. So it's a general statement about the cloud technologies. Many companies have just done an exceptional job at building products that our people can work with. So I don't really complain too much about adoption across the board or struggle with it, I should say. So Google, Microsoft, Splunk, Cornerstone OnDemand, Salamander, Everbridge, Palantir. >> Be careful it's like naming the kids you're going to leave somebody out. So many of these great benefactors. >> Yeah, they're used to it but we work with all and our new COO came in, I apologize, I was CIO/CTO of Team Rubicon USA for about three years and I just moved over to Team Rubicon global to help orchestrate our global footprint. And we've set up licensing and a model for where instances of software are located to meet the legal regulatory framework for doing business internationally. And but the the COO of USA, and I'm so proud of what USA is doing right now, it's just blowing up. I mean what they're accomplishing as the largest Team Rubicon entity. But he looked at me, he said, Steve we got to get rid of some of these software products, and I said well, tell me what you don't want to do and I'll delete it, happy to. And instead the numbers gone up by 10 you know since that conversation. So there's some great challenges with and great opportunities, but as you know when your capacity increases, working with data and information your risk also goes up. So we work hard it impacting the behaviors of all of our people, it doesn't happen in a month or two months it takes years. So that everyone is security minded and making good decisions about how we work with information and data, you know whether it's a collective view provided by a product like Splunk which gives us this global view of information. You know if we have people working in a in a dangerous area and all of a sudden we know where all of our people are we just don't post that up on the open internet right. That's a bad idea just to give you a simple example. Down to the PII of our members and employees. And we're becoming very good at that. And for an NGO that's unusual and we're going to be driving an independent security audit fairly soon, to push it even further with the Board of Directors and executives, and so the business team can make decisions about how what we do technically based on you know liability in business model, right for how we work, but for me, the highest priority's protection of everyone. >> Well, it is a wonderful organization and we sincerely Dave and I both thank you for your service, present and future tense, for your service absolutely. Team Rubicon they will accept contributions, both time and treasure so visit the website Team Rubicon and see what you might be able to do to lend help to the cause, great cause that it is. Thank you Stephen. Back with more from .conf2017 here in DC, right after this.

live from san francisco extracting the signal from the noise it's the cute covering oracle openworld 2015 brought to you by oracle now your host John furrier okay welcome back everyone we are here live in San Francisco on Howard Street for oracle openworld special presentation of the cube so looking ankles flagship program we go out to the events and extract the system noise i'm john furrier founder of SiliconANGLE join my next to gas prakash ramamurthy senior vice president systems and cloud management basically management cloud at oracle and mary johnson Turner research vice president enterprise systems management IDC welcome to the cube thank you so I think take my glasses off to read read the intro there but I want to just get your take on it because we just had to admit on Lavery talk about the plowed and one question I didn't get to ask him was a success mark hurry was talk about the pipeline of customers already in motion on the cloud so I wanted to ask him which is great timing for you guys is how do they integrate it which he talked about but then how do they manage if this is a big issue and he you know ease of use is something that he was generally throwing around there so what is the status of the management cloud because that will be a differentiator like security and to end as a differentiator management certainly will be to me not just table stakes it's really differentiated absolutely i think we're here because we're launching it today actually the management cloud and the interesting thing is this which is today if you look at it whether it's on our cloud or on-premise the rate of innovation is very very robust right i mean you have a mobile phone you're seeing your apps getting refresh twice a week or or even faster than that so what it means is you need the next generation monitoring solution that can monitor all of that so our goal with oracle management flower is to help you manage and monitor your solutions independent of where they are deployed if you deploy it on oracle cloud you little come bake with it to be able to monitor it right from the get-go or if you still have it on premise we will allow you to monitor it and break down those data I low so it is very effective so like you said is very very critical that people look at what their challenges are today in terms of proactive monitoring and troubleshooting to get to the next generation solutions we are providing theory I want to ask you a question on the trends but before that I want to just say that one of things i love about doing the oracle shells are six year the cube here is that for an old-timer like me seen the client-server live the client-server Revolution which is now kind of almost a point in time now it's almost it's over now we're into the cloud cloud modern error it's interesting to see because the same same things keep coming up again it's like the platform's the tool is so I got to ask you the question on what is the key trends that are driving this new application space because if you look at the client-server one of the big things that really was huge was the application market mean that would grant it was siloed up by you know by vendors but now with open source this is a huge application boom right now that's gonna impact IT operations sure yeah I think that if you look at it there's been like you said a couple of generations of technology we had mainframes things changed really slow right then we had client server which was to give business units and developers more control and things started to speed up and change a little more quickly but now in our current and cloud native cloud based development real-time microservice open source-based kind of world the rating pays the change is almost constant you're seeing so many organizations that are moving to continuous delivery modes much of it hosted on public cloud or hybrid private public cloud and they're changing features and functions every day and that creates huge management challenges in terms of just trying to understand is the end-to-end application performing effectively are the end-users getting what they need are the business decision-makers really understanding the impact of those outages or upgrades and it's so it's very complex and then I think it's raising the set of requirements for a particular application performance monitoring and IT operations and log analytics I was Oracle addressing these trends because one of the things that people like tonight I'd like to put things into two camps rip and replace okay or evolutionary development and we're clearly on the McCloud evolutionary because Oracle has it's not gonna be it's not gonna go away right so you can say Oracle native is the cloud strategy to all the Oracle customers but yet now with open source there's net new applications that do you got cha vows to 20 years anniversary so there's new stuff going on IOT is a huge application market right now now I can run an IOT thing in the cloud somewhere else or maybe on Amazon or somewhere else but the other day I have run through my operational assistance assistance of engagements this is a record which is Oracle right so is it an Oracle native cloud and the cloud data mean it how do you see oracle addressing that dynamic are they well positioned well i think oracle has a pretty broad portfolio you know they've had again from a management perspective they had Oracle Enterprise Manager on Prem for many many years i think that the new offerings that are being announced today really are interesting that they extend Oracles of monitoring and analytics to a whole range of cloud-based solutions many of which may not necessarily have been born on the Oracle platforms so I think it's a good recognition of the need for heterogeneity and the need to recognize that it is going to be a very hybrid world for many many years so I think that those are all real you know positive factors and then the new releases and it was talking about the integrated pass perform as a service Enchantix connect those environments but on the management side what are you guys delivering because that's going to be the challenge Prakash to talk about the specific things that you guys are announcing and delivering the customers today so specifically we are delivering three services first one is around application performance monitoring that allows our customers to stay ahead of their customers and their problems and give them the best user experience and monitor that and troubleshoot that and then the second service is around managing your logs and extracting IT operational data and business data out of it today if you look at it the most common thing people do with the log is to archive them and put it away because they don't want that to interrupt their production systems but that has a ton of good information so we have that second service eight exhaust becomes gold exactly so today what happens is they just get put away they get archived and that has real nuggets of business information and IT information being able to collect all of that and use it for your rapid troubleshooting as well so that's the second service the set third one is around IT analytics I call those first two services kind of like the Fitbit for your applications you're constantly getting vitals out of it and white throw that away if you don't have an issue still use it to run some interesting capacity friends and forecasting and all of that so use your real data to forecast your IT health as opposed to using a spreadsheet with some random data that you collected in a point in time so that's what we are announcing three services application performance monitoring log analytics and long term trending and forecasting with IT analytic Isis plunks been doing some log files how they were born people's blunt their data exactly they are trying to kind of get into that how do you guys compared to things like splunk and other tools I know tableau is a new relationship that was announced for the data visualization yeah Larry kind of talked about that yesterday talk about that how people are using that data exhaust give me some examples so the most fundamental difference in what we are doing is this which is we do not differentiate the sources of data and the classes of data when we bring it to the cloud so it could be metric data but with that you can collect based on your monitoring your health of your applications which splunk doesn't do for example and then log data but collect all of that and correlate it together so that in essence what we want to do is this which is the enterprise's today don't have a really a data problem they'd have an insight problem which is they want to be able to just see the right amount of data when they have a problem not all the data when they have a problem depends how you look at the data problem they'll have a Jerry problems you define that as they get all this data so you're plenty of data that's the problem there's no dearth of data problem yeah so that's what I'm i know i know i just kind of making this fun was good comment because i like that because that's that is really not an issue the data is coming yeah and that's you know Brandon whole know the problem you guys have scale now with that but the I don't Linux is a big thing I wanna talk about that because it can be problematic I'm a talk to some customers all the time and they say if someone comes in here and sells me another dashboard I'm gonna shoot myself exactly so it's like because and I said what do you mean by that he goes well there's so many alarms going off I don't know what to pay attention to that's where we start to see machine learning from these tools can you share any color what your great wine Larry I'm it's exactly right which is one of the underpinnings for us is to be able to automatically generate baseline and detect anomalies the last thing I mean our product support our own public cloud and I hear from the guys who run the cloud saying don't just give me another alert tell me what I need to do with an alert because I need to be able to disposition the alert so what we want to do is to understand the normal behavior of your application and only alerts you when there's an anomaly okay so that's part of our machine learning and prioritisation learning some learning algorithms in volved understand some pattern recognition that's right things and only tell you what the outlier is and when and and ask determine what the outlier is that suppose you setting thresholds for us to know it because sometimes things change if you are an e-commerce application or the day before Thanksgiving would have a different pattern than the third week of January right me just that the way the world works so what I want to talk to you about Larry made a comment yes in the key no I just like to take a dig at work day but you know in the way he likes work day because you know it's competition and also highlights from the features that Oracle has but what work days actually losing some share to service now a company in here in Silicon Valley that is an itsm IT service management company and they have been very successful their developer program which actually is starting to nibble away at work shares market share because they're building these developers are building these really focused age are apps that is not flat point it's a tool I know like an offense report for example and works really really well but work day has a plethora of features and they don't always have the best in class features uh-huh so that brings up the whole developer angle what do you and you guys have a story there for developers api's how do you talk to the absolutely share absolutely we have a rest api that the developers can use to collect the data from there into their own dashboards if they want to and also for example you can automatically deploy our agents when you're using our Java cloud service so that monitoring gets baked into it so we have api's for both inputting data and torque loud and extracting data back from the cloud will have api's for you to take the events that we generate into your own event dashboard that you have I'm a developer have a team like I could do some stuff filled my own kind of visualization UI and just have JSON endpoints come right into the absolution absolutely maybe I know she smirked when I said service now you will share some insight it's a this dynamic because this is kind of what's happening on the cloud these tools are popping up yeah well yeah and again I think what we're talking about today is to be able to monitor and analyze and optimize a lot of those different tools and deliver them via cloud platform and I think that we are finding that DevOps organizations are very interested in cloud-based solutions that help them do this better cheaper or faster so I think that you know I think it's an opportunity service now has currently been a pioneer in the delivery of system management as a cloud based model and I think it's interesting that Oracle is actually choosing to enter that market in in a different place yeah I mean actually I just a strength and you got the systems of record a on the right and and really talk from your really you know to Prakash this point really focusing on data because managing effectively managing the performance and operation of applications and complex environments it's all it is a huge data problem and you've got data coming from so many sources so many formats and being able to take that in rapidly to transform it normalize it and make it digestible for humans it's something that is really important in these complex environments and yes I think it's going to be interesting to see I think it's a great try or agree with you I think it's a great strategy by focusing on the data you have a lot of range and I wrote a blog post in 2007 now I'm going way back date is a new developer kit and now that's actually happening you look at data people are playing with the data like a developer place with function calls if you will so we're seeing now is a data rich environment hence the not not a problem of having enough data laying around the problem is how do you use the data you're getting all the products yeah inside is a huge problem and that's only an accelerated by faster performance machines in easy-to-use environment like I'd better analytics because you you want if the user knows what the problem is that they're looking for there are a lot of tools that will help you find it yeah but if you do not know what the problem is and to guide them towards the problem is is where where there's real opportunity and there's a real pain point in these enterprises especially now that you and I don't tolerate a downtime so you never cut anybody slack saying oh the website is slow but they've been innovating I'm gonna give them some slack nobody does that yeah yeah so and because now everything is measurable now for the first time in the history of business everything is measurable that's right and that's like just mind-blowing to me but i think is a huge app i only get your thoughts on the application market because I just see a massive tsunami coming of third-party developers and I'm not sure Oracle can handle that I didn't that's my personal opinion counter that I mean I people want to know can Oracle handle an ecosystem of third-party developers absolutely we have shown that before with with Java and I think you see every one of four services having open api's we are coating third-party developers we will be continuing to support them and I think we'll be able to handle it and we need to do that as a part of this ecosystem yeah I mean it's a platform yeah so you have to enable absolutely and that's the open message exactly all right so gosh what's your advice for the people at oracle openworld here and the people watching let's start with the people here on site if they catch this video when are we putting up some snippets before you even get off the set here so one what session should they attend what's where should I get more information what sessions and breakouts and then presentations they goes I have a keynote tomorrow at 11am that I would love for them to attend and outside of that there are some hands-on labs here that they should go look at the products and people who are remote they should go to cloud.oracle.com / management where we have all the services listed and take a look at it and we are really really going to be putting out a very differentiated solution than what is available in the marketplace and I would love for them to check it out and give us feedback for the folks watching online and customers in general when they squint through all the activities a lot of bombs dropping here at Oracle I mean a lot of announcements this is pretty pretty unprecedented what should they look for what are the if you at the point of someone to 11 point data point within your world that's going to get their attention and have them dive in deep what should they look at if they're having issues with their applications today if they're hearing about their application issues first from their customers and not by themselves they should be looking at our solutions to see how they can get ahead of the customers and that's what that's one precise message they can take back