(funky music) >> Live from San Francisco, it's theCube, covering RSA Conference 2019 brought to you by Forescout. >> Hey welcome back everybody Jeff Frick here with theCUBE. We're at the RSA Conference at downtown San Francisco Moscone Center, they finally finished the remodel. We're excited to be in the Forescout booth, we've never been in the Forescout booth before, psyched that they invited us in. But we've got an old time CUBE alumni and a special company in my heart, was my very first CUBE event ever was Splunk.conf 2012. >> I did not know that Jeff. >> Yeah so we're live. We have Doug Merritt on he's a CEO of Splunk. Doug great to see you. >> Thanks Jeff, good to see you again also. >> Yeah so we've been doing Splunk.conf since 2012. >> The early days. The Cosmo Hotel and it was pouring rain that week. >> That was the third year. >> Probably the third year? >> Second year, yeah long time ago, it's grown. >> 2012 wasn't that big but this is a crazy show. You've been coming here for a while. Security is such an important part of the Splunk value proposition, just general impressions of RSA as you've been here for a couple of days. >> Yeah, it's amazing to see how the show has grown over the years, security's gone from this, kind of backwater thing that a few weird people did in the corner, that only understood the cyber landscape, to something that boards care about now. And that, obviously has helped with this show, I don't know what the attendee numbers are like, but tens of thousands of people. >> Oh yeah. >> You can't walk down a hallway without bumping into 10 brand new companies that were launched in the past year, and the security space and make the biggest challenge people that I have, and I think that other people have is, how do you tell different, where's the wheat from the chaff? What is really important in security and how do you tell different companies and different trends apart, so you can actually focus on what matters? >> Right, I just feel for the seed-sows, right, I mean, you guys have a big ecosystem at .conf, but those are all kind of complimentary things around the core Splunk solution. This is, you've got co-opetition, competition, how does somebody navigate so many options? 'Cause at the end of the day you don't have unlimited resources, you don't have unlimited people to try to figure all these pieces of the puzzle out. >> Yeah, and the CSOs have got a really tough job, the average CSO has got well over a hundred different vendors you're dealing with, and with Splunk what we're very focused on, and where I think we add value is that we become, if done right, we become the abstraction layer that creates a brain and nervous system that allows all those different products, and all of them have got unique capabilities. When you think about the complexity of all the networking, all the compute, all the storage, all the end point landscapes that's only getting worse for the cloud, because now there's more services with more varieties across more cloud vendors. How do you get visibility on that? >> Right, right. >> And you need products at those different junctures, 'cause protect and prevent and defend is still an important function for CSOs, but when we know that you can't prevent everything. >> Right. >> And things will go wrong, how do you know that, that is actually occurring? And what the splunk value prop is, we are the, we don't have as much of a point of view on any one product, we aggregate data from all the products, which is why so many people are partners, and then help companies with both raw investigations, given that if something goes wrong with our schema less data structure, but then also with effective monitoring and analytics that's correlating data across those tens, hundreds or thousands of different technologies. So you can get a better feel for what are the patterns that make sense to pay attention to. >> I think you just gave me like 10 questions to ask just in that answer, you covered it all. 'Cause the other thing, you know, there's also IoT now and OT and all these connected devices so, you know the end points, the surface area, the throughput is only going up by orders of magnitude. >> Without a doubt. >> It's crazy. >> I saw some stats the other day that, globally at this point there's, I may get these off by one digit, but lets say there's 80,000 servers that are the backbone of the entire internet. There's already over 11 billion connected devices, going back to that IoT theme. So the ramifications at the edge and what that means are so profound and companies like Forescout, as a key partner of Splunk's, help make sure that you're aware of; what are all the different elements that are ever hitting my network in a way. And what do they look like and what, what should I be doing, as different things pop on and pop off and, again, we're trying to be the interpretation and brain layer for that, so that they are more and more intelligent to the actions they're taking, given their depth of domain, their deep knowledge of what a camera should look like, or what a windows PC should look like or what a firewall should look like given the configurations that are important to that company. >> Before we turned on the cameras you made an interesting comment. We used to talk about schema on read versus schema on write, that was the big, kind of big data theme, and you guys are sitting on a huge data flow, but you had a really kind of different take, because you never really know, even with schema on read it seems you know what the schema is but in today's changing environment you're not really sure what it is you're going to be looking for next right? And that can evolve and change over time, so you guys have kind of modified that approach a little bit. >> Yeah, I think we are this year you'll see us really reemphasizing that core of Splunk. That the reason you'd have an investigative lake, and I don't think most people know what a schema is period, much less read or write so my new terminology is hey you need a very thorough investigative lake. Going back to the discussion we were having, with so much surface area, so many network devices, so many servers, so many end points, what tool do you have that's reading in data from all of those, and they all are going to have crazy formats. The logs around those are not manageable. To say you can manage logs and centralize. Centralized logs I get, manage those words don't work together. >> Right. Logs are chaotic by nature, you're not going to manage them, you're not going to force every developer and every device to adhere to a certain data structure so it can neatly fit into your structured database. >> Right. >> It is too chaotic, but more importantly, even if you could you're going to miss a point, which is, once you structure data, you're limited with the types of questions you can ask, which means you had to visualize what the questions would be in the first place. In this chaotic environment you don't know what the questions going to be. The dynamics are changing way to quickly, so the investigative lake is truly, our index is not schematized in any way, so you can ask a million questions once versus a schematized data store where it is; I ask one question >> A million times. a million times. And that's super efficient for that, but, the uniqueness of Splunk is, the investigative lake is the fabric of what we do, and where I think our customers, almost have forgotten about Splunk is, read all that data in. I know we've got a volume based licensing model that we're working on customers, were working to solve that for you, that's not the, I'm not trying to get data in so that we can charge more, I'm trying to get data in so that everybody has got the capacity to investigate, 'cause we cannot fail in answering what, why, when, where, how, and stuff'll go wrong, if you can't answer that, man you're in big trouble. And then on top of that let's make sure you've got right monitoring capability, the right predictive analytics capability; and now with tools like Phantom, and we bought a company called victorOps, which is a beautiful collaboration tool, let's make sure you've got the right automation and action frameworks so that you can actually leverage peoples skills across the investigative, monitoring and analytical data stores that at Splunk we help with all four of those. >> Right, right, again, you touch on a lot of good stuff. We could go for hours but we don't have you all day. But I want to follow up on a couple of things, because one of the things that we hear over and over and over is the time to even know that you've been breached. The time to know that you have a problem, and again, by having all that data there you can now start adjusting your questions based on that way you now know. But I think what's even more kind of intriguing to me is, as nation states have become more active, as we've seen the politicalization of a lot of things, you know, what is valuable today is a much varied, much more varied answer than just tapping into a bank account or trying to steal credit card numbers. So it really supports, kind of this notion that you're saying, which you don't have a clue what the question is that you're going to need to ask tomorrow. So how do you make sure you're in a position, when you find out what the question is, that you can ask it? >> And that's the design architecture I like about splunk as a company is that our orientation is, if you're dealing with a world of chaos, allow that chaos to exist and then find the needles in the haystack, the meaning from that chaos, and then when you find the meaning, now you know that a monitor is worthwhile, because you've validated root cause and it exists. And when your monitor is kicked a few times, and you know it's legit, build a predictive routine, because you now know it's worth trying to predict, because you've seen this thing trip a number of times, which inverts the way that most people, that all of us were taught. Which is start with the end in mind, because garbage in equals garbage out, so be really thoughtful in what you want and then you can structure everything, it's like well, that's not the way the world works. What if the question we asked 15 years ago was, what if you couldn't start with the end in mind, what would you have to do? Well you'd have to have a schema less storage vehicle and a language that allows you to ask any question you want and get structure on the question, but then you still need a structure. So you're going to structure them one way or the other, how do you make sure you've got high quality structure, and in our dynamic landscape that's always going to change. >> Right, well the good news is 2020 next year so we'll all know everything right? >> Yeah, exactly. >> We'll have the hindsight. So the last thing before I let you go is really to talk about automation, and just the quantity and volume and throughput of these systems. Again, one, escalating, just 'cause it's always escalating, but two, now adding this whole connected devices and IoT, and this whole world of operational technology devices, you just, you can't buy your way out of it, you can't hire your way out of it, you have to have an increasing level of automation. So how are you kind of seeing that future evolve over the next couple of years? >> I've been meeting with a lot of customers obviously this week, and one of them said, the interesting part about where we are now is, you can't unsee what you've seen. And where we were five years ago, as most people in security and IT; which are natively digitized, they still didn't know how to wrap there arms around the data. So they just didn't see it, they were like the ostrich. Now with tools like Splunk they can actually see the data, but now, what do I do with it? When I've got a billion potential events per day, how do I deal with that? And even if I could find enough manpower, the skills are going to be changing at such a constant basis, so I think this security, orchestration, automation, response; SOAR, area and we were fortunate enough to form a great relationship with phantom a couple of years ago and add them to the Splunk fold, exactly a year ago, as, I think, the best of the SOAR vendors, but it's a brand new category. Because companies have not yet had that unseeing moment of, holy cow, what do I do, how do I even deal with this amount of information? And adding in automation, intelligent automation, dynamic automation, with the right orchestration layer is an absolute imperative for these shops going forward, and when I look at a combination of phantom and their competitors there's still less then a thousand companies in a sea of a million plus corporate entities, globally, that have licensed these products. So we're at the very beginning of this portion of the wave. But there's no way that companies will be able to be successful without beginning to understand what that means, and wrapping their minds around how to use it. What we're so excited about with Splunk, is traversing investigate, monitor, analyze and automate up and down continuously, we think is the key to getting the best value from this really, really diverse and chaotic landscape and then having phantom as part of the fold helps a lot, because you can get signal on, did I do the right automation? Did It actually achieve the goal that my brain told me to do, or not? And if not, what do I adjust in the brain? Do I go after different data, do I structure the data a different way? But that up and down the chain of check and balance, am I doing the right stuff is something that-- >> And do it continuously. >> It's got to be continuous. >> It's got to be continuous. So we're sitting in the Forescout booth, so talk about how Forescout plays. I mean you guys have been sitting on those (mumbles), really fundamental core date, they're really kind of been opening up a whole different set of data, so how is that kind of working out? >> Yeah, so I'm really thankful for the relationship, mostly because they're a great company and I love their CEO, but mostly, if you go customer back, it's a very important relationship. Which is the proliferation of devices, developments continues to grow, and most companies aren't even aware of the number of devices that exist in their sphere, much less how they should look, and then what vulnerabilities might exist because of changes in those devices. So the information flow of, here's what's in the eco-sphere of a customer into Splunk is really helpful, and then the correlation that Splunk drives, so that Forescout gets even more intelligent on what corrective actions to what type of actions period do I take across this sea of devices is a really important and beneficial relationship for our customers. >> Excellent, so I'll give you the last word, little plug for Splunk.conf coming up in October. >> Yeah, I'm really excited about conf, excited to have you guys there again. We've been on a really intense innovation march for the past few years. This last conf we introduced 20 products at conf, which was a record. We're trying to keep the same pace for conf 2019 and I hope that everyone gets a chance to come, because we're going to both be, moving forward those products that we talked about, but, I think really surprising people, with some of the directions that were taking, the investigate, monitor, analyze and act capabilities both as a platform and for security IT and our other key buy-in centers. >> Alright, well we'll see you there Doug, thanks for stopping by. >> Thank you, Jeff. >> Great seeing you. >> He's Doug, I'm Jeff, you're watching theCUBE, we're in the Forescout booth at RSA Conference 2019, thanks for watching we'll see ya next time. >> Thank you. (electronic music)

(upbeat music) >> Hi, I'm Lauren Cooney, and welcome back to theCUBE. Today we have Jeff Frick with us, who is the general manager of theCUBE, and we're here to learn about what goes on at theCUBE, what the business is like, some of the most fun aspects of what he does, and go from there. >> Jeff: Great to be here. >> Thank you so much. So, Jeff, starting out, really, when did you join theCUBE, and really what are your goals and aspirations for theCUBE as you look to business going forward now? >> My first CUBE gig was, I've known John for a long, long time, reached out. It was actually Splunk.conf 2012 in the Cosmo, I'll never forget, and they needed an extra host, we were over-subscribed, and I went and did that show. I did it with Jeff Kelley, and was really touched by this format where you've got kind of this professional looking, newsy, opportunity for people to tell their story, most people don't ever get to tell their story in that context, which I thought was pretty cool. And then also just to personalize the people behind the tech because since Steve Jobs, and that genre of people, people want to know who the people are behind the technology. So not only the people that run the companies, but who creates it. I think Open-source had a lot to do with that where people are interested in other people, not just the tech for itself. And that's what I really like. >> You bring up a great point with stories, and luminaries, and visionaries. Can you talk about some of those folks that you've had on theCUBE, some of the best guests you've ever had? >> Oh my gosh, we've had so much. People ask me this all the time, I need to prepare my answer better. But like Scott Cook, from Intuit, was just phenomenal. Tremendously successful, still focused on the same core vision that he came up with when his wife was filling out her checkbook, writing checks, about just a better way to organize and manage cash. And that show is so inspirational because it's really a small business show pretending to be an accounting show. We've had Robert Gates on, I didn't get to interview Robert Gates, but served with many, many President's. We're really fortunate, we often get the keynotes. Fred Luddy, from ServiceNow, phenomenal founder, goofy, quirky. Maria Klawe who runs Harvey Mudd College, goofy, quirky, great personality. So there's just so many great individuals and then some that you don't know. We had, an original ServiceNow we had this little older lady who had got a ServiceNow POC through, it's some ancient company, I don't even remember what company it was, and it was just fascinating to me how this, you know, she wasn't young and hip and new and on top of things, was able to kind of see the vision, get it funded, get a project underway, and then eventually build into being a customer for them. And how she was able to do that, and what was the story, and how many peers out there are curious to know how they could do that for their company. And those, I love those stories. >> Those are great. And I think one of the things that we want to look at too is that we want to understand for the most part what are some of the bloopers that you've seen out there? What are some of the things that you've noticed that are funny or were oh my gosh, you know, while you were on air, while you were thinking about different things. Can you tell me a little bit about that? >> Well, of course, the classic one that we've referenced over and over and over, and if you've seen any of our promos you see, it was John Cleese. Ironically again, at another ServiceNow keynote he was doing their CIO Summit or something, and he came on and he basically decided he wanted to rewrite the end of the, it became a sketch, not an interview. And just stood up and threw his water all over John and Dave, fried Dave's laptop, and marched off the stage. Half the people there, we had a huge live audience, were laughing hysterically. The other half were petrified. Unfortunately, a number of those were the client senior executives who didn't really know, and we had to go out and do some investigation and find out he actually does it a lot to people. And in fact the guys ran into him later that night and he said, "Wasn't that fun, wasn't that fun?" So that's one that just jumps right off the page. Another great one was Michael North from the NFL was at an IBM event talking about how they build the schedule. And while the analytics are fine, and you run an algorithm and it can plug a bunch of numbers, it's really the softer side. You know, how do you leverage at that point a Peyton Manning versus a Tom Brady match up? Do you use it to leverage an existing relationship? Do you use it to build a new network? Do you use it in your feature presentation to get the most leverage from that asset? So a whole lot of kind of soft, softer sided things in terms of the decision making. Which I think is what's really interesting. >> Yeah, I think that's great. And I want to take it a little bit further into what are the business aspects of theCUBE? What do you do on a day to day basis? What are the things that matter the most for running this business? >> Big question. So most important area is our customers. So what customer, what value does theCUBE bring to people when they take us to their conference? >> Lauren: And who are the key customers? >> Well key customers, right. IBM, and we've mentioned ServiceNow, Splunk, EMC, Dell EMC now, Vmware and their ecosystem partners. So a lot of enterprise infrastructure, a lot of opensource, and a lot of applications. But really there's three key components to why people bring theCUBE and what we deliver when we're there. One of them is just great content. The format that we have, the conversational tone, the way that it all works, we just get people to say stuff that you wouldn't ever ask them to say, especially on the customer reference ones. So the content is great and, you know, conferences are looking for more great content. The second really is our community and our distribution. You know we are a media company, we're super active in the community, we leverage a lot of social tools. We try to ask interviews and get information that's topical and evergreen and can be used often and over and over, and really run that out through a number of different channels and different formats. And then the third thing, which we didn't use to talk about as much, but we really do now, it's really the theater of our presence. There's something to bright lights and cameras when theCUBE is at an event. It's like, oh, theCUBE guys are here. And we hear it all the time, theCUBE guys are here. >> Everyone likes to be a star. >> Everybody wants to be a star. And it does a little bit of, I won't say validates for the greater good, but certainly within our community when we're at an event it's a signal that something's going on, something's exciting here, theCUBE guys are here, and we're covering it. And we hear that over and over. We have people stop us literally in an elevator to say, I look at your guys' upcoming sheet to make some decisions as to where I should plan my schedule time. And, or we've also heard, you know, I just wait and watch theCUBE all day, I can't go, I just have theCUBE running in the background. And get a taste of not necessarily what happened in all the breakouts and all the keynotes and all the other stuff, but we generally get all the same people who run all the keynotes. You're getting those same folks, but you're getting them in a conversational tone, talking often about many of the similar topics, it's just a different way to get that message across. >> So how do you grow the community further? So you talk about the community you have, you talk about the community that's at large right now. How are you looking to grow your user base and your community further? >> Right, so it's really kind of along two angles. One is kind of this natural bundling of subsets within our existing community. And that's like our Women in Tech coverage that we started years ago. Honestly, you know things were kind of slowing again in November, so we're like, you know, there's some great women, they're not getting highlighted, let's go out and do some Women in Tech interviews and integrate that. So that's kind of more of a horizontal play if you will. In terms of more vertical plays, we're trying to get a little bit out of the application infrastructure space and more into the app space. So autonomous vehicles, autonomous drones, commercial drones, we've done a lot of just app shows as companies do their own shows versus more of an industry show. So like I said, I mentioned QuickBooks Connect was fun. So really getting into some of these other areas that are more application specific and not just kind of infrastructure, per se which is the roots. >> So when you so application specific, are you looking at for example, you know Microsoft for example is a very large company. They have application space. Is that what you're looking for? >> Love to do some Microsoft shows, yeah, we have a Microsoft build and Ignite, they have a number of shows. >> What about Salesforce? Salesforce is doing some really interesting stuff around applications and community and the whole nine yards. >> Right, so before we didn't really go after Salesforce per se, 'cause it was just really big and we were just really small, we were trying to get a lot of our processes and structure in place. Since then we actually covered one Salesforce lightly a couple years back. A friend of mine, Lynn Voinovich, was a CMO and we covered the kick off. >> I love Lynn. >> You know Lynn? But we need to get back to Salesforce, that's one that we should be at, it's an important show, we should be there. >> Great, so let's have, let's kind of end here with a fun fact. So tell me a fun fact about your job or something that you do that perhaps people don't know about. >> A fun fact about my job. Just, it's just a lot. >> Lauren: Let's make it fun, not a lot of work. >> Basically our job is kind of like the proverbial duck, right? When we run production, we do about a hundred shows a year. There is, I always tell people it's like catering. There's about a thousand details that you kind of have some idea about, and there's a thousand ideas, there's a thousand issues that you have just no control. So being able to dance, being able to be like that proverbial duck that looks smooth, and cool, calm, and collected on top, but it's really pumping pretty hard underneath, you know we've got a lot of people, we've got a lot of back end processes, we have a lot of dancing that happens to try to make it really smooth for the guests, really smooth for the consumer. And we screw up and things happen. But I think we're pretty good, and we're constantly trying to improve our process. >> Great, thank you so much, and thank you for being here again. >> Thank you. >> I really appreciate your time. And we'll be back shortly on theCUBE with something that is coming up in about 15 minutes. (techno music)