Okay. We're back at AWS reinforced 2022. My name is Dave Vellante, and this is the cube we're here in Boston, home of lobster and CDA. And we're here, the convention center where the cube got started in 2010, Shariq Qureshi is here the senior manager at Deloitte and two LL P and merit bear is back on the cube. Good to see >>You guys can't keep me away, >>Right? No. Well, we love having you on the cube shark set up your role at, at Deloitte and toosh what do you actually, what's your swim lane, if you will. >>Yeah, sure. You know, I spend, I wear a lot of hats. I spend a lot of time in the assurance, the controls advisory audit type of role. So I spend our time, a lot of time working with our clients to understand, you know, regulatory requirements, compliance requirements, and then controls that they need to have in place in order to address risks, technology risks, and ultimately business risks. >>So I like to put forth premise, you know, when I walk around a show like this and come up with some observations and then I like to share 'em and then people like me. Well, you know, maybe so help me course correct. My epiphany at this event is the cloud is becoming the first line of defense. The CISO at your customers is now the second line of defense. I think audit is maybe the th third line of defense. Do, do you buy that the sort of organizational layered approach? >>No, because in fact, what we're here to talk about today is audit manager, which is integrated, right? Like if you're doing so the whole notion of cloud is that we are taking those bottom layers of the stack, right? So the concrete floors up through layer for the hypervisor, the, the racks and stacks and HVAC and guards and gates up through the hypervisor, right? Our, our proprietary hardware nitro ecosystem, which has security inheritance is okay upon that. We are then virtualized. Right? And so what we're really talking about is the ways that audit looks different today, that you can reason about what you're doing. So you're doing infrastructure as code. You can do securities code, you can do compliances code, and that's the beauty of it. So like for better, or in your case for worse in your analogy, you know, these are integrated, these are woven together and they are an API call >>Seamless. >>It, it is like easy to describe, right? I mean, like you can command line knowledge about your resources. You can also reason about it. So like, this is something that's embedded, for example, an inspector you can do network reachability know whether you have an internet facing endpoint, which is a PCI, you know, requirement, but that'll be dashboarded in your security hub. So there's the cloud is all the stuff we take away that you don't have to deal with. And also all the stuff that we manage on top of it that then you can reason about and augment and, and take action on. >>Okay. So at the same time you can't automate the audit entirely. Right? So, but, but talk about the challenges of, of, of, of automating and auditing cloud environment. >>Yeah. I mean, when I look at cloud, you know, organizations move to take advantage of cloud characteristics and cloud capabilities, right? So elasticity, scalability is one of them. And, you know, for market conditions, business, business outcomes, you know, resources expand and contract. And one of the questions that we often get as an auditor is how do you maintain a control environment for resources that weren't there yesterday, but are there today, or that are, that are no longer there and that are there today. So how do you maintain controls and how do you maintain security consistently uniformly throughout an audit environment? It's not there. So that's a challenge auditors, you know, historically when you look at the on-prem environment, you have servers that are there, it's a physical, it's a physical box. You can touch it and see it. And if it goes down, then, you know, it's still there. You can hug >>It if you're some people >>It's still there. So, but you know, with, you know, with cloud things get torn down that you don't see. So how do you maintain controls? That's, you know, it, one challenges, it >>Sounds like you're describing a CMDB for audit. >>I mean, that's a, that's an outcome of having, you know, getting good controls of having a CMDB to keep track and have an inventory of your assets. >>But the problem with CMDB is they're out of date, like so, so quickly, is it different in the cloud world? >>Yeah, exactly. I mean, yes. And yes, they are outta date. Cuz like anything static will be manual and imprecise, like it's gonna be, did John go calculate, like go count how many servers we have. That's why I was joking about server huggers versus like virtualizing it. So you put out a call and you know, not just whether it exists, but whether it's been patched, whether it's, you know, like there are ways that we can reason about what we've done, permissioning pruning, you know, like, and these, by the way, correspond to audit and compliance requirements. And so yes, we are not like there, it's not a click of a, whatever, a snap of the fingers, right. It takes work to translate between auditors and us. And it also takes work to have customers understand how they can augment the way that they think about compliance. But a lot of this is just the good stuff that they already need to be doing, right? Knowing internet facing endpoints or whatever, you know, like pruning permissioning. And there's a lot of ways that, you know, access analyzer, for example, these are automated reasoning tools that come from our formal reasoning group, automated reason group that's in identity. Like they, computers can reason about things in ways that are more complex, as long as it can be resolved. It's like EEU utility in mathematics. You don't go out and try to count every prime number. We accept the infinitude of primes to be true. If you believe in math, then we can reason about it. >>Okay. So hearing that there's a changing landscape yeah. In compliance shift from a lot of manual work to one that's much more highly automated, maybe not completely integrated and seamless. Right. But, but working in that direction, right. Yeah. Is that right? And maybe you could describe that in a little bit more detail, how that, you know, journey has progressed. >>I mean, just the fact alone that you have, you know, a lot of services, a lot of companies that are out there that are trying to remove the manual component and to automate things, to make things more efficient. So then, you know, developers can develop and we can be more agile and to do the things that, you know, really what the core competencies are of the business to remove those manual, you know, components to take out the human element and there's a growing need for it. You know, like we always look at security as, you know, like a second class citizen, we don't take advantage of, you know, the, you know, the opportunities that we need to, to do to maintain controls. So, you know, there's an opportunity here for us to look at and, and automate compliance, to automate controls and, and to make things, you know, seamless >>As a fun side benefit, you will actually hopefully have improved your actual security and also retain your workforce because people don't wanna be doing manual processes. You know, they wanna be doing stuff that humans are designed for, which is creative thinking, innovation, you know, creating ways to make new pathways instead of just like re walking these roads that a computer can analyze, >>You mentioned audit manager, what is that? I mean, let's give a plug for the product or the service. What's that all about what problems does it solve? Let's get >>Into that. Yeah. I mean, audit manager is a first of its kind service. You're not gonna find this offered through any other hyperscaler it's specifically geared and tailored towards the second line, which is security and compliance and a third line function, which is internal audit. So what is it looking to do and what is it looking to address some of those challenges working in a cloud space working, and if you have a cloud footprint. So for example, you know, most organizations operate in a multi account strategy, right? You don't just have one account, but how do you maintain consistency of controls across all your accounts? Auto manager is a service that can give, you know, kind of that single pane of view that to see across your entire landscape, just like a cartographer has a map to see, you know, the entire view of what he's designing auto managers does the same thing only from a cloud perspective. So there's also other, you know, features and capabilities that auto managers trying to integrate, you know, that presents challenges for those in compliance those in the audit space. So, you know, most companies, organizations they have, you know, not just one framework like SOC two or GDPR, high trust, HIPAA PCI, you know, you can select an industry accepted framework and evaluate your cloud consumption against, you know, an industry accepted framework to see where you stand in terms of your control posture, your security hygiene, >>And that's exclusive to AWS. Is that what you're saying? You won't find that on any other hyper scale >>And you'll find similarities in other products, but you won't find something that's specifically geared towards the second line and third line. There's also other features and capabilities to collect evidence, which is, I don't see that in the marketplace. >>Well, the only reason I ask that is because, you know, you, everybody has multiple clouds and I would love, I would love a, you know, an audit manager that's, that's span that transcends, you know, one cloud, is that possible? Or is that something that is just not feasible because of the, the, the deltas between clouds? >>I mean, anything's possible with the APIs right now, the way that, you know, you have to ingrain in, right. There's, you know, a, a feature that was introduced recently for audit manager was the ability to pull in APIs from third party sources. So now you're not just looking, looking exclusively at one cloud provider, you're looking at your entire digital ecosystem of services, your tools, your SA solutions that you're consuming to get a full, comprehensive picture of your environment. >>So compliance, risk, audit security, they're like cousins that are all sort of hanging out on the same holiday, but, but they're different. Like what help us understand and squint through those different disciplines. >>Yeah. I mean, each of them have, you know, a different role and a hat to wear. So internal audit is more of your independent arm of management working or reporting directly towards, you know, to the audit committee or to the board to give an independent view on company control and posture security and compliance works with management to help design the, that there that are intended to prevent, detect, or even correct, you know, controls, breakdowns, you know, those action, those action verb items that you wanna prevent unauthorized access, or you wanna restrict changes from making its way into production unless it's approved and, and documented and tracked and so on and so forth. So each, you know, these roles they're very similar, but they're also different in terms of what their function is. >>How are customers dealing with regional differences? You mentioned GDPR, different regulations, data sovereignty, what are the global nuances and complexities that, that, that cloud brings. And how are you addressing those? >>Yeah. Merit, I don't know if you had any thoughts on that one. >>I mean, I think that a lot of what, and this will build off of your response to the sort of Venn diagrams of security and risk and compliance and audit. I think, you know, what we're seeing is that folks care about the same stuff. They care about privacy. They care about security. They care about incentivizing best practices. The form that that takes when it's a compliance framework is by definition a little bit static over time. Whereas security tends to be more quickly evolving with standards that are like industry standards. And so I think one of the things that, you know, all these compliance frameworks have in, in mind is to go after those best practices, the forms that they take may take different forms. You know what I mean? And so I, I see them as hopeful in the motivation sense that we are helping entities get the wherewithal, they need to grow up or mature or get even more security minded. I think there are times that they feel a little clunky, but you know, that's just Frank. Yeah. >>It, it, it can audit manager sort of help me solve that problem. Is that the intent? And I see what you're saying, merit, that there security is at a different pace than, than, you know, GDPR, a privacy, you know, person, >>Right. I mean, like security says, we want this outcome. We want to have, you know, data be protected. The compliance may say, it must be this particular encryption standard. You know what I mean? Like the form I see things taking over time will evolve and, and feels dynamic. Whereas I think that sometimes when we think about compliance and it's exactly why we need stuff like audit manager is to like help manage exactly what articulation of that are we getting in this place at this time for this regulated industry? And like almost every customer I have is regulated. If you're doing business, you're probably in PCI, right. >>And there's never just one silver bullet. So security is, is a number of things that you're gonna do, the number of tools that you're gonna have. And it's often the culture in, in what you develop in your people, your process and technology. So auto manager is one of the components of robust strategy on how to address security. >>But it's also one of those things where like, there are very few entities, maybe Deloitte is one that are like built to do compliance. They're built to do manufacturing, automotive hospitality. Yeah. You know, like they're doing some other industry as their industry. Right. And we wanna let them have less lag time as they make sure that they can do that core business. And the point is to enable them to move our, I mean like sure. I think that folks should move to the pod because of security, but you don't have to, you should move because it enables your business. And this is one of the ways in which it just like minimizes, you know, like whatever our tailwinds lagging or push it anyway, it pushes you. Right. I mean, like it minimizes the lag >>Definitely tailwind. So are you suggesting merit that you can inject that industry knowledge and specificity into things like audit manager and, and actually begin to automate that as, and of course Deloitte has, you know, industry expertise char, but, but, but how should we think about that? >>I mean, you're gonna, you're gonna look at your controls comprehensively a across the board. So if you operate in an industry, you're gonna look to see like, what's, what's important for you. What do you have to, you know, be mindful of? So if you have data residency concerns, you wanna make sure that you've tailored your controls based on the risks that you're addressing. So if there's a framework >>And remember that you can go in the console and choose what region you're, you know, like we never remove your data from your region that you have chosen, you know, like this is, there's an intentionality and an ability to do this with a click of a mouse or with an API call that's, you know, or with a cloud formation template. That's like, there is a deliberateness there. There's not just like best wishes. >>You know, >>ESG is in scope. I presume, you know, helping the CISO become more green, more diverse. Increasingly you're seeing ESG reports come out from major organizations. I presume that's part of the compliance, but maybe not, maybe it hasn't seeped in yet. Are you seeing >>For that? I think it's still a new service auto manager. It's still, you know, being developed, but, you know, continuous feedback to make sure that, you know, we're covering a, a broad range of services and, and, and those considerations are definitely in the scope. Yeah. >>I mean, are you hearing more of that from >>Clients? So, I mean, we have an internal commitment to sustainability, right. That has been very publicly announced and that I'm passionate about. We also have some other native tools that probably, you know, are worth mentioning here, like security hub that does, you know, CIS benchmarking and other things like that are traffic lighted in their dashboard. You know, like there are ways a lot of this is going to be the ways that we can take what might have been like an ugly ETL process and instead take the managed ness on top of it and, and consume that and allow your CISO to make high velocity decision, high velocity, high quality decisions. >>What's the relationship between your two firms? How do you work >>To I'm like we just met. >>Yeah. I sense that, so is it, is it, how do you integrate, I guess is >>A question. Yeah. I mean, I mean, from the audit perspective, our perspective, working with clients and understanding, you know, their requirements and then bringing the service audit manager from the technical aspect and how we can work together. So we have a few use cases, one we've working with the tech company who wanted to evaluate, you know, production workload that had content, you know, critical client information, client data. So they needed to create custom controls. We were working with them to create custom controls, which auto manager would evaluate their environment, which would, you know, there's a reporting aspect of it, which was used to, you know, to present to senior leadership. So we were working together with AWS and on helping craft what those custom controls were in implement at the customer. >>Yeah. I mean, among other things, delight can help augment workforce. It can help folks interpret their results when they get outputs and act upon them and understand industry standards for responsiveness there. I mean, mean like it's a way to augment your approach by, you know, bringing in someone who's done this before. >>Yeah. Cool, cool. Collaboration on a topic that's generally considered, sorry. Don't, don't hate me for saying this boring, but really important. And the fact that you're automating again makes it a lot more interesting guys. Excellent. Thanks for your sharp first time on the cube. Thank you. Absolutely on, appreciate it. Rapidly. Becoming a VIP. Thanks. Coming on. Hey, I'll take it. All right. Keep it right there. Thank you. This is Dave ante for the cube. You're watching our coverage of AWS reinforce 2022 from Boston. We'll be right back.

hi everybody welcome back to boston you're watching thecube's coverage of reinforce 2022 last time we were here live was 2019. had a couple years of virtual merit bear is here she's with the office of the cso for aws merit welcome back to the cube good to see you thank you for coming on thank you so much it's good to be back um yes cso chief information security officer for folks who are acronym phobia phobic yeah okay so what do you do for the office of the is it ciso or sizzo anyway ah whatever is it sim or theme um i i work in three areas so i sit in aws security and i help us do security we're a shop that runs on aws i empathize with folks who are running shops it is process driven it takes hard work but we believe in certain mechanisms and muscle groups so you know i work on getting those better everything from how we do threat intelligence to how we guard rail employees and think about vending accounts and those kinds of things i also work in customer-facing interactions so when a cso wants to meet awssc so that's often me and then the third is product side so ensuring that everything we deliver not just security services are aligned with security best practices and expectations for our customers so i have to ask you right off the bat so we do a lot of spending surveys we have a partner etr i look at the data all the time and for some reason aws never shows up in the spending metrics why do you think that is maybe that talks to your strategy let's double click on that yeah so first of all um turn on guard duty get shield advanced for the you know accounts you need the 3k is relatively small and a large enterprise event like this doesn't mean don't spend on security there is a lot of goodness that we have to offer in ess external security services but i think one of the unique parts of aws is that we don't believe that security is something you should buy it's something that you get from us it's something that we do for you a lot of the time i mean this is the definition of the shared responsibility model right everything that you interact with on aws has been subject to the same rigorous standards and we aws security have umbrella arms around those but we also ensure that service teams own the security of their service so a lot of times when i'm talking to csos and i say security teams or sorry service teams own the security of their service they're curious like how do they not get frustrated and the answer is we put in a lot of mechanisms to allow those to go through so there's automation there are robots that resolve those trouble tickets you know like and we have emissaries we call them guardian champions that are embedded in service teams at any rate the point is i think it's really beautiful the way that customers who are you know enabling services in general benefit from the inheritances that they get and in some definition this is like the value proposition of cloud when we take care of those lower layers of the stack we're doing everything from the concrete floors guards and gates hvac you know in the case of something like aws bracket which is our quantum computing like we're talking about you know near vacuum uh environments like these are sometimes really intricate and beautiful ways that we take care of stuff that was otherwise manual and ugly and then we get up and we get really intricate there too so i gave a talk this morning about ddos protection um and all the stuff that we're doing where we can see because of our vantage point the volume and that leads us to be a leader in volumetric attack signatures for example manage rule sets like that costs you nothing turn on your dns firewall like there are ways that you just as a as an aws customer you inherit our rigorous standards and you also are able to benefit from the rigor with which we you know exact ourselves to really you're not trying to make it a huge business at least as part of your your portfolio it's just it's embedded it's there take advantage of it i want everyone to be secure and i will go to bad to say like i want you to do it and if money is a blocker let's talk about that because honestly we just want to do the right thing by customers and i want customers to use more of our services i genuinely believe that they are enablers we have pharma companies um that have helped enable you know personalized medicine and some of the copic vaccines we have you know like there are ways that this has mattered to people in really intimate ways um and then fun ways like formula one uh you know like there are things that allow us to do more and our customers to do more and security should be a way of life it's a way of breathing you don't wake up and decide that you're going to bolt it on one day okay so we heard cj moses keynote this morning i presume you were listening in uh we heard a lot about you know cool tools you know threat detection and devops and container security but he did explicitly talked about how aws is simplifying the life of the cso so what are you doing in that regard and what's that that's let's just leave it there for now i talk to c sales every day and i think um most of them have two main concerns one is how to get their organization to grow up like to understand what security looks like in a cloudy way um and that means that you know your login monitoring is going to be the forensics it's not going to be getting into the host that's on our side right and that's a luxury like i think there are elements of the cso job that have changed but that even if you know cj didn't explicitly call them out these are beauties things like um least privilege that you can accomplish using access analyzer and all these ways that inspector for example does network reachability and then all of these get piped to security hub and there's just ways that make it more accessible than ever to be a cso and to enable and embolden your people the second side is how csos are thinking about changing their organization so what are you reporting to the board um how are you thinking about hiring and um in the metrics side i would say you know being and i get a a lot of questions that are like how do we exhibit a culture of security and my answer is you do it you just start doing it like you make it so that your vps have to answer trouble tickets you may and and i don't mean literally like every trouble ticket but i mean they are 100 executives will say that they care about security but so what like you know set up your organization to be responsive to security and to um have to answer to them because it matters and and notice that because a non-decision is a decision and the other side is workforce right and i think um i see a lot of promise some of it unfulfilled in folks being hired to look different than traditional security folks and act different and maybe a first grade teacher or an architect or an artist and who don't consider themselves like particularly technical like the gorgeousness of cloud is that you can one teach yourself this i mean i didn't go to school for computer science like this is the kind of thing we all have to teach ourselves but also you can abstract on top of stuff so you're not writing code every day necessarily although if you are that's awesome and we love debbie folks but you know there's there's a lot of ways in which the machine of the security organization is suggesting i think cj was part to answer your question pointedly i think cj was trying to be really responsive to like all the stuff we're giving you all the goodness all the sprinkles on your cupcake not at all the organizational stuff that is kind of like you know the good stuff that we know we need to get into so i think so you're saying it's it's inherent it's inherently helping the cso uh her life his life become less complex and i feel like the cloud you said the customers are trying to become make their security more cloudy so i feel like the cloud has become the first line of defense now the cso your customer see so is the second line of defense maybe the audit is the third line what does that mean for the role of the the cso how is that they become a compliance officer what does that mean no no i think actually increasingly they are married or marriable so um when you're doing so for example if you are embracing [Music] ephemeral and immutable infrastructure then we're talking about using something like cloud formation or terraform to vend environments and you know being able to um use control tower and aws organizations to dictate um truisms through your environment you know like there are ways that you are basically in golden armies and you can come back to a known good state you can embrace that kind of cloudiness that allows you to get good to refine it to kill it and spin up a new infrastructure and that means though that like your i.t and your security will be woven in in a really um lovely way but in a way that contradicts certain like existing structures and i think one of the beauties is that your compliance can then wake up with it right your audit manager and your you know security hub and other folks that do compliance as code so you know inspector for example has a tooling that can without sending a single packet over the network do network reachability so they can tell whether you have an internet facing endpoint well that's a pci standard you know but that's also a security truism you shouldn't have internet facing endpoints you don't approve up you know like so these are i think these can go in hand in hand there are certainly i i don't know that i totally disregard like a defense in-depth notion but i don't think that it's linear in that way i think it's like circular that we hope that these mechanisms work together that we also know that they should speak to each other and and be augmented and aware of one another so an example of this would be that we don't just do perimeter detection we do identity-based fine-grained controls and that those are listening to and reasoned about using tooling that we can do using security yeah we heard a lot about reasoning as well in the keynote but i want to ask about zero trust like aws i think resisted using that term you know the industry was a buzzword before the pandemic it's probably more buzzy now although in a way it's a mandate um depending on how you look at it so i mean you anything that's not explicitly allowed is denied in your world and you have tools and i mean that's a definition if it's a die that overrides if it's another it's a deny call that will override and allow yeah that's true although anyway finish your question yeah yeah so so my it's like if there's if there's doubt there's no doubt it seems in your world but but but you have a lot of capabilities seems to me that this is how you you apply aws internal security and bring that to your customers do customers talk to you about zero trust are they trying to implement zero trust what's the best way for them to do that when they don't have that they have a lack of talent they don't have the skill sets uh that it and the knowledge that aws has what are you hearing from customers in that regard yeah that's a really um nuanced phrasing which i appreciate because i think so i think you're right zero trust is a term that like means everything and nothing i mean like this this notebook is zero trust like no internet comes in or out of it like congratulations you also can't do business on it right um i do a lot of business online you know what i mean like you can't uh transact something to other folks and if i lose it i'm screwed yeah exactly i usually have a water bottle or something that's even more inanimate than your notebook um but i guess my point is we i don't think that the term zero trust is a truism i think it's a conceptual framework right and the idea is that we want to make it so that someone's position in the network is agnostic to their permissioning so whereas in the olden days like a decade ago um we might have assumed that when you're in the perimeter you just accept everything um that's no longer the right way to think about it and frankly like covid and work from home may have accelerated this but this was ripe to be accelerated anyway um what we are thinking about is both like you said under the network so like the network layer are we talking about machine to machine are we talking about like um you know every api call goes over the open internet with no inherent assurances human to app or it's protected by sig v4 you know like there is an inherent zero trust case that we have always built this goes back to a jeff bezos mandate from 2002 that everything be an api call that is again this kind of like building security into it when we say security is job zero it not only reflects the fact that like when you build a terraform or a cloud formation template you better have permission things appropriately or try to but also that like there is no cloud without security considerations you don't get to just bolt something on after the fact so that being said now that we embrace that and we can reason about it and we can use tools like access analyzer you know we're also talking about zero trust in that like i said augmentation identity centric fine grained controls so an example of this would be a vpc endpoint policy where it is a perm the perimeter is dead long live the perimeter right you'll have your traditional perimeter your vpc or your vpn um augmented by and aware of the fine-grained identity-centric ones which you can also reason about prune down continuously monitor and so on and that'll also help you with your logging and monitoring because you know what your ingress and egress points are how concerned should people be with quantum messing up all the encryption algos oh it's stopping created right okay so but we heard about this in the keynote right so is it just a quantum so far off by the time we get there is it like a y2k you're probably not old enough to remember y2k but y2k moment right i mean i can't take you anywhere what should we um how should we be thinking about quantum in the context of security and sure yeah i mean i think we should be thinking about quantum and a lot of dimensions as operationally interesting and how we can leverage i think we should be thinking about it in the security future for right now aes256 is something that is not broken so we shouldn't try to fix it yeah cool encrypt all the things you can do it natively you know like i love talking about quantum but it's more of an aspirational and also like we can be doing high power compute to solve problems you know but like for it to get to a security uh potentially uh vulnerable state or like something that we should worry about is a bit off yeah and show me an application that can yeah and i mean and i think at that point we're talking about homomorphic improvements about another thing i kind of feel the same way is that you know there's a lot of hype around it a lot of ibm talks about a lot you guys talked about in your keynote today and when i really talk to people who understand this stuff it seems like it's a long long way off i don't think it's a long long way off but everything is dog years in tech world but um but for today you know like for today encrypt yourself we will always keep our encryption up to standard and you know that will be for now like the the industry grade standard that folks i mean like i i have i have never heard of a case where someone had their kms keys broken into i um i always ask like awesome security people this question did you like how did you get into this did you have like did you have a favorite superhero as a kid that was going to save the world i um was always the kid who probably would have picked up a book about the cia and i like find this and i don't remember who i was before i was a security person um but i also think that as a woman um from an american indian family walking through the world i think about the relationship between dynamics with the government and companies and individuals and how we want to construct those and the need for voices that are observant of the ways that those interplay and i always saw this as a field where we can do a lot of good yeah amazing merritt thanks so much for coming on thecube great guest john said you would be really appreciate your time of course all right keep it ready you're very welcome keep it right there this is dave vellante for the cube we'll be right back at aws reinforced 2022 from boston keep right there [Music]

(upbeat music) >> Welcome back, everyone. It's theCUBE's coverage here in Las Vegas. I'm John Furrier, your host of theCUBE with re:MARS. Amazon re:MARS stands for machine learning, automation, robotics, and space. Lot of great content, accomplishment. AI meets meets robotics and space, industrial IoT, all things data. And we've got two great guests here to unpack the AI side of it. Manoj Suvarna, Managing Director at AI Ecosystem at Deloitte and Arte Merritt, Conversational AI Lead at AWS. Manoj, it's great to see you CUBE alumni. Art, welcome to theCUBE. >> Thanks for having me. I appreciate it. >> So AI's the big theme. Actually, the big disconnect in the industry has been the industrial OT versus IT, and that's happening. Now you've got space and robotics meets what we know is machine learning and AI which we've been covering. This is the confluence of the new IoT market. >> It absolutely is. >> What's your opinion on that? >> Yeah, so actually it's taking IoT beyond the art of possible. One area that we have been working very closely with AWS. We're strategic alliance with them. And for the past six years, we have been investing a lot in transformations. Transformation as it relate to the cloud, transformation as it relate to data modernization. The new edge is essentially on AI and machine learning. And just this week, we announced a new solution which is more focused around enhancing contact center intelligence. So think about the edge of the contact center, where we all have experiences around dealing with customer service and how to really take that to the next level, challenges that clients are facing in every part of that business. So clearly. >> Well, Conversational AI is a good topic. Talk about the relationship with Deloitte and Amazon for a second around AI because you guys have some great projects going on right now. That's well ahead of the curve on solving the scale problem 'cause there's a scale and problem, practical problem and then scale. What's the relationship with Amazon and Deloitte? >> We have a great alliance and relationship. Deloitte brings that expertise to help folks build high quality, highly effective conversational AI and enterprises are implementing these solutions to really try to improve the overall customer experience. So they want to help agents improve productivity, gain insights into the reasons why folks are calling but it's really to provide that better user experience being available 24/7 on channels users prefer to interact. And the solutions that Deloitte is building are highly advanced, super exciting. Like when we show demos of them to potential customers, the eyes light up and they want those solutions. >> John: Give an example when their eyes light up. What are you showing there? >> One solution, it's called multimodal interfaces. So what this is, is when you're call into like a voice IVR, Deloitte's solution will send the folks say a mobile app or a website. So the person can interact with both the phone touching on the screen and the voice and it's all kept in sync. So imagine you call the doctor's office or say I was calling a airline and I want to change my flight or sorry, change the seat. If they were to say, seat 20D is available. Well, I don't know what that means, but if you see the map while you're talking, you can say, oh, 20D is the aisle. I'm going to select that. So Deloitte's doing those kind of experiences. It's incredible. >> Manoj, this is where the magic comes into play when you bring data together and you have integration like this. Asynchronously or synchronously, it's all coming together. You have different platforms, phone, voice, silo databases potentially, the old way. Now, the new ways integrating. What makes it all work? What's the key to success? >> Yeah, it's certainly not a trivial feat. Bringing together all of these ecosystems of relationships, technologies all put together. We cannot do it alone. This is where we partner with AWS with some of our other partners like Salesforce and OneReach and really trying to bring a symphony of some of these solutions to bear. When you think about, going back to the example of contact center, the challenges that the pandemic posed in the last couple of years was the fact that who's a humongous rise in volume of number of calls. You can imagine people calling in asking for all kinds of different things, whether it's airlines whether it is doctor's office and retail. And then couple with that is the fact that there's the labor shortage. And how do you train agents to get them to be productive enough to be able to address hundreds or thousands of these calls? And so that's where we have been starting to, we have invested in those solutions bringing those technologies together to address real client problems, not just slideware but actual production environments. And that's where we launched this solution called TrueServe as of this week, which is really a multimodal solution that is built with preconceived notions of technologies and libraries where we can then be industry agnostic and be able to deliver those experiences to our clients based on whatever vertical or industry they're in. >> Take me through the client's engagement here because I can imagine they want to get a practical solution. They're going to want to have it up and running, not like a just a chatbot, but like they completely integrated system. What's the challenge and what's the outcome first set of milestones that you see that they do first? Do they just get the data together? Are they deploying a software solution? What's the use cases? >> There's a couple different use cases. We see there's the self-service component that we're talking about with the chatbots or voice IVR solutions. There's also use cases for helping the agents, so real-time agent assist. So you call into a contact center, it's transcribed in real time, run through some sort of knowledge base to give the agents possible answers to help the user out, tying in, say the Salesforce data, CRM data, to know more about the user. Like if I was to call the airline, it's going to say, "Are you calling about your flight to San Francisco tomorrow?" It knows who I am. It leverages that stuff. And then the key piece is the analytics knowing why folks are calling, not just your metrics around, length of calls or deflections, but what were the reasons people were calling in because you can use that data to improve your underlying products or services. These are the things that enterprise are looking for and this is where someone like Deloitte comes in, brings that expertise, speeds up the time to market and really helps the customers. >> Manoj, what was the solution you mentioned that you guys announced? >> Yeah, so this is called Deloitte TrueServe. And essentially, it's a combination of multiple different solutions combinations from AWS, from Salesforce, from OneReach. All put together with our joint engineering and really delivering that capability. Enhancing on that is the analytics component, which is really critical, especially because when you think about the average contact center, less than 10% of the data gets analyzed today, and how do you then extract value out of that data and be able to deliver business outcomes. >> I was just talking to some of the other day about Zoom. Everyone records their zoom meetings, and no one watches them. I mean, who's going to wade through that. Call center is even more high volume. We're talking about massive data. And so will you guys automate that? Do you go through every single piece of data, every call and bring it down? Is that how it works? >> Go ahead. >> There's just some of the things you can do. Analyze the calls for common themes, like figuring out like topic modeling, what are the reasons people are calling in. Summarizing that stuff so you can see what those underlying issues are. And so that could be, like I was mentioning, improving the product or service. It could also be for helping train the agents. So here's how to answer that question. And it could even be reinforcing positive experiences maybe an agent had a particular great call and that could be a reference for other folks. >> Yeah, and also during the conversation, when you think about within 60 to 90 seconds, how do you identify the intonation, the sentiments of the client customer calling in and be able to respond in real time for the challenges that they might be facing and the ability to authenticate the customer at the same time be able to respond to them. I think that is the advancements that we are seeing in the market. >> I think also your point about the data having residual values also excellent because this is a long tail of value in this data, like for predictions and stuff. So NASA was just on before you guys came on, talking about the Artemis project and all the missions and they have to run massive amounts of simulations. And this is where I've kind of seen the dots connect here. You can run with AI, run all the heavy lifting without human touching it to get that first ingestion or analysis, and then iterating on the data based upon what else happens. >> Manoj: Absolutely. >> This is now the new normal, right? Is this? >> It is. And it's transverse towards across multiple domains. So the example we gave you was around Conversational AI. We're now looking at that for doing predictive analytics. Those are some examples that we are doing jointly with AWS SageMaker. We are working on things like computer vision with some of the capabilities and what computer vision has to offer. And so when you think about the continuum of possibilities of what we can bring together from a tools, technology, services perspective, really the sky is the limit in terms of delivering these real experiences to our clients. >> So take me through a customer. Pretending I'm a customer, I get it. I got to do this. It's a competitive advantage. What are the outcomes that they are envisioning? What are some of the patterns you're seeing with customers? What outcomes are they expecting and what kind of high level upside you see them envisioning coming out of the data? >> So when you think about the CxOs today and the board, a lot of them are thinking about, okay, how do you build more efficiency in those system? How do you enable a technology or solution for them to not only increase their top line but as well as their bottom line? How do you enhance the customer experience, which in this case is spot on because when you think about, when customers go repeat to a vendor, it's based on quality, it's based on price. Customer experience is now topping that where your first experience, whether it's through a chat or a virtual assistant or a phone call is going to determine the longevity of that customer with you as a vendor. And so clearly, when you think about how clients are becoming AI fuel, this is where we are bringing in new technologies, new solutions to really push the art to the limit and the art of possible. >> You got a playbook too to do this? >> Yeah, yeah, absolutely. We have done that. And in fact, we are now taking that to the next level up. So something that I've mentioned about this before, which is how do you trust an AI system as it's building up. >> Hold on, I need to plug in. >> Yeah, absolutely. >> I put this here for a reason to remind me. No, but also trust is a big thing. Just put that trustworthy. This is an AI ethics question. >> Arte: It's a big. >> Let's get into it. This is huge. Data's data. Data can be biased from coming in >> Part of it, there are concerns you have to look at the bias in the data. It's also how you communicate through these automated channels, being empathetic, building trust with the customer, being concise in the answers and being accessible to all sorts of different folks and how they might communicate. So it's definitely a big area. >> I mean, you think about just normal life. We all lived situations where we got a text message from a friend or someone close to us where, what the hell, what are you saying? And they had no contextual bad feelings about it or, well, there's misunderstandings 'cause the context isn't there 'cause you're rapid fire them on the subway. I'm riding my bike. I stop and text, okay, I'm okay. Church response could mean I'm busy or I'm angry. Like this is now what you said about empathy. This is now a new dynamic in here. >> Oh, the empathy is huge, especially if you're say a financial institution or building that trust with folks and being empathetic. If someone's reaching out to a contact center, there's a good chance they're upset about something. So you have to take that. >> John: Calm them down first. >> Yeah, and not being like false like platitude kind of things, like really being empathetic, being inclusive in the language. Those are things that you have conversation designers and linguistics folks that really look into that. That's why having domain expertise from folks like Deloitte come in to help with that. 'Cause maybe if you're just building the chat on your own, you might not think of those things. But the folks with the domain expertise will say like, Hey, this is how you script it. It's the power of words, getting that message across clearly. >> The linguistics matter? >> Yeah, yeah. >> It does. >> By vertical too, I mean, you could pick any the tribe, whatever orientation and age, demographics, genders. >> All of those things that we take for granted as a human. When you think about trust, when you think about bias, when you think about ethics, it just gets amplified. Because now you're dealing with millions and millions of data points that may or may not be the right direction in terms of somebody's calling in depending on what age group they're in. Some questions might not be relevant for that age group. Now a human can determine that, but a bot cannot. And so how do you make sure that when you look at this data coming in, how do you build models that are ethically aware of the contextual algorithms and the alignment with it and also enabling that experience to be much enhanced than taking it backwards, and that's really. >> I can imagine it getting better with as people get scaled up a bit 'cause then you're going to have to start having AI to watch the AI at some point, as they say. Where are we in the progress in the industry right now? Because I know there's been a lot of news stories around, ethics and AI and bias and it's a moving train actually, but still problems are going to be solved. Are we at the tipping point yet? Are we still walking in before we crawl or crawling before we walk? I should say, I mean, where are we? >> I think we are in between a crawling or walk phase. And the reason for that is because it varies depending on whether you're regulated industry or unregulated. In the regulated industry, there are compliance regulations requirements, whether it's government whether it's banking, financial institutions where they have to meet Sarbanes-Oxley and all kinds of compliance requirements, whereas an unregulated industry like retail and consumer, it is anybody's gain. And so the reality of it is that there is more of an awareness now. And that's one of the reasons why we've been promoting this jointly with AWS. We have a framework that we have established where there are multiple pillars of trust, bias, privacy, and security that companies and organizations need to think about. Our data scientists, ML engineers need to be familiar with it, but because while they're super great in terms of model building and development, when it comes to the business, when it comes to the client or a customer, it is super important for them to trust this platform, this algorithm. And that is where we are trying to build that momentum, bring that awareness. One of my colleagues has written this book "Trustworthy AI". We're trying to take the message out to the market to say, there is a framework. We can help you get there. And certainly that's what we are doing. >> Just call Deloitte up and you're going to take care of them. >> Manoj: Yeah. >> On the Amazon side, Amazon Web Services. I always interview Swami every year at re:Invent and he always get the updates. He's been bullish on this for a long time on this Conversational AI. What's the update on the AWS side? Where are you guys at? What's the current trends that you're riding? What wave are you riding right now? >> So some of the trends we see in customer interest, there's a couple of things. One is the multimodal interfaces we we're just chatting about where the voice IVA is synced with like a web or mobile experience, so you take that full advantage of the device. The other is adding additional AI into the Conversational AI. So one example is a customer that included intelligent document processing as part of the chatbot. So instead of typing your name and address, take a photo of your driver's license. It was an insurance onboarding chatbot, so you could take a photo of your existing insurance policy. It'll extract that information to build the new insurance policy. So folks get excited about that. And the third area we see interest is what's called multi-bot orchestration. And this is where you can have one main chatbot. Marshall user across different sub-chatbots based on the use case persona or even language. So those things get people really excited and then AWS is launching all sorts of new features. I don't know which one is coming out. >> I know something's coming out tomorrow. He's right at corner. He's big smile on his face. He wouldn't tell me. It's good. >> We have for folks like the closer alliance relationships, we we're able to get previews. So there a preview of all the new stuff. And I don't know what I could, it's pretty exciting stuff. >> You get in trouble if you spill the beans here. Don't, be careful. I'll watch you. We'll talk off camera. All exciting stuff. >> Yeah, yeah. I think the orchestrator bot is interesting. Having the ability to orchestrate across different contextual datasets is interesting. >> One of the areas where it's particularly interesting is in financial services. Imagine a bank could have consumer accounts, merchant accounts, investment banking accounts. So if you were to chat with the chatbot and say I want to open account, well, which account do you mean? And so it's able to figure out that context to navigate folks to those sub-chatbots behind the scenes. And so it's pretty interesting style. >> Awesome. Manoj while we're here, take a minute to quickly give a plug for Deloitte. What your program's about? What customers should expect if they work with you guys on this project? Give a quick commercial for Deloitte. >> Yeah, no, absolutely. I mean, Deloitte has been continuing to lead the AI field organization effort across our client base. If you think about all the Fortune 100, Fortune 500, Fortune 2000 clients, we certainly have them where they are in advanced stages of multiple deployments for AI. And we look at it all the way from strategy to implementation to operational models. So clients don't have to do it alone. And we are continuing to build our ecosystem of relationships, partnerships like the alliances that we have with AWS, building the ecosystem of relationships with other emerging startups, to your point about how do you continue to innovate and bring those technologies to your clients in a trustworthy environment so that we can deliver it in production scale. That is essentially what we're driving. >> Well, Arte, there's a great conversation and the AI will take over from here as we end the segment. I see a a bot coming on theCUBE later and there might be CUBE be replaced with robots. >> Right, right, right, exactly. >> I'm John Furrier, calling from Palo Alto. >> Someday, CUBE bot. >> You can just say, Alexa do my demo for me or whatever it is. >> Or digital twin for John. >> We're going to have a robot on earlier do a CUBE interview and that's Dave Vellante. He'd just pipe his voice in and be fun. Well, thanks for coming on, great conversation. >> Thank you. Thanks for having us. >> CUBE coverage here at re:MARS in Las Vegas. Back to the event circle. We're back in the line. Got re:Inforce and don't forget re:Invent at the end of the year. CUBE coverage of this exciting show here. Machine learning, automation, robotics, space. That's MARS, it's re:MARS. I'm John Furrier. Thanks for watching. (gentle music)

>>Welcome back to the cubes cover dot com. Splunk annual conference >>Virtual this year. I'm john for >>your host of the cube as always we're being the best stories. The best guest to you and the best guest today is the ceo Doug merit of course, Top Dog. It's great to see you. Thanks for coming on to be seen. >>So nice. I can't believe it. We had a whole year without seeing each other. >>I love this conference because it's kind of like a studio taking over a full virtual studio multiple sets, cubes here. You have the main stage, you've got rooms upstairs, tons of virtual interactions. Great numbers. Congratulations. >>Thank you. Thank you. We were, we wanted this to be primarily live where we are live, primarily on site. Um, and we pivoted some private marketing team. How quickly they pivoted and I love the environment they've created as I know next year we will be always have virtual now we've all learned but will be on site, which is great. >>It's good to see kind of you guys telling the story a lot, a lot more stories happening and You know, we've been covering splint since 2012 on the Cube. I think longer than aws there was 2013 our first cube seeing Splunk emerge is the trend has been, it's new, it's got value and you operationalize it for customers. Something new happens. You operationalized for customers and it just keeps on the Splunk way, the culture of innovation. It just seems now more than ever. You guys were involved in security early 2015 I think that was the year we started kind of talking about it your first year and now it just feels like something bigger is right here in front of us. It's and people are trying to figure out multi cloud observe ability. We see that what that's a big growth wave coming. What's the wave that's happening? >>So uh the beauty of Splunk and the kind of culture and how we were born was we have this non structured backbone um what I would call the investigative lake where you just dump garbage into it and then get value out of it through the question asking which means you can traverse anywhere because you're not taking a point of view on the data it's usable all over the place. And that's how we went up in security. As we had the I. T. Systems administrators pinging that thing with with questions. And at that point in time the separate teams were almost always part of the I. T. Teams like hey can we ask questions that thing. It's like yeah go ahead. And also they got value. And then the product managers and the app dev guys started asking questions. And so a lot of our proliferation has been because of the underlying back bonus blank the ability for new people to come to the data and find value in the data. Um as you know and as our users know we have tried to stay very focused on the go to market basis on serving the technical triumphant the cyber teams, the infrastructure management, 90 ops teams and the abdomen devoPS teams and on the go to market basis and the solutions we package that is, we're trying to stay super pure to that. That's $90 billion of total addressable market. We're super excited will be well over three billion an error this year, which is amazing is 300 million when I started seven years ago so that 10 x and seven years is great. But three billion and 90 billion like we're all just getting going right now with those Corbyn centers. The were on top of what sean bison as we tell you about, hey, we've got to continue to focus on multi cloud and edge is really important. Machine learning is important. That the lever that we've been focused on for a long time that we'll continue to gain better traction on is making sure that we've got the right data plane and application platform layer so that the rest of the world can participate in building high quality reusable and recyclable applications so that operate operationalization that we have done officially around cyber it and devops and unofficially on a one off basis for marketing and supply chain and logistics and manufacturing that those other use cases can be packaged repeated, sold and supported by the people that really know those domains because we're not manufacturing experts. It's we're honored that portion BMW are using us to get operational insight into the manufacturing floor. But they lead that we just were there is the technical Splunk people to help bring that to life. But there are lots of firms out there, no manufacturing cold process versus the screed and they can create with these packages. They're appropriate for automotive, automotive versus paint versus wineries versus having that. I think the big Accelerant over the next 10 years response, we gotta keep penetrating our core use cases but it would be allowing our ecosystem and so happy Teresa Karlsson's here is just pounding the table and partners to take the other probably 90% of the market that is not covered by by our core market. >>Yeah, I think that's awesome. And the first time we get to the partner 1st and 2nd the rebranding of the ecosystem as it's growing. But you mentioned you didn't know manufacturing as an example where the value is being created. That's interesting because you guys are enabling that value, their adding that because they know their apps then they're experts. That's where the ecosystem is really gonna shine because if you can provide that enablement this control plane as you mentioned, that's going to feed the ecosystem. So the question I have for you is as you guys have become essentially the de facto control playing for most companies because they were using spring for a lot of other great reasons now you have set them up that way is the pattern to just keep building machine learning apps on top of it or more querying what's the what's the customer next level trends that you're seeing. >>So the two core focus areas that we will stay on top of is enriching that data platform and ensure that we continue to provide better at peace and better interfaces so that when people want to build a really interesting automotive parts, supply chain optimization app that they're able to do that, we've got the right A. P. S. We've got the right services, we've got the right separation between the application of platforms so they can get that done, we'll continue to advance that platform so that there's modernization capabilities and there's advertising capabilities and other pieces that they can make their business. The other piece that will stay very focused on is within the cyber realm within I. T. Ops within devops, ensuring that we're leveraging that platform, but baking ml and baking all the advanced edge and other capabilities into those solutions because the cyber teams as where you started with a You know, we really started reporting on cyber 2015, those guys have got such a hard job and while there's lots of people pretending like they're going to come in and serve them, it's the difficulty is there are hundreds of tools and technologies that the average C so deals with and the rate of innovation is not slowing down and those vendors that have a vested interest and I want to maintain my footprint and firewalls, I want to maintain an implant, I want to maintain. It's really hard for them to say, you know what? There are 25 other categories of tools and there's 500 vendors. You gotta play nicely with your competitors and know all those folks if you really want to provide the ml the detection, the remediation, The investigation capabilities. And that's where I'm really excited about the competition. The fake competition in many cases because like, yeah, bring it on. Like I've got 2000 engineers, all they do all day long is focused on the data layer and making sure that we're effective there and I'm not diverting my engineers with any other tasks that I've got a it's hard enough to do what we do in the day layers. Well, >>it's interesting. I just had some notes here, I had one data driven innovation you've been talking about since you've been here. We've been talking about data driven innovation, cybersecurity mentioned for many years, it's almost like the balance of you gotta have tools, but you gotta have the platform. If you have too many tools and no platform, then there's a mix match here and you get hung up with tools and these blind spots. You can't have blind spots, you can't have silos. This is what kind of everyone's pretty much agreeing on right now. It's not a debate. It's more like, okay, I got silos and I got blind spots. Well how do I solve >>the difficulty? And I touched a little bit of the sun my keynote of There are well over 60 and I was using 16 because DB engines categorizes 16 different database tools. But there's actually more if you go deeper. So there's different 16 different categories of database tools. Think relational database, data warehouse, ledger databases, graph database, et cetera over 16 categories those 350 vendors. That's not because we're all stupid in tech like a graph DB is different than a relational database, which is different than what we do with our stimulus index. So there's those categories that many vendors because they're trying to solve different problems within the swim lane that you are in which for us is this non structured, high volume difficult data to manage Now. The problem is how do you create that non broken that end to end view. So you can handle your use cases effectively. Um and then the customer is still going to do with the fact that we're not a relational database engine company. We're not a data warehousing company where we were beginning to use graph DB capabilities within our our solution sets. We're gonna lean on open source other vendors use the tool for the job >>you need. But I think that what you're thinking hitting on my like is this control plane idea. I want to get back to that because if you think about what the modern application developers want is they want devops and deVOps kind of one infrastructures codes there. But if I'm a modern developer, I just want to code, >>I don't want to configure >>the data or the infrastructure. So the data value now is so much more important for the developer, whether that's policy based innovation, get options, some people call it A I ops, these are big trends. This is fairly new in the sense of being mainstream. It's been around for a couple of years, but this time, how do you see the data being much more of a developer input. >>People talk about deVOps is a new thing when I was running on the HR products at Peoplesoft in 2000 and four, we had a deVOPS teams. So that is, you know, there's always been a group of people whether Disney or not that are kind of managing the manufacturing floor for your developers, making sure they got the right tools and databases and what's new is because the ephemeral nature of cloud, that app dev work and devops and everyone that surrounds those or is now 100% data driven because you have ephemeral services, they're popping up and popping down. And if you're not able to trap the data that are each one of those services are admitting and do it on a real time basis and a thorough, complete basis, you can't sample then you are flying blind and that's not gonna work when you've got a critical code push for a feature your customers demanding and if you don't get it out, your competitors are, you need to have assurance that you've done the right things and that the quality and and the actual deployment actually works And that's where what lettuce tubes or ability Three years ago as we roughly started doing our string of acquisitions is we saw that transition from a state full world where it was all transaction engine driven. I've got to insert transaction and engines in a code. Very different engineering problem to I've got to grab data and it's convoluted data. It's chaotic data. It's changing all the time. Well, jeez that sounds and latency >>issues to they're gonna be doing fast. >>I've got to do it. You literally millisecond by millisecond. You've got are are bigger customers were honored because of how we operate. Splunk to serve some of the biggest web properties in the in the globe and they're dealing with hundreds of terabytes to petabytes of data per day that are traversing these pipes and you've got to be able to extract metrics that entire multi petabyte or traces that entire multi pedal extreme and you can't hope you're guessing right by only extracting from portions of it because again, if you missed that data you've missed it forever. So for us that was a data problem, which is why we stepped in and >>other things That data problem these days, it's almost it's the most fun to talk about if you love the problem statement that we're trying to solve. I want to get your reaction something if you don't mind. I was talking to a C. So in the C. I. O. We have a conversation kind of off camera at an event recently and I said what's the biggest challenge that you have? Just curious? I asked him, it's actually it's personnel people are mad at each other. Developers want to go faster because there are ci cd pipeline is devops their coding. They're having to wait for the security groups in some cases weeks and days when they could do it in minutes they want to do it on the in the pipelines, shifting left as some call it and it's kind of getting in the way. So it's kind of like it's not they're not getting along very well uh meaning they're slowing things down. I can say something what they really said, but they weren't getting along. What's your reaction? Because that seems to be a speed scale problem. That's developer centric, not organizational, you've got organizational challenges and being slowed down. >>So uh while we all talk about this converted landscape and how exciting is going to be. You do have diametrically opposed metrics and you're never going to have, it's very difficult to get a single person to have the same allegiance to those diametrically a virgin metrics as you want. So you've got checks and balances and the reality of what the cyber teams need to be doing to ensure that you aren't just coding effective functions with the right delivery timeframe. But that's also secure is I think going to make the security team is important forever and the same thing. You can't just write sloppy code that consumes, that blows your AWS budget or G. C. P budget within the first week of deploying it because you've still got to run a responsible business. So there are different dimensions that we all have to deal with quality time and feature functionality that different groups represent. So we, I believe a converged landscape is important. It's not that we're gonna blow it up and one person is going to do it all if you've got to get those groups talking better and you've got to reduce cycle times now we believe it's plunk is with a common data plane, which is the backbone and then solutions built from that common data plane to serve those groups. You're lessening the lack of understanding and you're reducing the cycle time. So now I can look when I'm publishing the code. If it's done properly, is it also secure And the cyber teams can kind of be flying in saying, hey, wait, wait, wait, we just saw something in the data says we're not quite ready. I'm sorry. I know you want to push, you can't push now, but there'll be a data driven conversation and not this, you shouldn't be waiting a week or two weeks, like we can't operate that scale and you've got to address people with facts and data and logic and that's what we're trying to get done. And you >>guys have a good policy engine, you can put up that up into the pipeline. So awesome. That's great, great insight there. Thanks for sharing. Final question. Um looking back in your time since you've been Ceo the culture kind of hasn't changed at Splunk, it's still they have fun, hard charging laid back a little bit and public company now, he's still got to meet the numbers, but your growing business is good, but there's a lot more coming as a big wave coming talk about the Splunk culture. >>So the core elements of culture that I love that. I think all of us agree you don't want to change one where curiosity driven culture, our tool is an investigative tool, so I never want to lose. I think that threat of grit, determination, tenacity and curiosity is paramount in life and I think literally what we push out represents that and I want our people represent that and I think the fun element is really the quirkiness of the fund, like that is one of the things I love about Splunk but we are a serious company, we are in the data plane of tens of thousands of organizations globally and what we do literally makes a difference on whether they're successful or not. As organizations, we're talking about walmart is example And how one second latency can have a, have a 10% drop off in fulfillment of transaction for wal mart that's like a billion dollars a week if you cannot get their system to perform at the level it needs to so what we do matters and the change that we've been driving that I think is a great enhancement to the culture is as we are now tip into the 50% cloud company, you have the opportunity to measure millisecond by millisecond, second by second, minute by minute, hour by hour and that's a different level of help that you get. You can literally see patterns happening over the course of minutes within customers and that's not something we were born with. We were an on premise solution, we had beautiful tools and it was the C E O. S problem, the CSS problem um and their opportunity to get that feedback. Now we get that feedback so we're trying to measure that crunchiness, the fun, the cool part about Splunk with. We also have got to be very operationally disciplined because we carry a heavy responsibility set from our customers and we're in the middle of that as well as the world knows, we're halfway through our transition to be a cloud first company but I'm excited with the results I'm seeing, so I think curiosity and tenacity go with that operational rigor. Like we should all be growth mindset oriented and very excited about, Hey, can I improve? I guess there's some information that I need that I'm not getting that will make me serve my customers better and that is the tone and tenor. I want to cross all the Splunk of whether in HR legal or engineering or sales or we serve customers and we've got to be so excited every day about getting better feedback and how to serve them better. >>Doug. Thanks for coming on the Cuban, sharing that inside. I know you had to cancel your physical event, pulled off an exceptionally strong virtual event here in person. Thanks for having the Cuban. Thanks for coming on. >>Thank you for being here and I can't wait to do this in person. Next >>to mary the ceo of Splunk here inside the cube cube coverage continues stay with us for more. We've got more interviews all the rest of the day, Stay with us. I'm john for your host. Thanks for watching. Mm >>mm mhm >>mhm >>Yeah

>> Narrator: From around the globe, It's theCUBE! Covering Fortinet Security Summit, brought to you by Fortinet. >> And welcome to the cube coverage here at the PGA champion-- Fortinet championship, where we're going to be here for Napa valley coverage of Fortinet's, the championships security summit, going on Fortinet, sponsoring the PGA, but a great guest Merritt Baer, who's the principal in the office of the CISO at Amazon web services. Great to see you. Thanks for coming on. >> Merritt: Thank you for having me. It's good to be here. >> So Fortinet, uh, big brand now, sponsoring the PGA. Pretty impressive that they're getting out there with the golf. It's very enterprise focused, a lot of action. A lot of customers here. >> Merritt: It seems like it, for sure. >> Bold move. Amazon, Amazon web services has become the gold standard in terms of cloud computing, seeing DevOps people refactoring. You've seen the rise of companies like Snowflake building on Amazon. People are moving not only to the cloud, but they're refactoring their business and security is top of mind for everyone. And obviously cybersecurity threats that Fortinet helps cover, you guys are partnering with them, is huge. What is your state of the union for cyber? What's the current situation with the threat landscape? Obviously there's no perimeter in the cloud. More end points are coming on board. The Edge is here. 5G, wavelength with outpost, a lot happening. >> That was a long question, but I'll, I'll try. So I think, you know, as always business in innovation is the driver. And security needs to be woven into that. And so I think increasingly we're seeing security not be a no shop, but be an enabler. And especially in cloud, when we're talking about the way that you do DevOps with security, I know folks don't like the term DevSecOps, but you know, to be able to do agile methodology and be able to do the short sprints that are really agile and, and innovative where you can-- So instead of nine months or whatever, nine week timelines, we're talking about short sprints that allow you to elastically scale up and down and be able to innovate really creatively. And to do that, you need to weave in your security because there's no like, okay, you pass go, you collect $200. Security is not an after the fact. So I think as part of that, of course the perimeter is dead, long live the perimeter, right? It does matter. And we can talk about that a little bit. You know, the term zero trust is really hot right now. We can dig into that if that's of interest. But I think part of this is just the business is kind of growing up. And as you alluded to we're at the start of what I think is an S curve that is just at the beginning. >> You know, I was really looking forward to Reinforced this year. It was got canceled last year, but the first inaugural event was in Boston. I remember covering that. This year it was virtual, but the keynote Steven gave was interesting, security hubs at the center of it. And I want to ask you, because I need you to share your view on how security's changed with the cloud, because there's now new things that are there to take advantage of if you're a business or an enterprise, yeah on premises, there's a standard operating procedure. You have the perimeter, et cetera. That's not there anymore, but with the cloud, there's a new, there's new ways to protect and security hub is one. What are some of the new things that cloud enables for security? >> Well, so just to clarify, like perimeters exist logically just like they do physically. So, you know, a VPC for example, would be a logical perimeter and that is very relevant, or a VPN. Now we're talking about a lot of remote work during COVID, for example. But one of the things that I think folks are really interested with Security Hub is just having that broad visibility and one of the beauties of cloud is that, you get this tactile sense of your estate and you can reason about it. So for example, when you're looking at identity and access management, you can look at something like access analyzer that will under the hood be running on a tool that our, our group came up with that is like reasoning about the permissions, because you're talking about software layers, you're talking about computer layer reasoning about security. And so another example is in inspector. We have a tool that will tell you without sending a single packet over the network, what your network reach ability is. There's just like this ability to do infrastructure as code that then allows you to do security as code. And then that allows for ephemeral and immutable infrastructures so that you could, for example, get back to a known good state. That being said, you know, you kill a, your web server gets popped and you kill it and you spin up a new one. You haven't solved your problem, right? You need to have some kind of awareness of networking and how principals work. But at the same time, there's a lot of beauties about cloud that you inherit from a security perspective to be able to work in those top layers. And that's of course the premise of cloud. >> Yeah, infrastructure as code, you mentioned that, it's awesome. And the program ability of it with, with server-less functions, you're starting to see new ways now to spin up resources. How is that changing the paradigm and creating opportunities for better security? Is it, is it more microservices? Is it, is, are there new things that people can do differently now that they didn't have a year ago or two years ago? Because you're starting to see things like server-less functions are very popular. >> So yes, and yes, I think that it is augmenting the way that we're doing business, but it's especially augmenting the way we do security in terms of automation. So server-less, under the hood, whether it's CloudWatch events or config rules, they are all a Lambda function. So that's the same thing that powers your Alexa at home. These are server-less functions and they're really simple. You can program them, you can find them on GitHub, but they are-- one way to really scale your enterprise is to have a lot of automation in place so that you put those decisions in ahead of time. So your gray area of human decision making is scaled down. So you've got, you know, what you know to be allowable, what you know to be not allowable. And then you increasingly kind of whittled down that center into things that really are novel, truly novel or high stakes or both. But the focus on automation is a little bit of a trope for us. We at Amazon like to talk about mechanisms, good intentions are not enough. If it's not someone's job, it's a hope and hope is not a plan, you know, but creating the actual, you know, computerized version of making it be done iteratively. And I think that is the key to scaling a security chain because as we all know, things can't be manual for long, or you won't be able to grow. >> I love the AWS reference. Mechanisms, one way doors, raising the bar. These are all kind of internal Amazon, but I got to ask you about the Edge. Okay. There's a lot of action going on with 5G and wavelength. Okay, and what's interesting is if the Edge becomes so much more robust, how do you guys see that security from a security posture standpoint? What should people be thinking about? Because certainly it's just a distributed Edge point. What's the security posture, How should we be thinking about Edge? >> You know, Edge is a kind of catch all, right, we're talking about Internet of Things. We're talking about points of contact. And a lot of times I think we focus so much on the confidentiality and integrity, but the availability is hugely important when we're talking about security. So one of the things that excites me is that we have so many points of contact and so many availability points at the Edge that actually, so for example, in DynamoDB, the more times you put a call on it, the more available it is because it's fresher, you've already been refreshing it, there are so many elements of this, and our core compute platform, EC2, all runs on Nitro, which is our, our custom hardware. And it's really fascinating, the availability benefits there. Like the best patching is a patching you don't have to do. And there are so many elements that are just so core to that Greengrass, you know, which is running on FreeRTOS, which has an open source software, for example, is, you know, one element of zero trust in play. And there are so many ways that we can talk about this in different incarnations. And of course that speaks to like the breadth and depth of the industries that use cloud. We're talking about automotive, we're talking about manufacturing and agriculture, and there are so many interesting use cases for the ways that we will use IOT. >> Yeah. It's interesting, you mentioned Nitro. we also got Annapurna acquisition years ago. You got latency at the Edge. You can handle low latency, high volume compute with the data. That's pretty powerful. It's a paradigm shift. That's a new dynamic. It's pretty compelling, these new architectures, most people are scratching their heads going, "okay, how do I do this, like what do I do?" >> No, you're right. So it is a security inheritance that we are extremely calculated about our hardware supply chain. And we build our own custom hardware. We build our own custom Silicon. Like, this is not a question. And you're right in that one of the things, one of the north stars that we have is that the security properties of our engineering infrastructure are built in. So there just is no button for it to be insecure. You know, like that is deliberate. And there are elements of the ways that nature works from it running, you know, with zero downtime, being able to be patched running. There are so many elements of it that are inherently security benefits that folks inherit as a product. >> Right. Well, we're here at the security summit. What are you excited for today? What's the conversations you're having here at the Fortinet security summit. >> Well, it's awesome to just meet folks and connect outside. It's beautiful outside today. I'm going to be giving a talk on securing the cloud journey and kind of that growth and moving to infrastructure as code and security as code. I'm excited about the opportunity to learn a little bit more about how folks are managing their hybrid environments, because of course, you know, I think sometimes folks perceive AWS as being like this city on a hill where we get it all right. We struggle with the same things. We empathize with the same security work. And we work on that, you know, as a principal in the office of the CISO, I spend a lot of my time on how we do security and then a lot of my time talking to customers and that empathy back and forth is really crucial. >> Yeah. And you've got to be on the bleeding edge and have the empathy. I can't help but notice your AWS crypto shirt. Tell me about the crypto, what's going on there. NFT's coming out, is there a S3 bucket at NFT now, I mean. (both laughing) >> Cryptography never goes out of style. >> I know, I'm just, I couldn't help-- We'll go back to the pyramids on that one. Yeah, no, this is not a, an advertisement for cryptocurrency. It is, I'm a fangirl of the AWS crypto team. And as a result of wearing their shirts, occasionally they send me more shirts. And I can't argue with that. >> Well, love, love, love the crypto. I'm big fan of crypto, I think crypto is awesome. Defi is amazing. New applications are going to come out. We think it's going to be pretty compelling, again, let's get today right. (laughing) >> Well, I don't think it's about like, so cryptocurrency is just like one small iteration of what we're really talking about, which is the idea that math resolves, and the idea that you can have value in your resolution that the math should resolve. And I think that is a fundamental principle and end-to-end encryption, I believe is a universal human right. >> Merritt, thank you for coming on the cube. Great, great to have you on. Thanks for sharing that awesome insight. Thanks for coming on. >> Merritt: Thank you. >> Appreciate it. Okay. CUBE coverage here in Napa valley, our remote set for Fortinet's security cybersecurity summit here as part of their PGA golf Pro-Am tournament happening here in Napa valley. I'm John Furrier. Thanks for watching.

>> Announcer: Live from Las Vegas, it's theCUBE! Covering Splunk .conf19. Brought to you by Splunk. Okay, welcome back, everyone. This is day three live CUBE coverage here in Las Vegas for Splunk's .conf. Its 10 years anniversary of their big customer event. I'm John Furrier, theCUBE. This is our seventh year covering, riding the wave with Splunk. From scrappy startup, to going public company, massive growth, now a market leader continuing to innovate. We're here with the CEO, Doug Merritt of Splunk. Thanks for joining me, good to see you. >> Thank you for being here, thanks for having me. >> John: How ya feelin'? (laughs) >> Exhausted and energized simultaneously. (laughs) it was a fun week. >> You know, every year when we have the event we discuss Splunk's success and the loyalty of the customer base, the innovation, you guys are providing the value, you got a lot of happy customers, and you got a great ecosystem and partner network growing. You're now growing even further, every year it just gets better. This year has been a lot of big highlights, new branding, so you got that next level thing goin' on, new platform, tweaks, bringing this cohesive thing. What's your highlights this year? I mean, what's the big, there's so much goin' on, what's your highlights? >> So where you started is always my highlight of the show, is being able to spend time with customers. I have never been at a company where I feel so fortunate to have the passion and the dedication and the enthusiasm and the gratitude of customers as we have here. And so that, I tell everyone at Splunk this is similar to a holiday function for a kid for me where the energy keeps me going all year long, so that always is number one, and then around the customers, what we've been doing with the technology architecture, the platform, and the depth and breadth of what we've been working on honestly for four plus years. It really, I think, has come together in a unique way at this show. >> Last year you had a lot of announcements that were intentional announcements, it's coming. They're coming now, they're here, they're shipping. >> They're here, they're here. >> What is some of the feedback you're hearing because a lot of it has a theme where, you know, we kind of pointed this out a couple of years ago, it's like a security show now, but it's not a security show, but there's a lot of security in there. What are some of the key things that have come out of the oven that people should know about that are being delivered here? >> So the core of what we're trying to communicate with Data-to-Everything is that you need a very multifaceted data platform to be able to handle the huge variety of data that we're all dealing with, and Splunk has been known and been very successful at being able to index data, messy, non-structured data, and make sense of it even though it's not structured in the index, and that's been, still is incredibly valuable. But we started almost four years ago on a journey of adding in stream processing before the data gets anywhere, to our index or anywhere else, it's moving all around the world, how do you actually find that data and then begin to take advantage of it in-flight? And we announced that the beta of Data Stream Processor last year, but it went production this year, four years of development, a ton of patents, a 40 plus person, 50 plus person, development team behind that, a lot of hard engineering, and really elegant interface to get that there. And then on the other end, to complement the index, data is landing all over the place, not just in our index, and we're very aware that different structures exist for different needs. A data warehouse has different properties than a relational database which has different properties than a NoSQL column store in-memory database, and data is going to only continue to be more dispersed. So again, four plus years ago we started on what now is Data Fabric Search which we pre-announced in beta format last year. That went production at this show, but the ability to address a distributed Splunk landscape, but more importantly we demoed the integration with HTFS and S3 landscapes as the proof point of we've built a connector framework, so that this really cannot just be a incredibly high-speed, high-cardinality search processing engine, but it really is a federated search engine as well. So now we can operate on data in the stream when it's in motion. We obviously still have all the great properties of the Splunk index, and I was really excited about Splunk 8.0 and all the features in that, and we can go get data wherever it lives across a distributed Splunk environment, but increasingly across the more and more distributed data environment. >> So this is a data platform. This is absolutely a data platform, so that's very clear. So the success of platforms, in the enterprise at least, not just small and medium-sized businesses, you can have a tool and kind of look like a platform, there's some apps out there that I would point to and say, "Hey, that looks like a tool, it's really not a platform." You guys are a platform. But the success of a platform are two things, ecosystem and apps, because if you're in a platform that's enabling value, you got to have those. Talk about how you see the ecosystem success and the app success. Is that happening in your view? >> It is happening. We have over 2,000 apps on our Splunkbase framework which is where any of our customers can go and download the application to help draw value of a Palo Alto firewall, or ensure integration with a ServiceNow trouble ticketing system, and thousands of other examples that exist. And that has grown from less than 300 apps, when I first got here six years ago, to over 2,000 today. But that is still the earliest inning, for earliest pitch and your earliest inning journey. Why are there 20,000, 200,000, two million apps out there? A piece of it is we have had to up the game on how you interface with the platform, and for us that means through a stable set of services, well-mannered, well-articulated, consistently maintained services, and that's been a huge push with the core Splunk index, but it's also a big amount of work that we've been doing on everything from the separation between Phantom runbooks and playbooks with the underlying orchestration automation, it's a key component of our Stream Processor, you know, what transformations are you doing, what enrichments are you doing? That has to live separate than the underlying technology, the Kafka transport mechanism, or Kinesis, or whatever happens in the future. So that investment to make sure we got a effective and stable set of services has been key, but then you complement that with the amazing set of partners that are out here, and making sure they're educated and enabled on how to take advantage of the platform, and then feather in things like the Splunk Ventures announcement, the Innovation Fund and Social Impact Fund, to further double down on, hey, we are here to help in every way. We're going to help with enablement, we're going to help with sell-through and marketing, and we'll help with investment. >> Yeah, I think this is smart, and I think one of the things I'll point out is that feedback we heard from customers in conversations we had here on theCUBE and the hallway is, there's a lot of great feedback on the automation, the machine learning toolkit, which is a good tell sign of the engagement level of how they're dealing with data, and this kind of speaks to data as a value... The value creation from data seems to be the theme. It's not just data for data's sake, I mean, managing data is all hard stuff, but value from the data. You mentioned the Ventures, you got a lot of tech for good stuff goin' on. You're investing in companies where they're standing up data-driven companies to solve world problems, you got other things, so you guys are adjusting. In the middle innings of the data game, platform update, business model changes. Talk about some of the consumption changes, now you got Splunk Cloud, what's goin' on on (laughs) how you charge, how are customers consuming, what moves did you guys make there and what's the result? >> Yeah, it's a great intro on data is awesome, but we all have data to get to decisions first and actions second. Without an action there is no point in gathering data, and so many companies have been working their tails off to digitize their landscapes. Why, well you want a more flexible landscape, but why the flexibility? Because there's so much data being generated that if you can get effective decisions and then actions, that landscape can adapt very, very rapidly, which goes back to machine learning and eventual AI-type opportunities. So that is absolutely, squarely where we've been focused, is translating that data into value and into actual outcomes, which is why our orchestration automation piece was so important. One of the gating factors that we felt has existed is for the Splunk index, and it's only for the Splunk index, the pricing mechanism has been data volume, and that's a little bit contrary to the promise, which is you don't know where the value is going to be within data, and whether it's a gigabyte or whether it's a petabyte, why shouldn't you be able to put whatever data you want in to experiment? And so we came out with some updates in pricing a month and change ago that we were reiterating at the show and will continue to drive on a, hopefully, very aggressive and clear marketing and communications framework, that for people that have adjusted to the data volume metric, we're trying to make that much simpler. There's now a limited set of bands, or tiers, from 100 gigs to unlimited, so that you really get visibility on, all right, I think that I want to play with five terabytes, I know what that band looks like and it's very liberal. So that if you wind up with six and a half terabytes you won't be penalized, and then there's a complimentary metric which I think is ultimately going to be the more long-lived metric for our infrastructurally-bound products, which is virtual CPU or virtual core. And when I think about our index, stream processing, federated search, the execution of automation, all those are basically a factor of how much infrastructure you're going to throw at the problem, whether it's CPU or whether it's storage or network. So I can see a day when Splunk Enterprise and the index, and everything else at that lower level, or at that infrastructure layer, are all just a series of virtual CPUs or virtual cores. But I think both, we're offering choice, we really are customer-centric, and whether you want a more liberal data volume or whether you want to switch to an infrastructure, we're there and our job is to help you understand the value translation on both of those because all that matters is turning it into action and into doing. >> It's interesting, in the news yesterday quantum supremacy was announced. Google claims it, IBM's debating it, but quantum computing just points to the trend that more compute's coming. So this is going to be a good thing for data. You mentioned the pricing thing, this brings up a topic we've been hearing all week on theCUBE is, diverse data's actually great for machine learning, great for AI. So bringing in diverse data gives you more aperture into data, and that actually helps. With the diversity comes confusion and this is where the pricing seems to hit. You're trying to create, if I get this right, pricing that matches the needs of the diverse use of data. Is that kind of how you guys are thinkin' about it? >> Meets the needs of diverse data, and also provides a lot of clarity for people on when you get to a certain threshold that we stop charging you altogether, right? Once you get above 10s of terabytes to 100 terabytes, just put as much data in as you want. The foundation of Splunk, going back to the first data, is we're the only technology that still exists on the index side that takes raw, non-formatted data, doesn't force you to cleanse or scrub it in any way, and then takes all that raw data and actually provides value through the way that we interact with the data with our query language. And that design architecture, I've said it for five, six years now, is completely unique in the industry. Everybody else thinks that you've got to get to the data you want to operate on, and then put it somewhere, and the way that life works is much more organic and emergent. You've got chaos happening, and then how do you find patterns and value out of that chaos? Well, that chaos winds up being pretty voluminous. So how do we help more organizations? Some of the leading organizations are at five to 10 petabytes of data per day going through the index. How do we help everybody get there? 'Cause you don't know the nugget across that petabyte or 10 petabyte set is going to be the key to solving a critical issue, so let's make it easy for you to put that data in to find those nuggets, but then once you know what the pattern is, now you're in a different world, now you're in the structured data world of metrics, or KPIs, or events, or multidimensional data that is much more curated, and by nature that's going to be more fine-grained. There's not as much volume there as there is in the raw data. >> Doug, I notice also at the event here there's a focus on verticals. Can you comment on the strategy there, is that by design? Is there a vertical focus? >> It's definitely by design. >> Share some insight into that. >> So we launched with an IT operations focus, we wound up progressing over the years to a security operations focus, and then our doubling down with Omnition, SignalFx, VictorOps, and now Streamlio is a new acquisition on the DevOps and next gen app dev buying centers. As a company and how we go to market and what we are doing with our own solutions, we stay incredibly focused on those three very technical buying centers, but we've also seen that data is data. So the data you're bringing in to solve a security problem can be used to solve a manufacturing problem, or a logistics and supply chain problem, or a customer sentiment analysis problem, and so how do you make use of that data across those different buying centers? We've set up a verticals group to seed, continue to seed, the opportunity within those different verticals. >> And that's compatible with the horizontally scalable Splunk platform. That's kind of why that exists, right? >> That the overall platform that was in every keynote, starting with mine, is completely agnostic and horizontal. The solutions on top, the security operations, ITOps, and DevOps, are very specific to those users but they're using the horizontal platform, and then you wind up walking into the Accenture booth and seeing how they've taken similar data that the SecOps teams gathered to actually provide insight on effective rail transport for DB cargo, or effective cell tower triangulation and capacity for a major Australian cell company, or effective manufacturing and logistics supply chain optimization for a manufacturer and all their different retail distribution centers. >> Awesome, you know, I know you've talked with Jeff Frick in the past, and Stu Miniman and Dave Vellante about user experience, I know that's something that's near and dear to your heart. You guys, it has been rumored, there's going to be some user experience work done on the onboarding for your Splunk Cloud and making it easier to get in to this new Splunk platform. What can we expect on the user experience side? (laughs) >> So, for any of you out there that want to try, we've got Splunk Investigate, that's one of the first applications on top of the fully decomposed, services layered, stateless Splunk Cloud. Mission Control actually is a complementary other, those are the first two apps on top of that new framework. And the UI and experience that is in Splunk Investigate I think is a good example of both the ease of coming to and using the product. There's a very liberal amount of data you get for free just to experiment with Splunk Investigate, but then the onboarding experience of data is I think very elegant. The UI is, I love the UI, it's a Jupyter-style workbook-type interface, but if you think about what do investigators need, investigators need both some bread crumbs on where to start and how to end, but then they also need the ability to bring in anybody that's necessary so that you can actually swarm and attack a problem very efficiently. And so when you go back and look at, why did we buy VictorOps? Well, it wasn't because we think that the IT alerting space is a massive space we're going to own, it's because collaboration is incredibly important to swarm incidents of any type, whether they're security incidents or manufacturing incidents. So the facilities at VictorOps gave, on allowing distributed teams and virtual teams to very quickly get to resolution. You're going to find those baked into all products like Mission Control 'cause it's one of the key facilities of, that Tim talked about in his keynote, of indulgent design, mobility, high collaboration, 'cause luckily people still matter, and while ML is helping all of us be more productive it isn't taking away the need for us, but how do you get us to cooperate effectively? And so our cloud-based apps, I encourage any of you out there, go try Splunk Investigate, it's a beautiful product and I think you'll be blown away by it. >> Great success on the product side, and then great success on the customer side, you got great, loyal customers. But I got to ask you about the next level Splunk. As you look at this event, what jumps out at me is the cohesiveness of the story around the platform and the apps, ecosystem's great, but the new branding, Data-to-Everything. It's not product-specific 'cause you have product leadership. This is a whole next level Splunk. What is the next level Splunk vision? >> And I love the pink and orange, in bold colors. So when I've thought about what are the issues that are some of the blockers to Splunk eventually fulfilling the destiny that we could have, the number one is awareness. Who the heck is Splunk? People have very high variance of their understanding of Splunk. Log aggregation, security tool, IT tool, and what we've seen over and over is it is much more this data platform, and certainly with the announcements, it's becoming more of this data fabric or platform that can be used for anything. So how do we bring awareness to Splunk? Well, let's help create a category, and it's not up to us to create the category, it's up to all of you to create the category, but Data-to-Everything in our minds represents the power of data, and while we will continue internally to focus on those technical buying centers, everything is solvable with data. So we're trying to really reinforce the importance of data and the capabilities that something like Splunk brings. Cloud becomes a really important message to that because that makes it, execution to that, 'cause it makes it so much easier for people to immediately try something and get value, but on-prem will always be important as well 'cause data has gravity, data has risk, data has cost to move. And there are so many use cases where you would just never push data to the cloud, and it's not because we don't love cloud. If you have a factory that's producing 100 terabytes an hour in a area where you've got poor bandwidth, there's no option for a cloud connect there of high scale, so you better be able to process, make sense of, and act on that data locally. >> And you guys are great in the cloud too, on-premise, but final word, I want to get your thoughts to end this segment, I know you got to run, thanks for your time, and congratulations on all your success. Data for good. There's a lot of tech for bad kind of narratives goin' on, but there's a real resurgence of tech for good. A lot of people, entrepreneurs, for-profit, for-nonprofit, are doing ventures for good. Data is a real theme. Data for good is something that you have, that's part of the Data-to-Everything. Talk about the data for good real quick. >> Yeah, we were really excited about what we've done with Splunk4Good as our nonprofit focused entity. The Splunk Pledge which is a classic 1-1-1 approach to make sure that we're able to help organizations that need the help do something meaningful within their world, and then the Splunk Social Impact Fund which is trying to put our money where our mouth is to ensure that if funding and scarcity of funds is an issue of getting to effective outcomes, that we can be there to support. At this show we've featured three awesome charities, Conservation International, NetHope, and the Global Emancipation Network, that are all trying to tackle really thorny problems with different, in different ways, different problems in different ways, but data winds up being at the heart of one of the ways to unlock what they're trying to get done. We're really excited and proud that we're able to actually make meaningful donations to all three of those, but it is a constant theme within Splunk, and I think something that all of us, from the tech community and non-tech community are going to have to help evangelize, is with every invention and with every thing that occurs in the world there is the power to take it and make a less noble execution of it, you know, there's always potential harmful activities, and then there's the power to actually drive good, and data is one of those. >> Awesome. >> Data can be used as a weapon, it can be used negatively, but it also needs to be liberated so that it can be used positively. While we're all kind of concerned about our own privacy and really, really personal data, we're not going to get to the type of healthcare and genetic, massive shifts in changes and benefits without having a way to begin to share some of this data. So putting controls around data is going to be important, putting people in the middle of the process to decide what happens to their data, and some consequences around misuse of data is going to be important. But continuing to keep a mindset of all good happens as we become more liberal, globalization is good, free flow of good-- >> The value is in the data. >> Free flow of people, free flow of data ultimately is very good. >> Doug, thank you so much for spending the time to come on theCUBE, and again congratulations on great culture. Also is worth noting, just to give you a plug here, because it's, I think, very valuable, one of the best places to work for women in tech. You guys recently got some recognition on that. That is a huge accomplishment, congratulations. >> Thank you, thank you, we had a great diversity track here which is really important as well. But we love partnering with you guys, thank you for spending an entire week with us and for helping to continue to evangelize and help people understand what the power of technology and data can do for them. >> Hey, video is data, and we're bringin' that data to you here on theCUBE, and of course, CUBE cloud coming soon. I'm John Furrier here live at Splunk .conf with Doug Merritt the CEO. We'll be back with more coverage after this short break. (futuristic music)

(funky music) >> Live from San Francisco, it's theCube, covering RSA Conference 2019 brought to you by Forescout. >> Hey welcome back everybody Jeff Frick here with theCUBE. We're at the RSA Conference at downtown San Francisco Moscone Center, they finally finished the remodel. We're excited to be in the Forescout booth, we've never been in the Forescout booth before, psyched that they invited us in. But we've got an old time CUBE alumni and a special company in my heart, was my very first CUBE event ever was Splunk.conf 2012. >> I did not know that Jeff. >> Yeah so we're live. We have Doug Merritt on he's a CEO of Splunk. Doug great to see you. >> Thanks Jeff, good to see you again also. >> Yeah so we've been doing Splunk.conf since 2012. >> The early days. The Cosmo Hotel and it was pouring rain that week. >> That was the third year. >> Probably the third year? >> Second year, yeah long time ago, it's grown. >> 2012 wasn't that big but this is a crazy show. You've been coming here for a while. Security is such an important part of the Splunk value proposition, just general impressions of RSA as you've been here for a couple of days. >> Yeah, it's amazing to see how the show has grown over the years, security's gone from this, kind of backwater thing that a few weird people did in the corner, that only understood the cyber landscape, to something that boards care about now. And that, obviously has helped with this show, I don't know what the attendee numbers are like, but tens of thousands of people. >> Oh yeah. >> You can't walk down a hallway without bumping into 10 brand new companies that were launched in the past year, and the security space and make the biggest challenge people that I have, and I think that other people have is, how do you tell different, where's the wheat from the chaff? What is really important in security and how do you tell different companies and different trends apart, so you can actually focus on what matters? >> Right, I just feel for the seed-sows, right, I mean, you guys have a big ecosystem at .conf, but those are all kind of complimentary things around the core Splunk solution. This is, you've got co-opetition, competition, how does somebody navigate so many options? 'Cause at the end of the day you don't have unlimited resources, you don't have unlimited people to try to figure all these pieces of the puzzle out. >> Yeah, and the CSOs have got a really tough job, the average CSO has got well over a hundred different vendors you're dealing with, and with Splunk what we're very focused on, and where I think we add value is that we become, if done right, we become the abstraction layer that creates a brain and nervous system that allows all those different products, and all of them have got unique capabilities. When you think about the complexity of all the networking, all the compute, all the storage, all the end point landscapes that's only getting worse for the cloud, because now there's more services with more varieties across more cloud vendors. How do you get visibility on that? >> Right, right. >> And you need products at those different junctures, 'cause protect and prevent and defend is still an important function for CSOs, but when we know that you can't prevent everything. >> Right. >> And things will go wrong, how do you know that, that is actually occurring? And what the splunk value prop is, we are the, we don't have as much of a point of view on any one product, we aggregate data from all the products, which is why so many people are partners, and then help companies with both raw investigations, given that if something goes wrong with our schema less data structure, but then also with effective monitoring and analytics that's correlating data across those tens, hundreds or thousands of different technologies. So you can get a better feel for what are the patterns that make sense to pay attention to. >> I think you just gave me like 10 questions to ask just in that answer, you covered it all. 'Cause the other thing, you know, there's also IoT now and OT and all these connected devices so, you know the end points, the surface area, the throughput is only going up by orders of magnitude. >> Without a doubt. >> It's crazy. >> I saw some stats the other day that, globally at this point there's, I may get these off by one digit, but lets say there's 80,000 servers that are the backbone of the entire internet. There's already over 11 billion connected devices, going back to that IoT theme. So the ramifications at the edge and what that means are so profound and companies like Forescout, as a key partner of Splunk's, help make sure that you're aware of; what are all the different elements that are ever hitting my network in a way. And what do they look like and what, what should I be doing, as different things pop on and pop off and, again, we're trying to be the interpretation and brain layer for that, so that they are more and more intelligent to the actions they're taking, given their depth of domain, their deep knowledge of what a camera should look like, or what a windows PC should look like or what a firewall should look like given the configurations that are important to that company. >> Before we turned on the cameras you made an interesting comment. We used to talk about schema on read versus schema on write, that was the big, kind of big data theme, and you guys are sitting on a huge data flow, but you had a really kind of different take, because you never really know, even with schema on read it seems you know what the schema is but in today's changing environment you're not really sure what it is you're going to be looking for next right? And that can evolve and change over time, so you guys have kind of modified that approach a little bit. >> Yeah, I think we are this year you'll see us really reemphasizing that core of Splunk. That the reason you'd have an investigative lake, and I don't think most people know what a schema is period, much less read or write so my new terminology is hey you need a very thorough investigative lake. Going back to the discussion we were having, with so much surface area, so many network devices, so many servers, so many end points, what tool do you have that's reading in data from all of those, and they all are going to have crazy formats. The logs around those are not manageable. To say you can manage logs and centralize. Centralized logs I get, manage those words don't work together. >> Right. Logs are chaotic by nature, you're not going to manage them, you're not going to force every developer and every device to adhere to a certain data structure so it can neatly fit into your structured database. >> Right. >> It is too chaotic, but more importantly, even if you could you're going to miss a point, which is, once you structure data, you're limited with the types of questions you can ask, which means you had to visualize what the questions would be in the first place. In this chaotic environment you don't know what the questions going to be. The dynamics are changing way to quickly, so the investigative lake is truly, our index is not schematized in any way, so you can ask a million questions once versus a schematized data store where it is; I ask one question >> A million times. a million times. And that's super efficient for that, but, the uniqueness of Splunk is, the investigative lake is the fabric of what we do, and where I think our customers, almost have forgotten about Splunk is, read all that data in. I know we've got a volume based licensing model that we're working on customers, were working to solve that for you, that's not the, I'm not trying to get data in so that we can charge more, I'm trying to get data in so that everybody has got the capacity to investigate, 'cause we cannot fail in answering what, why, when, where, how, and stuff'll go wrong, if you can't answer that, man you're in big trouble. And then on top of that let's make sure you've got right monitoring capability, the right predictive analytics capability; and now with tools like Phantom, and we bought a company called victorOps, which is a beautiful collaboration tool, let's make sure you've got the right automation and action frameworks so that you can actually leverage peoples skills across the investigative, monitoring and analytical data stores that at Splunk we help with all four of those. >> Right, right, again, you touch on a lot of good stuff. We could go for hours but we don't have you all day. But I want to follow up on a couple of things, because one of the things that we hear over and over and over is the time to even know that you've been breached. The time to know that you have a problem, and again, by having all that data there you can now start adjusting your questions based on that way you now know. But I think what's even more kind of intriguing to me is, as nation states have become more active, as we've seen the politicalization of a lot of things, you know, what is valuable today is a much varied, much more varied answer than just tapping into a bank account or trying to steal credit card numbers. So it really supports, kind of this notion that you're saying, which you don't have a clue what the question is that you're going to need to ask tomorrow. So how do you make sure you're in a position, when you find out what the question is, that you can ask it? >> And that's the design architecture I like about splunk as a company is that our orientation is, if you're dealing with a world of chaos, allow that chaos to exist and then find the needles in the haystack, the meaning from that chaos, and then when you find the meaning, now you know that a monitor is worthwhile, because you've validated root cause and it exists. And when your monitor is kicked a few times, and you know it's legit, build a predictive routine, because you now know it's worth trying to predict, because you've seen this thing trip a number of times, which inverts the way that most people, that all of us were taught. Which is start with the end in mind, because garbage in equals garbage out, so be really thoughtful in what you want and then you can structure everything, it's like well, that's not the way the world works. What if the question we asked 15 years ago was, what if you couldn't start with the end in mind, what would you have to do? Well you'd have to have a schema less storage vehicle and a language that allows you to ask any question you want and get structure on the question, but then you still need a structure. So you're going to structure them one way or the other, how do you make sure you've got high quality structure, and in our dynamic landscape that's always going to change. >> Right, well the good news is 2020 next year so we'll all know everything right? >> Yeah, exactly. >> We'll have the hindsight. So the last thing before I let you go is really to talk about automation, and just the quantity and volume and throughput of these systems. Again, one, escalating, just 'cause it's always escalating, but two, now adding this whole connected devices and IoT, and this whole world of operational technology devices, you just, you can't buy your way out of it, you can't hire your way out of it, you have to have an increasing level of automation. So how are you kind of seeing that future evolve over the next couple of years? >> I've been meeting with a lot of customers obviously this week, and one of them said, the interesting part about where we are now is, you can't unsee what you've seen. And where we were five years ago, as most people in security and IT; which are natively digitized, they still didn't know how to wrap there arms around the data. So they just didn't see it, they were like the ostrich. Now with tools like Splunk they can actually see the data, but now, what do I do with it? When I've got a billion potential events per day, how do I deal with that? And even if I could find enough manpower, the skills are going to be changing at such a constant basis, so I think this security, orchestration, automation, response; SOAR, area and we were fortunate enough to form a great relationship with phantom a couple of years ago and add them to the Splunk fold, exactly a year ago, as, I think, the best of the SOAR vendors, but it's a brand new category. Because companies have not yet had that unseeing moment of, holy cow, what do I do, how do I even deal with this amount of information? And adding in automation, intelligent automation, dynamic automation, with the right orchestration layer is an absolute imperative for these shops going forward, and when I look at a combination of phantom and their competitors there's still less then a thousand companies in a sea of a million plus corporate entities, globally, that have licensed these products. So we're at the very beginning of this portion of the wave. But there's no way that companies will be able to be successful without beginning to understand what that means, and wrapping their minds around how to use it. What we're so excited about with Splunk, is traversing investigate, monitor, analyze and automate up and down continuously, we think is the key to getting the best value from this really, really diverse and chaotic landscape and then having phantom as part of the fold helps a lot, because you can get signal on, did I do the right automation? Did It actually achieve the goal that my brain told me to do, or not? And if not, what do I adjust in the brain? Do I go after different data, do I structure the data a different way? But that up and down the chain of check and balance, am I doing the right stuff is something that-- >> And do it continuously. >> It's got to be continuous. >> It's got to be continuous. So we're sitting in the Forescout booth, so talk about how Forescout plays. I mean you guys have been sitting on those (mumbles), really fundamental core date, they're really kind of been opening up a whole different set of data, so how is that kind of working out? >> Yeah, so I'm really thankful for the relationship, mostly because they're a great company and I love their CEO, but mostly, if you go customer back, it's a very important relationship. Which is the proliferation of devices, developments continues to grow, and most companies aren't even aware of the number of devices that exist in their sphere, much less how they should look, and then what vulnerabilities might exist because of changes in those devices. So the information flow of, here's what's in the eco-sphere of a customer into Splunk is really helpful, and then the correlation that Splunk drives, so that Forescout gets even more intelligent on what corrective actions to what type of actions period do I take across this sea of devices is a really important and beneficial relationship for our customers. >> Excellent, so I'll give you the last word, little plug for Splunk.conf coming up in October. >> Yeah, I'm really excited about conf, excited to have you guys there again. We've been on a really intense innovation march for the past few years. This last conf we introduced 20 products at conf, which was a record. We're trying to keep the same pace for conf 2019 and I hope that everyone gets a chance to come, because we're going to both be, moving forward those products that we talked about, but, I think really surprising people, with some of the directions that were taking, the investigate, monitor, analyze and act capabilities both as a platform and for security IT and our other key buy-in centers. >> Alright, well we'll see you there Doug, thanks for stopping by. >> Thank you, Jeff. >> Great seeing you. >> He's Doug, I'm Jeff, you're watching theCUBE, we're in the Forescout booth at RSA Conference 2019, thanks for watching we'll see ya next time. >> Thank you. (electronic music)

(energetic music) >> Live from Orlando, Florida, it's theCUBE covering .conf 18, brought to you by Splunk. >> We're back in Orlando, Splunk .conf 2018, I'm Dave Vellante, Stu Miniman, and this is theCUBE, the leader in live tech coverage. Doug Merritt is here, the CEO of Splunk, long time CUBE guest, great to see you again. >> Thank you, Dave, great to be here. >> So, loved the keynote yesterday and today. You guys have a lot of fun, I was laughing my you-know-what off at the auditions. They basically said, Doug wasn't a shoo in for the keynote, so they had these outtake auditions. They were really hilarious, you guys are a lot of fun. You got the great T-shirts, how do you feel? >> It's been a, my favorite time of year is .conf, both because there's usually so much that we're funneling to our customers at this time, but being here is just infectious, it's, and one of the things that always amazes me is it's almost impossible to tell who are the customers and who are the employees. That just, I think Devonia this morning said it's a family affair, and it's not just a family affair, it's that there's a shared passion, a shared, almost culture and value set, and there's, it just is a very inspiring and naturally flowing type of event and I know I'm biased because I'm the CEO of Splunk, but I don't, I just don't know of events that feel like our, like .conf does. There's a lot of great shows out there, but this has got a very unique feel to it. >> Well, we do a lot of shows, as you know, and I've always said, .conf, I think ServiceNow, does a great job obviously, re-invent the tableau shows. That energy is there, and the other thing is, we do, when we go to these shows, a lot of times, you'll look at the keynotes and say, are there any products being announced? You guys, that wasn't a problem here. You guys announced this -- >> Not this year. >> Bevy of products, I mean, it's clear the R and D is translating into stuff that people can consume, and obviously that you can sell, so that's huge. >> I'm really excited about the product roadmap right now, and it's, that was, when I got the job, almost three years ago, one of the key areas I leaned forward and the board was excited about it was, what, where or how are we going to take this product beyond the amazing index and search technology that we have? And this show, it takes a while to progress the roadmap to the point that you can get the type of volume that we have here, but this show was the first time that I felt that we had laid enough of the tracks, so you could see a much, much broader landscape of capabilities, and now it's a challenge of packaging and making sure our customers are successful with it, with the product that we just have, the products we've announced. >> Cloud caught a lot of companies and a lot of end user companies, flatfooted. You guys have embraced the cloud, not only with the AWS partnership, which we're going to talk about, but also the business model. You're successfully transitioning from a company with perpetual license model, to a ratable model, which is never easy. Wall Street is killing companies who try to do that. Why have you been successful doing that? You know, give us an update. >> Yeah, so five years ago, less than 20% of our contracts were, had any type of subscription orientation to it, whether it's a multi-year term or a cloud. We'd just launched our cloud four years ago. And we moved from there to we had told the street there would be 65% term in subscription by the end of this year and updated guidance at the end of the second quarter, which is just a month and change ago, that we've already hit the 75% mark that we were set in for next year, so it's been a pretty rapid progression and I think there're two elements that have helped us with that. One: cloud continues to catch fire and so the people's orientation on "Do I do something in the cloud?" four years ago they were much more nervous, so less nervous today. But data is growing at such a huge rate and people are still wrapping their heads around, "How do I take advantage of this data, how do I even begin to collect this data and then how do I take advantage of it?" And the elasticity that comes in the cloud and that comes with term contracts, we can flex out and flex back in, I think it's just a much more natural contracting motion than you bought this big, perpetual thing and pay maintenance on it, especially when someone is growing as fast as data is growing. >> Well and it requires you to communicate differently to the financial analysts. >> It does. >> Obviously, billings, you know, was an important metric. You've come up with some new metrics to help people understand the real health of the business. And one of the other metrics that strikes me, and you see this with some of the successful companies, I actually think Aneel Bhusri was sort of the modern version of this, is the number of seven figure deals. You're startin' to hit that, and it's not, the way he's phrased it was pretty good. It's not something you're trying to engineer, it's the outcome -- >> Yes. >> of having great, loyal customers, it's not something you try to micromanage. >> Right, and that's, just recently we dropped six figure deals, which, when I joined, you got this wonderful dynamic forecasting system that sits on top of sales for us, and so as head of sales, where I started, you're really paying attention to deals. I'd go down to a hundred thousand dollar deals that would track throughout the quarter. And now it's hard to get it down to the six figures 'cause we've got a big enough envelope of seven figure deals. So the business has changed pretty dramatically from where it was, but it is an outgrowth of our number one customer priority, which is, or number one corporate priority, which is customer success. 'Cause that investment by companies, when you get to a million dollars plus, in most cases that's a million annually, you better believe in and trust that vendor, 'cause that's no longer an easy, small departmental sale. You're usually at the CIO, CFO type level. So it's something that we're very honored by, that people trust us enough to get that footprint of Splunk to be that size and to feel like they're getting a value from Splunk to justify that purchase. >> Alright we'll get off the income statement, Stu, and you can read about all that stuff, and we're going to get into, we've got a lot of ground to cover with you, Doug. Jump in here, Stu. >> Yeah, so Doug, I've really enjoyed talking to some of your customers that, you know, most of them started on premises with you and now many of them, they're using Splunk cloud, it's really kind of a hybrid model, and it's been really interesting to watch the maturation of your partnership with Amazon, and being the leader in the cloud space. Give us a little bit of color as to what you're hearing from the customers, you said three, four years ago, you know, they were obviously a little bit more cautious around it, and bring us inside a little bit that partnership. >> Sure, so the first piece that, as part of Splunk, that I think is a little bit different than other vendors is because we are both a lower level infrastructural technology, right, data is, the way I frame what we do is there's these raw materials, which are all these different renditions of data around, and companies increasingly have to figure out how to gather together these different raw materials, put them together different ways, for the output that is driving their business. And we are the manufacturing parts provider that makes it easy for them to go and pick up any of these different compounds and then actually do what they want to do, which is make things happen with data. And that middle layer is really important and we have never taken a super strong stance either, we started on prem, but as we moved to cloud, we never took a strong stance saying everything should be in the cloud or everything should be on prem because data has gravity, there is physics to data. And it doesn't always make sense to move data around and it doesn't always make sense to keep data stagnant, so having that flexibility, being able to deploy your collection capability, whether it's ours or third party, your storage capability, and then your process and your search, what are you going to do with the data, anywhere that makes sense for a customer, I think, is important. And that's part of that hybrid story, is as people increasingly trust and interview us and other cloud vendors to build core apps and then house a lot of their data, we absolutely need to be there. And I think that momentum of the cloud is certainly as secure and, in many cases, more secure than my on prem footprint, and the velocity of invention that some like ABDS is driving allows me to be much more agile and effectively drive application development and leading edge capability, I think just has people continuing to trust the cloud service providers a little bit more. >> Yeah well, we're here in the pavilion, and seeing your ecosystem grow, we've been at re:Invent for about five years, that ecosystem is just so >> It's been amazing. >> massive and full, give us a little bit about the relationship with Amazon and how you look at that, how Amazon looks at a company like yours. >> Yeah, it's been, so one, whenever you're playing with a highly inventive and hugely successful company like Amazon, my orientation and what I convey back to the company is our job is to be more inventive, more agile, and continue to find value with our maniacal focus every day being the data landscape. Data is a service and outcomes is a service, so our job is run faster than Amazon. And I think that this show and our announcements help illustrate that our invention cycle is in high tilt gear and for what we do, we are leaning in in a really aggressive way to add that value. With that backdrop, Andy and I formed this partnership four years ago. He felt there's enough value in Splunk and we were a good enough partner and the way we consume their services that he would commission and quota their sales reps whenever a Splunk sale was done in the ADBS landscape, which I think has been really helpful for us, but we obviously are a huge customer of ADBS's and they become an increasingly large customer of ours and finally gave us approval with their three year renewal a quarter ago to publicly reference them as a sizeable customer for us. >> Oh, okay, congratulations on that. And something I've really, it's really crystallized for me: so many administrators out there, you look at their jobs, you know, what are they? It's like okay, I'm the security expert, I'm the network certified person. You're really, your users here, you know, they are the beacons of knowledge, they are the center of data, is really what they are. You know, Splunk's a tool, they're super excited about the product, but it's data at the center of what Splunk does and therefore, you're helping them in just such a critical aspect of what is happening in the industry today. >> Yeah, the key aspects of the keynote, of my keynote, were we are moving to a world where data is the product that people care about so the whole object is how do you make things happen with data and the people that can get that done increasingly are becoming the most valuable players on the field, so what infrastructure, what tooling, what capability exists that allows people from all departments, you know, we're very heavy within IT and security, but increasingly HR departments, finance departments, marketing departments, sales departments, manufacturing departments will not be successful without a really competent group of folks that understand how to make things happen with data and our job is to lower that bar so you don't have to go to Carnegie Mellon for four years and get a Masters in Computer Science and Data Science to be able to be that most valuable person on the field. >> I want to take a moment, I want to explain why I'm so bullish on Splunk. We had a conversation with Susan St. Ledger yesterday. Digital transformation is all about data. >> Yup. >> And you guys are all about data, there's the cliche which is "data is the new oil" and we've observed, well not really. I could put oil in my car, I can put oil in my house, I can't put it in both places, but data? I can use that same data in a lot of different use cases and that's exactly what you guys are doing now as you expand into line of business -- >> Yup. >> With Splunk Next. >> Yup. >> So you've announced that, you showed some cool demos today. I'd like you to talk about how you're going from your core peeps, the IT ops guys and the sec ops guys, and how, what your plan is to go to lines of business. More than just putting the data out there, you've come up with some new products that make it simpler, like business work flows, but what else are you doing from a go to market standpoint and a partnership standpoint, how do you see that playing out? >> Yeah, I think that the innovation on product, there are three key pillars that we're focusing on. Access data, any type of data, anywhere it lives. Make sure that we're driving actionable outcomes with that data, and acquisitions like Phantom and VictorOps have been a key pillar of that, but there's other things we're doing. And then, expand the capability of finding those outcomes to a much broader audience by lowering the bar. So the three key themes across the portfolio. But all of those are in service of the developers at a customer site, the developers in the ecosystem, to make it easier for them to actually craft a set of solutions that help a retailer, help a discrete manufacturer, help a hospital actually make things happen with data. 'Cause you could certainly start with a platform and build something specific for yourself but it's much easier if you start with a solution. And a lot of the emphasis we've been putting over the past two to three years is how do we up that platform game. And the many, many, 20 different product announcements that we rolled at this .conf and one of them that I'm also very excited about is our developer cloud where we've really enhanced the API layer that interacts with the different services that the entire Splunk portfolio represents. Not just the search and index pieces that people are familiar with but everything from orchestration to role based access to different types of visualization so a very broad API layer that's a well-mannered, restful set of APIs that allows third parties to much more crisply develop, excuse me, applications to compliment the 1800 apps that are already part of our Splunk base and right behind me is a developer pavilion where we've got the first hand full of early adopter OEM partners that are building their first sets of apps on top of that API framework. >> Dozens of them, it's actually worth walking around to see. Now, so that developer cloud is a lever, those developers are a lever for you to get into lines of business and build those relationships through the software, really, and through the apps. Same thing for IOT. >> Yup. >> Industrial IOT. Now, we've observed, and a lot of the IT companies that we see are trying to take a top down approach into IOT and we don't think it's going to work. It's, we talk about process engineers, it's operations technology people, they speak a different language. It's not going to be a top down, here, IT. >> A very different audience. >> It's going to be a bottoms up set of standards coming from the OT world. The brilliance of what you guys have, it's the data, you know, it's data coming off machines, data, you don't care. And so, you're in a good position to do a bottoms up in IOT and we heard some of that today. Now, there are some challenges. A lot of that data is still analog, okay, you can't really control that. A lot of the devices aren't instrumented, they're not connected, you can't control that. But once they become instrumented and connected and that analog data gets digitized, you're in a really good position, but then you got to build out the ecosystem as well. >> Yup. >> So talk about how you're addressing some of those challenges in industrial IOT. >> Yup, man, it's a great subject 'cause I think that the trying to rely on standards is the wrong approach. The velocity across this digital landscape is so high and my view over the past 30 years, I think it's only accelerated now, is there's going to be more and more varieties of data with different formats than there's ever been, and we've seen it in the past five years. Just look at the variety of services on top of AWS, which didn't even exist ten years ago, but and they now have hundreds of services and there is no organizing principle across those services as far as data definition. So it's a very chaotic data landscape and I don't think there's any way to manage it other than to embrace the chaos and work a little bit more bottoms up, you know, grab this data, don't worry about cleansing it, don't worry about structuring it, just make sure you have access to it and then make sure that you've got tools like Splunk that allow you to play with the data and try and find the patterns and the value inside of that data, which is where I think we're very uniquely suited as a technology set. Helping the ecosystem come to that realization is a key aspect of what we're doing. We're trying to attack it the same way we attacked the IT security piece which is pick a handful of verticals and really focus on the players, both the marquis anchor tenants, the BMWs, the Siemens', the Deutsche Bahn railroads of the world, as customers. And through that, get access to the key influencers and consultants and advisors to those industries and start to get that virtuous circle of "I actually have more data than I think I have." Even though there's some analog machines, there's so many different ways to attach to the signal that those machines are emitting and it may not be bi-directionally addressable, but at least you can see what's happening within those machines without a full manufacturing floor rip and replace. And everyone is excited about doing that. The advisors to the industry are excited, the industry themselves are excited. We had BMW on stage who walked through how they're using Splunk to help on everything from product design all the way through to predictive maintenance and feedback on the quality of the cars that they're rolling out. We've all heard stories that there's more lines of code in the Ford F150 and these other vehicles than there is within Facebook right now, so we all are dealing with rolling and sitting in building's and house's data centers. How do you make sure that you're able to pay attention what's happened within that data center? So I think that that is as big or bigger of an opportunity than what we've done with IT and security, it just has its own pace of understanding and adoption. >> Carnival Cruise Line, another one, Stu. We had those guys on today and they basically look, they have a lot of industrial equipment on those ships, so they're excited. >> Yeah, absolutely. Alright, so Doug, we started the beginning talking about the last couple years, how we measure Splunk has changed. Going to more subscription models, talk about how many customers you have. I look at developers, I look at IOT, whole different set of metrics. So if you look at Splunk Next, how do we measure you, going forward? What is success for your team and your customers going forward? >> Yeah, and the whole orientation around Splunk Next, as I'm sure Susan covered, it's not a product, it's a messaging framework. People are so used to Splunk being all about the collection of data within the index and searching in said index, and we're increasingly moving, we're complementing the index, the index is a incredibly unique piece of IP for us. But there's a lot of other modalities that can complement what that index does and Splunk Next represents all of our investments in next generation technologies that are helping in with everything from stream processing to distributed compute capability, next generation visualizations, et cetera. The metric that I care about over time is customer adoption and customer success. How many use cases are being deployed at different customers? How many companies, both customers and partners, are incorporating Splunk in what they do every day? You're getting OEM Splunk, making Splunk a backbone of their overall health and success. And ultimately that needs to translate into revenue, so revenue and bookings will always be a metric that we care about, but I think the leading indicators within theses different markets of rate of adoption of technology and, more importantly, the outcomes that they're driving as they adopt this technology, are going to be increasingly important. >> Yeah, I just have to tell you, when you talk about your customers not only excited, but it's a deeper partnership when you talk to insurance company out of Toronto that, like, they're talking to the people that they insure about, should they be using Splunk and how do they do that. It just, a much deeper, and you know, deeper than a partnership model for your customers. >> It's one of the things I love about this conference, is it's, we were talking about earlier, it's hard to tell the customers from the employees, like, there's a, there's a, this whole belief and purpose that everybody shares, which I adore about being here. But when you look at a sea of data, we've thought traditionally looked at the data we manufacture, typically data that's historic and at rest from our ERP systems. This next wave is certainly all the data that's happening within our organizations but increasingly it's all the data that's available in the world at large. And whether it's insurance or automotive or oil and gas, the services that I'm going to have to deliver to customers require me to farm data outside of my walls, data inside my walls, combine those two, to come up with unique value added services for my customers. So it's great to hear that, that our customers are on that journey 'cause that's where we all need to go to be successful. >> And there's a definitely alignment there. Doug, I know you're super busy, we got to go. Thanks so much for coming on theCUBE. Give you the last word, .conf 18 takeaways. >> (laughs) Unbelievable excitement and enthusiasm. A huge array of products that, I think, broaden the aperture of what Splunk does so dramatically that people are really trying to digest, "What should, how should I be thinking about Splunk moving forward?" And I'm, we started a whole series of transformations three years ago, and I'm really excited that they're all starting to land and I can't wait for the slow realization of the impact that our customers are counting on us to provide and that we'll increasingly be known for across the data landscape. >> Well and the landscape is messy and, as you said, the messiest part of that landscape is the data landscape. You guys are helping organize that, curate it. And hopefully we're helping curate some of the, from some of the noise and distracting to the signal to you on theCUBE. Doug, thanks so much for coming on theCUBE, great to see you again. >> Thank you Dave, thank you Stu, you guys do a great job. >> Thanks, we appreciate that. >> Thanks for being here with us. >> Alright, keep it right there, buddy. We'll be back with our next guest from .conf 18 from Orlando, we'll be right back. (digital music)

(upbeat music) >> Live from Orlando, Florida, it's theCUBE covering .conf18. Brought to you by Splunk. >> Hello everybody, welcome to Orlando. This is theCUBE, the leader in live tech coverage, and we're here at Splunk conf .conf 2018. The hashtag is #splunkconf18. My name is Dave Vellante, I'm here with my co-host Stu Miniman. Stu it's great to be in Orlando again. Last year we were in D.C. This is our seventh year covering Splunk.conf and we've seen the company really move from essentially analyzing log files on PRAM in a perpetual license model, to now a company that is permeating all of IT into the lines of business. Security, IT performance, application performance, moving into IOT. Really becoming a mature company. It's a company with $1.7 billion in revenue forecasted for this year. They were talking about a $17 billion market cap, they're growing at 36%, and they're a company Stu, that is in the process of successfully going from a perpetual license model to a renewable model. Splunk set the goal of being 75% renewable by 2020. Sounds like renewable energy, but repeatable renewable from a subscription standpoint, they're already there. So you're seeing that in the execution. This is your first .conf, or conf as they like to say. We were at the ESPN Wide World of Sports Center, you saw what, what's the number, 8,000 people? >> Yeah I think 8,000 at the show this year, it's strong growth, and Dave I've been hearing from the team for years the excitement of the show, the passion of the show, saw like, right over near where we were sitting there's the whole group of that was the Splunk trust. They've got the fezzes on, a lot of them have superhero capes on, and it's what you'd expect from a passionate, technical maybe even geeky audience. Things like, we're announcing the S3 API-compatible storage. Everybody's like, yay we're so excited for this. It's hardcore techies. >> What was the other big clap? Screen? >> Yeah, that's right dark mode. We're going to go to dark mode, I don't have to play with the CSS. Anybody that's played with a website, changing these things is not trivial. I click a little button and the joke was this was the bright one for the executives, but when I'm down in the gamer center I don't want this glaring screen here, so I can switch it over to dark mode. And people were pretty excited about that. >> So again the roots of Splunk, they took log data and analyzed it. Doug Merritt the CEO, talked today talked about, making things happen with data. I thought he did a really good job of laying out the past, putting the past behind us in terms of he said, "I've been to I can't tell you "how many Master Data management classes "trying to optimize the database, "trying to codify business processes "and harden those business processes." The problem is data is messy. Data is growing so fast, business processes are changing so fast, the competition is moving so fast, customers are changing. So you have to be able to organize your data in the moment. So, the whole idea that, even go back to the early big data days and Hadoop, the whole idea was to bring five megabytes of compute to a petabyte of data. And no schema on write, or what some call schema on read. Splunk was really a part of that. Put the data, get the data organized in a way that you can look at in in a moment, but then let the data flow. So that has definite implications in terms of how you think about data. It's not trying to get the data all perfect so you can use it, it's trying to get the data into your data ocean, as we like to say, and then have the tooling to be able to analyze it very, very quickly. They announced Splunk 7.2 today which is a big deal. Some things, we'll talk about a few of the features, obviously focused on performance, but one of the things they talked about was basically being able to split storage and compute. So previously you had to add essentially a brick of storage and compute simultaneously. We've heard about these complaints for years in the conversion infrastructure space, it's obviously a problem in the software space as well. Now customers are able to add storage or compute in a granular fashion, and they're cozying up to Amazon doing S3 compatible store. >> Dave, I love that message that he put out there you said, "life is messy. "You can't try to control the chaos, "you want to be able to ride those waves of data "take advantage of them and not overly "make things rigid with structure." Because once you put things in place you're going to get new data or something else that's going to come along and your structure is going to be blown away. So when you need to search things you want to be able to look at them in that point in time but be able to ride those waves, flow with the data, live the way your data lives. That's definitely something that resonates in this community. Dave, something I've watching this space, as an infrastructure guy and watching the Cloud movement, there were a lot of reasons why traditional big data failed. I kind of never looked at Splunk like most of those other big data companies. Yes they had data, yes they're part of the movement of taking advantage of data, but they weren't, oh well we have this one tool that we're going to create to do it all, like some of the new players. They're playing with all the latest things. You want tentraflow, you want to do the A.I, the ML. Splunk is ready to take advantage of all of these new waves of technologies, and they've done a couple of acquisitions like VictorOps in the space that they keep growing and the goal is, you mentioned the revenue, but Splunk today has I think it's 16,000 customers. They have a short term goal of getting to 20,000 but with what they started talking about in the keynote today, Splunk Next, they really want to be able to do an order of magnitude of more customers and when you get great customer examples like Carnival Cruises. The CEO I thought, talked about the sea of data. Lots of good puns in the keynote there but mobile cities floating around and lots of data that they want to be able to get the customer experience and make sure the customer gets what they need and make sure that Carnival knows what they have to make sure that they're running better and optimizing their business too, so great example. Looking forward to talking to them on theCUBE. >> Well and they have many dozens, I think it's in last quarter, it was like 60 plus deals over a million dollars. They have many $10 million plus deals. That's an outcome of happy customers, it's not like they're trying to engineer those deals. I'm sure some of the sales guys would love to do that. But that's a metric that I think was popularized by the likes of Aneel Bhusri at Workday, certainly Frank Slootman at ServiceNow. It's one that Wall Street watches and Splunk it's an indicator. Splunk is doing some very very large deals that underscores the commitment that many customers are making to Splunk. Having said that, there are many more that are still smaller users of Splunk. There's a lot of upside here. And they're going into a serious TAM expansion that's something we're going to talk to Doug Merritt about. Making acquisitions of a company, VictorOps was their most recent acquisition sort of security orchestration and management. They're doing, the ecosystem is growing, they're doing bigger deals or partnerships with the likes of Accenture, Deloitte is here, EY. Accenture actually has a huge space at this event, and those are indicators. I want to go back to something you said earlier about the failure of big data. Certainly big data failed to live up to the hype in many ways. You didn't see a lot of wholesale replacement of traditional databases and EDWs. You did see a reduction in cost, that was the big deal. But clearly enterprise data warehouses and ETL, they're still a fundamental part of people's data strategies despite what Doug Merritt saying, hey, the data is messy and you've just got to let it flow, essentially what he's saying. There is still a need for structured data and mixing, sort of, interacting of structured and unstructured data. Bringing transaction data and systems of intelligence together, analytic data. But the one thing that big data did do and the Hadoop movement, it did a couple things: one is, architecturally it pushed data out and back in the day you had to get a big Unix box and stuff everything in there. It was your god box of data. And you had Oracle licenses and Sun Microsystems boxes and it was very expensive. And you had a couple of people who knew how to get the data out. So the goal of democratizing data, what it did is, it is messy. Data went out to the distributed nodes and now the edge. But it brought attention to the importance of data and the whole bromide of data driven companies. And so now we're in a position to make a new promise and that promise is A.I, machine learning, machine intelligence, which seems to be substantive. We talk a lot on theCUBE is this old wine, new bottle? And we had an event in New York last month and the consensus from a lot of practitioners and others in the room was: no there's something substantive, the data substrate is now in place. Now it's all about taking advantage of it. Tooling is still complex but emerging or evolving. And I think the cloud, to your point, is a huge part of that. By integrating data pipelines in the cloud it dramatically simplifies the deployment model and the complexity of managing big data. >> Yeah, Dave, as you said, there used to be these giant boxes and some of these initiatives I needed 18 months, you know, millions of dollars and a large time you either need to be a country or a multi-national company to be able to put this thing together. I remember one of the earliest case studies that David Floyer did when we were looking at big data it was how do I take that 18 month deployment and drive it down to more like a six week deployment, and when you talk about A.I, ML, and deep learning, the promise is that a business user should be able to get answers in a much much shorter window. So actionable on that data, being able to do things with it not just looking backwards but hear the team. So I want to be able to be proactive, I want to be able to be responsive. I want to even predict what my client is going to need and be ready for it. >> So as Doug Merritt said that digital and physical worlds they're coming together. They don't stop evolving. They're organic. Your data model has to be flexible. It's a sea of data. It's an ocean of data. It's not a confined data lake, as John Furrier and others like to say. And so I was happy to hear Doug Merritt talking about a sea. We use the term oceans because that's really what it is. And oceans are unpredictable, they're sometimes really harsh, they can sometimes be messy. But they're constantly evolving and so I think that kind of metaphor works in this world of Splunk. We've got two days here of coverage. A lot of customers coming on today, in fact, Splunk is one of those companies that puts many customers on theCUBE, which we love. We love to dig in to the case studies. We've got some ecosystem partners. Some of the big SIs are coming on and of course, we're going to hear from some of the product people at Splunk that go to market people. Doug Merritt will be on tomorrow. And a number of folks. I'm Dave Vellante, @DVellante on Twitter. He's @Stu. Stu Miniman. Keep it right there, buddy. We'll be back with our next guest right after this short break. You're watching day one from Splunk conf18 in Orlando. Be right back. (soft bouncy music)

>> Narrator: Live from Washington D.C. it's The Cube, covering .comf 2017. Brought to you by Splunk. >> Welcome back to the district everybody. We are here at .comf 2017. This is The Cube, the leader in live tech coverage. I'm Dave Vellante with my co-host George Gilbert. Doug Merritt here, the CEO of Splunk. Doug, thanks for stopping by The Cube. >> Thanks for having me here Dave. >> You're welcome! Good job this morning. You are a positive guy, great energy. You got the fun T-shirt, I like big data and I cannot lie. The T-shirts I love, so great. You guys are a fun company. So congratulations. >> Doug: Well thank you. >> How's it feel? >> It feels great. You're surrounded by 7,000 fans that are getting value out of the products that you distribute to them and the energy is just off the charts as you said. It's truly an honor to be able to be surrounded by people that care about your company as much as these people do. >> Well one of the badges of honor that Splunk has at your shows is spontaneous laughter and spontaneous applause. You get a lot of that. And that underscores the nature of your customer base and the passion that they have for you guys so that's a pretty good feeling. >> From the very beginning, from the first code that Erik Swan and Rob Dos pushed out, the whole focus has been on making sure that you please the user. The attendance that they created to drive Splunk still stand today and I think a lot of that spontaneous laughter and applause goes back to if you really pay attention to your customer and you really focus all your energy on making sure they're successful, then life gets a lot easier. >> Well it's interesting to watch the ascendancy of Splunk and when you know, go back to 2010, 2011, everybody was talking about big data, it was the next big thing, Splunk never really hopped on that meme from a narrative standpoint. But now you kind of are big data. You kind of need big data platforms to analyze all this data. Talk about that shift. >> I still don't think that we are the lead flag waver on big data. And I think so much of that goes back to our belief on how do you serve customers? Customers have problems and you've got to create a solution to solve that problem for them. Increasingly in these days, those problems can be solved in a much more effective way with big data. But big data is the after effect. It's not the lead of the story, it's the substantiation of the story. So what I think Splunk has done uniquely well is, whether it's our origins in IT operations and systems administration or our foray into security operations centers and analytics and security analyst support. As we started with what is the problem that we're trying to solve. And then because we're so good at dealing with big data, obviously we're going to take a unstructured data, big data approach to that problem. >> So about two years in, you were telling us off camera about the story of Splunk has a tendency to be a little ADD. You came in, helped a little prioritization exercise, but what have you learned in two years. >> Ah, infinite. You have to have an hour for that. I think part of the ADD is because the platform is so powerful, it can solve almost any problem. And what we need to do to help our customers is listen to them and figure out what are the repeat problems so that we can actually scale and bring it to lots of different people. And that's been part of that focus problem or focus opportunity we have, is if you can solve just about anything, how do you help your customers understand what they should do first, second and third. I think that's part of the dilemma we see in the big data space, is people started with I want to just amass all the data. And I think that was a leftover to where big data, George and I were talking about this, where those big data platforms started from. If I'm Yahoo, if I'm Google, if I'm LinkedIn, if I'm Facebook, the guys that originated MapReduce and the whole Hadoop ecosystem, my job is data. Literally, that's all I have, that's all I monetize and drive. So I both have the motivation and the technical engineering knowhow to just put every bit of data I possibly can somewhere for later retrieval. But even those organizations have a hard time really optimizing that data. So if the average or ar-din-e-ah start in a different spot. It's not just put everything somewhere that I can later retrieve it, it's what problem are you trying to solve, what data do I need to solve that problem and then how do I use it, how do I bring it into something and then visualize it so that I get immediate payback and return and that's, I think you guys talked to Mike Odi-son on the show, he was in my keynote, that's a lot of the magic he brought to Get-lick and to Dubai Upworks is, let's just start with can we get people through security in five minutes or less? What data do we need? And then you can move on to the next problem and the next problem. But I think it's a more practical and more effective way of looking at big data is through a customer solution lens. >> Dave: Yeah great story Dubai Upwork. Go ahead George. >> When you look at the customer adjacencies, are you looking at what is the most relevant next batch of data relative to what I've accumulated for the first problem? Or is it an analytic solution that addresses a similar end customer, similar department? How do you find those adjacencies and attack them? >> So the good news and the beauty of Splunk is it's not difficult to get data into the platform. When you do the surveys on data scientists and I think Richard talked about this in his keynote, they all unanimously come back and say, "We spend 60 to 80% "of our time just trying to wrangle data." Well that's not super hard for them. How do you get data in quickly? So we've always been effective at getting massive amounts of data because of the way that we architect the system in. The challenge for us is how do you marry domain expertise and the different algorithms, queries or usage the data so you get that specific solution to a problem? So we've built up a whole practice of looking at the data sources that are in. What do we know from our customer base that says here are the top end use cases that have been able to take advantage of those data sources for these outcomes. And that's how we try to work with customers to say, "Alright you've already brought server logs, "firewall logs and API streams from these four "A to B odd services into Splunk. "I've already got this benefit. "What are the next two things you can do "with that data to get additional benefit?" >> So in a sense, you've got a template for mapping out a customer journey that says, "Here are the next steps." It's like a field guide to move them along in maturity. >> Dave: And you can codify that? >> That's been the hard part is both creating the open source contribution framework, for lack of a better word, what are all these different uses? But the final mile or final inch that most of these customers are trying to drive to is different for every single customer. And that's again, part of what the challenge is with AINML and what we were highlighting on stage this morning. There's two different dimensions, three different dimensions you're dealing with simultaneously. One is what data sets are you bringing together? And as you add different data it radically changes the outcome. What algorithms are you driving? And as you tweak an al-go, even on the same data, it radically changes the outcome. And then what functional lens are you putting in place? And so if you want to solve baggage handling at the airport like one of Michael Epperson's guys, you need some rich aviation and logistics experience to actually understand that to mean how do you bring that to main set together with the actual data that the algorithms and the data sets you get that rapid piece. And so creating enough of those so they're easily digestible and easily actionable by our customers, that is the horizon that we're trying to pierce through. >> And that leads to an ecosystem question, does it not? >> Doug: It does. >> Is that the answer or part of the answer for that mile or last inch that micro vertical. >> That's a huge chunk of the answer. Because you just go back to I need that domain expertise. And pharmaceutical drug exploration expertise is different than general healthcare medical expertise. If you're not able to bring that practical experience with the ability to easily wrangle data and some data scientists that can write these really interesting and effective ML routines, then it's difficult to get that value. >> So I know you'll jump in here in a second, so what are you guys doing explicitly on that front? Where does that fall in the priority list? Is it percolating? >> So many points made Splunk unique from the very beginning. A whole host of things. But one is we made it accessible for an average person to get data in, to store data and to extract value. A lot of the technologies that are out there, you can cobble together and eventually get to Splunk but it's really long, painful and difficult. If you take that same orientation around this now over-hyped MLAI world, it's the same thing, how do you raise the bar so that an average person on an average day with domain expertise and some understanding of data can find ways to get value back out. So I think there's certainly a technology problem because you've got to be able to do it at scale, at speed with integrity. But I think it's almost as much or maybe more of a user interface, an approachability problem 'cause there's just not enough data scientists and data experts that are also computer science experts to go around and solve this problem for the world. >> So it sounds like there's two approaches. There's the customer specific last mile and then what you were talking about earlier, sort of in the keynote and the (mumbles) breakout, which is try and find the horizontal use cases that you can bake into what Richard called curated experiences, which is really ML models that need minimal, light touch from the customer. >> Doug: Yes. >> So help us understand how those can build out with the customer last mile and then the customer wakes up with a platform. >> We have over 1,500 solutions as part of Splunk base which really are those mini curated experiences. From my Palo Alto environment, a combination of Palo Alto, us and third parties created Palo Alto Solution that is able to read data in from the different Palo Alto technologies and provide Dash, Borge, Alert, Remediations how to really assist the Palo Alto team doing their job more effectively. So there's over 1,500 of those in Splunk base. What Rick and the IT operations and App Dev arena and high end security arena are responsible for is how do we continue to gen up the ecosystem so we get more and more of those experiences? How can we extend from Palo Alto firewalls to overall network and perimeter visibility? Which is a combination now of breeding in Palo Alto firewall logs plus the other firewall technologies they likely have, plus network data, plus endpoint data so we can get visibility. And that almost always is a hyper heterogeneous environment, especially when you start to drive the applications (mumbles), maybe some in GCP, maybe some in Azure. They all have different formats. They've got different virtualization technologies that represent all those different on prime renditions. So I think that the world continues to get more complex. And the more that we can help the community, corral the community into here are buying centers and here are pinpoints, use the technology to finish and deliver that curated experience, the easier it is and the better it is for our customers. >> Doug I know you're super busy and you got to go, so last question. We've seen Splunk go from startup, pre IPO, successful IPO, couple bumps along the way. Now you guys are over a billion dollars. I feel like there's much more to come. The ecosystem is growing, the adoption is really, really solid. The richness of the platform continues to grow. Where do you see it going from here? >> I really do believe in my heart, my deepest heart, that this is the next five, ten, 20 billion dollar organization out there. And it's less the money than the representation of what that means. Reaching millions to tens of millions to hundreds of millions of people with these curated experiences, with these solutions within sights across hundreds of thousands to potentially millions of different entities out there, organizations, whether it's non-profit, governmental, commercial. We are, Mark Endreessen is famous for saying, "The world is becoming a software world." I agree. I take it one step further. I think the world is becoming a data driven and a data inside world. Software is key to that but you implement software so you can get insights and be intelligent and sense and respond and continue to iterate and grow. And I believe that Splunk is the best position company and technology on the planet right now to lean in and make this practical and approachable for the millions of end users and the hundreds of thousands of organizations that need that capability. >> So much more to talk about with Doug Merritt. Thanks so much for coming brother. >> Thank you. >> Really a pleasure having you. >> Thank you George. >> Alright keep it right there everybody, we'll be back with our next guest. This is #splunkconf17, check that out. Check out #cubegems. This is The Cube. We're live, right back from the D.C. Bye bye. (electronic pulse music)

>> Narrator: Covering Data Works Summit Europe 2017 brought to you by Horton Works. (uptempo, energetic music) >> Okay, welcome back everyone. We're here live in Germany at Munich for DataWorks Summit 2017, formerly Hadoop Summit. I'm John Furrier, my co-host Dave Vellante. Our next guest is Mike Merritt-Holmes, is senior Vice President of Global Services Strategy at Think Big, a Teradata company, formerly the co-founder of the Big Data Partnership merged in with Think Big and Teradata. Mike, welcome to The Cube. >> Mike: Thanks for having me. >> Great having an entrepreneur on, you're the co-founder, which means you've got that entrepreneurial blood, and I got to ask you, you know, you're in the big data space, you got to be pretty pumped by all the hype right now around AI because that certainly gives a lot of that extra, extra steroid of recognition. People love AI it gives a face to it, and certainly IOT is booming as well, Internet of Things, but big data's cruising along. >> I mean it's a great place to be. The train is certainly going very, very quickly right now. But the thing for us is, we've been doing data science and AI and trying to build business outcomes, and value for businesses for a long time. It's just great now to see this really, the data science and AI both were really starting to take effect and so companies are starting to understand it and really starting to really want to embrace it which is amazing. >> It's inspirational too, I mean I have a bunch of kids in my family, some are in college and some are in high school, even the younger generation are getting jazzed up on just software, right, but the big data stuffs been cruising along now. It's been a good, decade now of really solid DevOps culture, cloud now accelerating, but now the customers are forcing the vendors to be very deliberate in delivering great product, because the demand (chuckling) for real time, the demand for more stuff, is at an all time high. Can you elaborate your thoughts on, your reaction to what customers are doing, because they're the ones driving everyone, not to create friction, to create simplicity. >> Yeah, and you know, our customers are global organizations, trying to leverage this kind of technology, and they are, you know, doing an awesome amount of stuff right now to try to move them from, effectively, a step change in their business, whether it's, kind of, shipping companies doing preventive asset maintenance, or whether it's retailers looking to target customers in a more personalized way, or really understand who their customers are, where they come from, they're leveraging all those technologies, and really what they're doing is pushing the boundaries of all of them, and putting more demands on all of the vendors in the space to say, we want to do this quicker, faster, but more easily as well. >> And then the things that you're talking about, I want to get your thoughts on, because this is the conversation that you're having with customers, I want to extract is, have those kind of data-driven mindset questions, have come out the hype of the Hadoob. So, I mean we've been on a hype cycle for awhile, but now its back to reality. Where are we with the customer conversations, and, from your stand point, what are they working on? I mean, is it mostly IT conversation? Is it a frontoffice conversation? Is it a blend of both? Because, you know, data science kind of threads both sides of the fence there. >> Yeah, I mean certainly you can't do big data without IT being involved, but since the start, I mean, we've always been engaged with the business, it's always been about business outcome, because you bring data into a platform, you provide all this data science capability, but unless you actually find ROI from that, then there's no point, because you want to be moving the business forward, so it's always been about business engagement, but part of that has always been also about helping them to change their mindset. I don't want a report, I want to understand why you look at that report and what's the thing you're looking for, so we can start to identify that for you quicker. >> What's the coolest conversation you've been in, over the past year? >> Uh, I mean, I can't go into too much details, but I've had some amazing conversations with companies like Lego, for instance, they're an awesome company to work with. But when you start to see some of the things we're doing, we're doing some amazing object recognition with deep-learning in Japan. We're doing some ford analytics in the Nordics with deep-learning, we're doing some amazing stuff that's really pushing the boundaries, and when you start to put those deep-learning aspects into real world applications, and you start to see, customers clambering over to want to be part of that, it's a really exciting place to be. >> Let me just double-click on that for a second, because a lot of, the question I get a lot on The Cube, and certainly off-camera is, I want to do deep-learning, I want to do AI, I love machine learning, I hear, oh, it's finally coming to reality so people see it forming. How do they get started, what are some of the best practices of getting involved in deep-learning? Is it using open-source, obviously, is one avenue, but what advice would you give customers? >> From a deep-learning perspective, so I think first of all, I mean, a lot of the greatest deep-learning technologies, run open-source, as you rightly said, but I think actually there's a lot of tutorials and stuff on there, but really what you need is someone who has done it before, who knows where the pitfalls are, but also know when to use the right technology at the right time, and also to know around some of the aspects about whether using a deep-learning methodology is going to be the right approach for your business problem. Because a lot of companies are, like, we want to use this deep-learning thing, its amazing, but actually its not appropriate, necessarily, for the use case you're trying to draw from. >> It's the classic holy grail, where is it, if you don't know what you're looking for, it's hard to know when to apply it. >> And also, you've got to have enough data to utilize those methods as well, so. >> You hear a lot about the technical complexity associated with Hadoop specifically, but just ol' big data generally. I wonder if you could address that, in terms of what you're seeing, how people are dealing with that technical complexity but what other headwinds are there, in terms of adopting these new capabilities. >> Yeah, absolutely, so one of the challenges that we still see is that customers are struggling to leverage value from their platform, and normally that's because of the technical complexities. So we really, we introduced to the open-source world last month Kaylo, something you can download free of charge. It's completely open-source on the Apache license, and that really was about making it easier for customers to start to leverage the data on the platform, to self-serve injection onto that, and for data scientists to wrangle the data better. So, I think there's a real push right now about that next level up, if you like, in the technology stack to start to enable non-technical users to start to do interesting things on the platform directly, rather than asking someone to do it for them. And that, you know, we've had technologies in the PI space like Tableau, and, obviously, the (mumbling) did a data-warehouse solutions on Teradata that have been giving customers something, before and previously, but actually now they're asking for more, not just that, but more as well. And that's where we are starting to see the increases. >> So that's sort of operationalizing analytics as an example, what are some of the business complexities and challenges of actually doing that? >> That's a very good question, because, I think, when you find out great insight, and you go, wow you've built this algorithm, I've seen things I've never seen before, then the business wants to have that always on they want to know that it's that insight all the time is it changing, is it going up, is it going down do I need to change my business decisions? And doing that and making that operational means, not only just deploying it but also monitoring those models, being able to keep them up to date regularly, understanding whether those things are still accurate or not, because you don't want to be making business decisions, on algorithms that are now a bit stale. So, actually operationalizing it, is about building out an entire capability that's keeping these things accurate, online, and, therefore, there's still a bit of work to do, I think, actually in the marketplace still, around building out an operational capability. >> So you kind of got bottom-up, top-down. Bottom-up is the you know the Hadoop experiments, and then top-down is CXO saying we need to do big data. Have those two constituencies come together now, who's driving the bus? Are they aligned or is it still, sort of, a mess organizationally? >> Yeah, I mean, generally, in the organization, there's someone playing the Chief Data Officer, whether they have that as a title or a roll, ultimately someone is in charge of generating value from the data they have in the organization. But they can't do that with IT, and I think where we've seen companies struggle is where they've driven it from the bottom-up, and where they succeed is where they drive it from the top-down, because by driving it from the top-down, you really align what you're doing with the business and strategy that you have. So, the company strategy, and what you're trying to achieve, but ultimately, they both need to meet in the middle, and you can't do one without the other. >> And one of our practitioner friends, who's describing this situation in our office in Palo Alto, a couple of weeks ago. he said, you know, the challenge we have as an organization is, you've got top people saying alright, we're moving. And they start moving, the train goes, and then you've got kind of middle management, sort of behind them, and then you got the doers that are far behind, and aligning those is a huge challenge for this particular organization. How do you recommend organizations to address that alignment challenge, does Think Big have capabilities to help them through that, or is that, sort of, you got to call Accenture? >> In essence, our reason for being is to help with those kind of things, and, you know, whether it's right from the start, so, oh, my God, my Chief Data Officer or my CEO is saying we need to be doing this thing right now, come on, let's get on with it, and we help them to understand what does that mean, what are the use cases, how, where's the value going to come from, what's that architecting to look like, or whether its helping them to build out capability, in terms of data science or building out the cluster itself, and then managing that and providing training for staff. Our whole reason for being is supporting that transformation as a business, from, oh, my God, what do I do about this thing, to, I'm fully embracing it, I know what's going on, I'm enabling my business, and I'm completely comfortable with that world. >> There was a lot talk three, or four or five years ago, about the ROI of so-called big data initiatives, not being really, you know, there were edge cases which were huge ROI, but there was a lot of talk about not a lot of return. My question is, has that, first question, has that changed, are you starting to see much bigger phone numbers coming back where the executives are saying yeah, lets double down on this. >> Definitely, I'm definitely seeing that. I mean, I think it's fair to say that companies are a bit nervous about reporting their ROI around this stuff, in some cases, so there's more ROI out there than you necessarily see out in the public place, but-- >> Why is that? Because they don't want to expose to the competition, or they don't want to front run their earnings, or whatever it is? >> They're trying to get a competitive edge. The minute you start saying, we're doing this, their competitors have an opportunity to catch up. >> John: Very secretive. >> Yeah and I think, it's not necessarily about what they're doing, it's about keeping the edge over their customers, really, over their competitors. So, but what we're seeing is that many customers are getting a lot of ROI more recently because they're able to execute better, rather than being struggling with the IT problems, and even just recently, for instance, we had a customer of ours, the CEO phones us up and says, you know what, we've got this problem with our sales. We don't really know why this is going down, you know, in this country, in this part of the world, it's going up, in this country, it's going down, we don't know why, and that's making us very nervous. Could you come in and just get the data together, work out why it's happening, so that we can understand what it is. And we came in, and within weeks, we were able to give them a very good insight into exactly why that is, and they changed their strategy, moving forward, for the next year, to focus on addressing that problem, and that's really amazing ROI for a company to be able to get that insight. Now, we're working with them to operationalize that, so that particular insight is always available to them, and that's an example of how companies are now starting to see that ROI come through, and a lot of it is about being able to articulate the right business question, rather than trying to worry about reports. What is the business question I'm trying to solve or answer, and that's when you can start to see the ROI come through. >> Can you talk about the customer orientation when they get to that insight, because you mentioned earlier that they got used to the reports, and you mentioned visualization, Tableau, they become table states, once you get addicted to the visualization, you want to extract more insights so the pressure seems to be getting more insight. So, two questions, process gap around what they need to do process-wise, and then just organizational behavior. Are they there mentally, what are some of the criteria in your mind, in your experiments, with customers around the processes that they go through, and then organizational mindset. >> Yeah, so what I would say is, first of all, from an organizational mindset perspective, it's very important to start educating, not just the analysis team, but the entire business on what this whole machine-learning, big data thing is all about, and how to ask the right questions. So, really starting to think about the opportunities you have to move your business forward, rather than what you already know, and think forward rather than retrospective. So, the other thing we often have to teach people, as well, is that this isn't about what you can get from the data warehouse, or replacing your data warehouse or anything like that. It's about answering the right questions, with the right tools, and here is a whole set of tools that allow you to answer different questions that you couldn't before, so leverage them. So, that's very important, and so that mindset requires time actually, to transform business into that mindset, and a lot of commitment from the business to make that happen. >> So, mindset first, and then you look at the process, then you get to the product. >> Yep, so, and basically, once you have that mindset, you need to set up an engine that's going to run, and start to drive the ROI out, and the engine includes, you know, your technical folk, but also your business users, and that engine will then start to build up momentum. The momentum builds more interest, and, overtime, you start to get your entire business into using these tools. >> It kind of makes sense, just kind of riffing in real time here, so the product-gap conversation should probably come after you lay that out first, right? >> Totally, yeah, I mean, you don't choose a product before you know what you need to do with it. So, but actually often companies don't know what they need to do with it, because they've got the wrong mindset in the first place. And so part of the road map stuff that we do, that we have a road map offering, is about changing that mindset, and helping them to get through that first stage, where we start to put, articulate the right use cases, and that really is driving a lot of value for our customers. Because they start from the right place-- >> Sometimes we hear stories, like the product kind of gives them a blind spot, because they tend to go into, with a product mindset first, and that kind of gives them some baggage, if you will. >> Well, yeah, because you end up with a situation, where you go, you get a product in, and then you say what can we do with it. Or, in fact, what happens is the vendor will say, these are the things you could do, and they give you use cases. >> It constrains things, forecloses tons of opportunities, because you're stuck within a product mindset. >> Yeah, exactly that, and you're not, you don't want to be constrained. And that's why open-source, and the kind of ecosystem that we have within the big data space is so powerful, because there's so many different tools for different things but don't choose your tool until you know what you're trying to achieve. >> I have a market question, maybe you just give us opinion, caveat, if you like, it's sort of a global, macro view. When we started first looking at the big data market, we noticed right away the dominant portion of revenue was coming from services. Hardware was commodity, so, you know, maybe sort of less than you would, obviously, in a mainframe world, and open-source software has a smaller contribution, so services dominated, and, frankly, has continued to dominate, since the early days. Do you see that changing, or do you think those percentages, if you will, will stay relatively constant? >> Well, I think it will change over time, but not in the near future, for sure, there's too much advancement in the technology landscape for that to stop, so if you had a set of tools that weren't really evolving, becoming very mature, and that's what tools you had, ultimately, the skill sets around them start to grow, and it becomes much easier to develop stuff, and then companies start to build out industry- or solutions-specific stuff on top, and it makes it very easy to build products. When you have an ecosystem that's evolving, growing with the speed it is, you're constantly trying to keep up with that technology, and, therefore, services have to play an awful big part in making sure that you are using the right technology, at the right time, and so, for the near future, for certain, that won't change. >> Complexity is your friend. >> Yeah, absolutely. Well, you know, we live in a complex world, but we live and breathe this stuff, so what's complex to some is not to us, and that's why we add value, I guess. >> Mike Merritt-Holmes here inside The Cube with Teradata Think Big. Thanks for spending the time sharing your insights. >> Thank you for having me. >> Understand the organizational mindset, identify the process, then figure out the products. That's the insight here on The Cube, more coverage of Data Works Summit 2017, here in Germany after this short break. (upbeat electronic music)

>> Announcer: From theCUBE studios in Palo Alto in Boston, bringing you data-driven insights from theCUBE and ETR. This is "Breaking Analysis" with Dave Vellante. >> The rapid pace of cloud adoption has changed the way organizations approach cybersecurity. Specifically, the cloud is increasingly becoming the first line of cyber defense. As such, along with communicating to the board and creating a security aware culture, the chief information security officer must ensure that the shared responsibility model is being applied properly. Meanwhile, the DevSecOps team has emerged as the critical link between strategy and execution, while audit becomes the free safety, if you will, in the equation, i.e., the last line of defense. Hello, and welcome to this week's, we keep on CUBE Insights, powered by ETR. In this "Breaking Analysis", we'll share the latest data on hyperscale, IaaS, and PaaS market performance, along with some fresh ETR survey data. And we'll share some highlights and the puts and takes from the recent AWS re:Inforce event in Boston. But first, the macro. It's earning season, and that's what many people want to talk about, including us. As we reported last week, the macro spending picture is very mixed and weird. Think back to a week ago when SNAP reported. A player like SNAP misses and the Nasdaq drops 300 points. Meanwhile, Intel, the great semiconductor hope for America misses by a mile, cuts its revenue outlook by 15% for the year, and the Nasdaq was up nearly 250 points just ahead of the close, go figure. Earnings reports from Meta, Google, Microsoft, ServiceNow, and some others underscored cautious outlooks, especially those exposed to the advertising revenue sector. But at the same time, Apple, Microsoft, and Google, were, let's say less bad than expected. And that brought a sigh of relief. And then there's Amazon, which beat on revenue, it beat on cloud revenue, and it gave positive guidance. The Nasdaq has seen this month best month since the isolation economy, which "Breaking Analysis" contributor, Chip Symington, attributes to what he calls an oversold rally. But there are many unknowns that remain. How bad will inflation be? Will the fed really stop tightening after September? The Senate just approved a big spending bill along with corporate tax hikes, which generally don't favor the economy. And on Monday, August 1st, the market will likely realize that we are in the summer quarter, and there's some work to be done. Which is why it's not surprising that investors sold the Nasdaq at the close today on Friday. Are people ready to call the bottom? Hmm, some maybe, but there's still lots of uncertainty. However, the cloud continues its march, despite some very slight deceleration in growth rates from the two leaders. Here's an update of our big four IaaS quarterly revenue data. The big four hyperscalers will account for $165 billion in revenue this year, slightly lower than what we had last quarter. We expect AWS to surpass 83 billion this year in revenue. Azure will be more than 2/3rds the size of AWS, a milestone from Microsoft. Both AWS and Azure came in slightly below our expectations, but still very solid growth at 33% and 46% respectively. GCP, Google Cloud Platform is the big concern. By our estimates GCP's growth rate decelerated from 47% in Q1, and was 38% this past quarter. The company is struggling to keep up with the two giants. Remember, both GCP and Azure, they play a shell game and hide the ball on their IaaS numbers, so we have to use a survey data and other means of estimating. But this is how we see the market shaping up in 2022. Now, before we leave the overall cloud discussion, here's some ETR data that shows the net score or spending momentum granularity for each of the hyperscalers. These bars show the breakdown for each company, with net score on the right and in parenthesis, net score from last quarter. lime green is new adoptions, forest green is spending up 6% or more, the gray is flat, pink is spending at 6% down or worse, and the bright red is replacement or churn. Subtract the reds from the greens and you get net score. One note is this is for each company's overall portfolio. So it's not just cloud. So it's a bit of a mixed bag, but there are a couple points worth noting. First, anything above 40% or 40, here as shown in the chart, is considered elevated. AWS, as you can see, is well above that 40% mark, as is Microsoft. And if you isolate Microsoft's Azure, only Azure, it jumps above AWS's momentum. Google is just barely hanging on to that 40 line, and Alibaba is well below, with both Google and Alibaba showing much higher replacements, that bright red. But here's the key point. AWS and Azure have virtually no churn, no replacements in that bright red. And all four companies are experiencing single-digit numbers in terms of decreased spending within customer accounts. People may be moving some workloads back on-prem selectively, but repatriation is definitely not a trend to bet the house on, in our view. Okay, let's get to the main subject of this "Breaking Analysis". TheCube was at AWS re:Inforce in Boston this week, and we have some observations to share. First, we had keynotes from Steven Schmidt who used to be the chief information security officer at Amazon on Web Services, now he's the CSO, the chief security officer of Amazon. Overall, he dropped the I in his title. CJ Moses is the CISO for AWS. Kurt Kufeld of AWS also spoke, as did Lena Smart, who's the MongoDB CISO, and she keynoted and also came on theCUBE. We'll go back to her in a moment. The key point Schmidt made, one of them anyway, was that Amazon sees more data points in a day than most organizations see in a lifetime. Actually, it adds up to quadrillions over a fairly short period of time, I think, it was within a month. That's quadrillion, it's 15 zeros, by the way. Now, there was drill down focus on data protection and privacy, governance, risk, and compliance, GRC, identity, big, big topic, both within AWS and the ecosystem, network security, and threat detection. Those are the five really highlighted areas. Re:Inforce is really about bringing a lot of best practice guidance to security practitioners, like how to get the most out of AWS tooling. Schmidt had a very strong statement saying, he said, "I can assure you with a 100% certainty that single controls and binary states will absolutely positively fail." Hence, the importance of course, of layered security. We heard a little bit of chat about getting ready for the future and skating to the security puck where quantum computing threatens to hack all of the existing cryptographic algorithms, and how AWS is trying to get in front of all that, and a new set of algorithms came out, AWS is testing. And, you know, we'll talk about that maybe in the future, but that's a ways off. And by its prominent presence, the ecosystem was there enforced, to talk about their role and filling the gaps and picking up where AWS leaves off. We heard a little bit about ransomware defense, but surprisingly, at least in the keynotes, no discussion about air gaps, which we've talked about in previous "Breaking Analysis", is a key factor. We heard a lot about services to help with threat detection and container security and DevOps, et cetera, but there really wasn't a lot of specific talk about how AWS is simplifying the life of the CISO. Now, maybe it's inherently assumed as AWS did a good job stressing that security is job number one, very credible and believable in that front. But you have to wonder if the world is getting simpler or more complex with cloud. And, you know, you might say, "Well, Dave, come on, of course it's better with cloud." But look, attacks are up, the threat surface is expanding, and new exfiltration records are being set every day. I think the hard truth is, the cloud is driving businesses forward and accelerating digital, and those businesses are now exposed more than ever. And that's why security has become such an important topic to boards and throughout the entire organization. Now, the other epiphany that we had at re:Inforce is that there are new layers and a new trust framework emerging in cyber. Roles are shifting, and as a direct result of the cloud, things are changing within organizations. And this first hit me in a conversation with long-time cyber practitioner and Wikibon colleague from our early Wikibon days, and friend, Mike Versace. And I spent two days testing the premise that Michael and I talked about. And here's an attempt to put that conversation into a graphic. The cloud is now the first line of defense. AWS specifically, but hyperscalers generally provide the services, the talent, the best practices, and automation tools to secure infrastructure and their physical data centers. And they're really good at it. The security inside of hyperscaler clouds is best of breed, it's world class. And that first line of defense does take some of the responsibility off of CISOs, but they have to understand and apply the shared responsibility model, where the cloud provider leaves it to the customer, of course, to make sure that the infrastructure they're deploying is properly configured. So in addition to creating a cyber aware culture and communicating up to the board, the CISO has to ensure compliance with and adherence to the model. That includes attracting and retaining the talent necessary to succeed. Now, on the subject of building a security culture, listen to this clip on one of the techniques that Lena Smart, remember, she's the CISO of MongoDB, one of the techniques she uses to foster awareness and build security cultures in her organization. Play the clip >> Having the Security Champion program, so that's just, it's like one of my babies. That and helping underrepresented groups in MongoDB kind of get on in the tech world are both really important to me. And so the Security Champion program is purely purely voluntary. We have over 100 members. And these are people, there's no bar to join, you don't have to be technical. If you're an executive assistant who wants to learn more about security, like my assistant does, you're more than welcome. Up to, we actually, people grade themselves when they join us. We give them a little tick box, like five is, I walk on security water, one is I can spell security, but I'd like to learn more. Mixing those groups together has been game-changing for us. >> Now, the next layer is really where it gets interesting. DevSecOps, you know, we hear about it all the time, shifting left. It implies designing security into the code at the dev level. Shift left and shield right is the kind of buzz phrase. But it's getting more and more complicated. So there are layers within the development cycle, i.e., securing the container. So the app code can't be threatened by backdoors or weaknesses in the containers. Then, securing the runtime to make sure the code is maintained and compliant. Then, the DevOps platform so that change management doesn't create gaps and exposures, and screw things up. And this is just for the application security side of the equation. What about the network and implementing zero trust principles, and securing endpoints, and machine to machine, and human to app communication? So there's a lot of burden being placed on the DevOps team, and they have to partner with the SecOps team to succeed. Those guys are not security experts. And finally, there's audit, which is the last line of defense or what I called at the open, the free safety, for you football fans. They have to do more than just tick the box for the board. That doesn't cut it anymore. They really have to know their stuff and make sure that what they sign off on is real. And then you throw ESG into the mix is becoming more important, making sure the supply chain is green and also secure. So you can see, while much of this stuff has been around for a long, long time, the cloud is accelerating innovation in the pace of delivery. And so much is changing as a result. Now, next, I want to share a graphic that we shared last week, but a little different twist. It's an XY graphic with net score or spending velocity in the vertical axis and overlap or presence in the dataset on the horizontal. With that magic 40% red line as shown. Okay, I won't dig into the data and draw conclusions 'cause we did that last week, but two points I want to make. First, look at Microsoft in the upper-right hand corner. They are big in security and they're attracting a lot of dollars in the space. We've reported on this for a while. They're a five-star security company. And every time, from a spending standpoint in ETR data, that little methodology we use, every time I've run this chart, I've wondered, where the heck is AWS? Why aren't they showing up there? If security is so important to AWS, which it is, and its customers, why aren't they spending money with Amazon on security? And I asked this very question to Merrit Baer, who resides in the office of the CISO at AWS. Listen to her answer. >> It doesn't mean don't spend on security. There is a lot of goodness that we have to offer in ESS, external security services. But I think one of the unique parts of AWS is that we don't believe that security is something you should buy, it's something that you get from us. It's something that we do for you a lot of the time. I mean, this is the definition of the shared responsibility model, right? >> Now, maybe that's good messaging to the market. Merritt, you know, didn't say it outright, but essentially, Microsoft they charge for security. At AWS, it comes with the package. But it does answer my question. And, of course, the fact is that AWS can subsidize all this with egress charges. Now, on the flip side of that, (chuckles) you got Microsoft, you know, they're both, they're competing now. We can take CrowdStrike for instance. Microsoft and CrowdStrike, they compete with each other head to head. So it's an interesting dynamic within the ecosystem. Okay, but I want to turn to a powerful example of how AWS designs in security. And that is the idea of confidential computing. Of course, AWS is not the only one, but we're coming off of re:Inforce, and I really want to dig into something that David Floyer and I have talked about in previous episodes. And we had an opportunity to sit down with Arvind Raghu and J.D. Bean, two security experts from AWS, to talk about this subject. And let's share what we learned and why we think it matters. First, what is confidential computing? That's what this slide is designed to convey. To AWS, they would describe it this way. It's the use of special hardware and the associated firmware that protects customer code and data from any unauthorized access while the data is in use, i.e., while it's being processed. That's oftentimes a security gap. And there are two dimensions here. One is protecting the data and the code from operators on the cloud provider, i.e, in this case, AWS, and protecting the data and code from the customers themselves. In other words, from admin level users are possible malicious actors on the customer side where the code and data is being processed. And there are three capabilities that enable this. First, the AWS Nitro System, which is the foundation for virtualization. The second is Nitro Enclaves, which isolate environments, and then third, the Nitro Trusted Platform Module, TPM, which enables cryptographic assurances of the integrity of the Nitro instances. Now, we've talked about Nitro in the past, and we think it's a revolutionary innovation, so let's dig into that a bit. This is an AWS slide that was shared about how they protect and isolate data and code. On the left-hand side is a classical view of a virtualized architecture. You have a single host or a single server, and those white boxes represent processes on the main board, X86, or could be Intel, or AMD, or alternative architectures. And you have the hypervisor at the bottom which translates instructions to the CPU, allowing direct execution from a virtual machine into the CPU. But notice, you also have blocks for networking, and storage, and security. And the hypervisor emulates or translates IOS between the physical resources and the virtual machines. And it creates some overhead. Now, companies like VMware have done a great job, and others, of stripping out some of that overhead, but there's still an overhead there. That's why people still like to run on bare metal. Now, and while it's not shown in the graphic, there's an operating system in there somewhere, which is privileged, so it's got access to these resources, and it provides the services to the VMs. Now, on the right-hand side, you have the Nitro system. And you can see immediately the differences between the left and right, because the networking, the storage, and the security, the management, et cetera, they've been separated from the hypervisor and that main board, which has the Intel, AMD, throw in Graviton and Trainium, you know, whatever XPUs are in use in the cloud. And you can see that orange Nitro hypervisor. That is a purpose-built lightweight component for this system. And all the other functions are separated in isolated domains. So very strong isolation between the cloud software and the physical hardware running workloads, i.e., those white boxes on the main board. Now, this will run at practically bare metal speeds, and there are other benefits as well. One of the biggest is security. As we've previously reported, this came out of AWS's acquisition of Annapurna Labs, which we've estimated was picked up for a measly $350 million, which is a drop in the bucket for AWS to get such a strategic asset. And there are three enablers on this side. One is the Nitro cards, which are accelerators to offload that wasted work that's done in traditional architectures by typically the X86. We've estimated 25% to 30% of core capacity and cycles is wasted on those offloads. The second is the Nitro security chip, which is embedded and extends the root of trust to the main board hardware. And finally, the Nitro hypervisor, which allocates memory and CPU resources. So the Nitro cards communicate directly with the VMs without the hypervisors getting in the way, and they're not in the path. And all that data is encrypted while it's in motion, and of course, encryption at rest has been around for a while. We asked AWS, is this an, we presumed it was an Arm-based architecture. We wanted to confirm that. Or is it some other type of maybe hybrid using X86 and Arm? They told us the following, and quote, "The SoC, system on chips, for these hardware components are purpose-built and custom designed in-house by Amazon and Annapurna Labs. The same group responsible for other silicon innovations such as Graviton, Inferentia, Trainium, and AQUA. Now, the Nitro cards are Arm-based and do not use any X86 or X86/64 bit CPUs. Okay, so it confirms what we thought. So you may say, "Why should we even care about all this technical mumbo jumbo, Dave?" Well, a year ago, David Floyer and I published this piece explaining why Nitro and Graviton are secret weapons of Amazon that have been a decade in the making, and why everybody needs some type of Nitro to compete in the future. This is enabled, this Nitro innovations and the custom silicon enabled by the Annapurna acquisition. And AWS has the volume economics to make custom silicon. Not everybody can do it. And it's leveraging the Arm ecosystem, the standard software, and the fabrication volume, the manufacturing volume to revolutionize enterprise computing. Nitro, with the alternative processor, architectures like Graviton and others, enables AWS to be on a performance, cost, and power consumption curve that blows away anything we've ever seen from Intel. And Intel's disastrous earnings results that we saw this past week are a symptom of this mega trend that we've been talking about for years. In the same way that Intel and X86 destroyed the market for RISC chips, thanks to PC volumes, Arm is blowing away X86 with volume economics that cannot be matched by Intel. Thanks to, of course, to mobile and edge. Our prediction is that these innovations and the Arm ecosystem are migrating and will migrate further into enterprise computing, which is Intel's stronghold. Now, that stronghold is getting eaten away by the likes of AMD, Nvidia, and of course, Arm in the form of Graviton and other Arm-based alternatives. Apple, Tesla, Amazon, Google, Microsoft, Alibaba, and others are all designing custom silicon, and doing so much faster than Intel can go from design to tape out, roughly cutting that time in half. And the premise of this piece is that every company needs a Nitro to enable alternatives to the X86 in order to support emergent workloads that are data rich and AI-based, and to compete from an economic standpoint. So while at re:Inforce, we heard that the impetus for Nitro was security. Of course, the Arm ecosystem, and its ascendancy has enabled, in our view, AWS to create a platform that will set the enterprise computing market this decade and beyond. Okay, that's it for today. Thanks to Alex Morrison, who is on production. And he does the podcast. And Ken Schiffman, our newest member of our Boston Studio team is also on production. Kristen Martin and Cheryl Knight help spread the word on social media and in the community. And Rob Hof is our editor in chief over at SiliconANGLE. He does some great, great work for us. Remember, all these episodes are available as podcast. Wherever you listen, just search "Breaking Analysis" podcast. I publish each week on wikibon.com and siliconangle.com. Or you can email me directly at David.Vellante@siliconangle.com or DM me @dvellante, comment on my LinkedIn post. And please do check out etr.ai for the best survey data in the enterprise tech business. This is Dave Vellante for theCUBE Insights, powered by ETR. Thanks for watching. Be well, and we'll see you next time on "Breaking Analysis." (upbeat theme music)

(upbeat music) >> Welcome back to Boston, everybody. This is the birthplace of theCUBE. In 2010, May of 2010 at EMC World, right in this very venue, John Furrier called it the chowder and lobster post. I'm Dave Vellante. We're here at RE:INFORCE 2022, Ed Walsh, CEO of ChaosSearch. Doing a drive by Ed. Thanks so much for stopping in. You're going to help me wrap up in our final editorial segment. >> Looking forward to it. >> I really appreciate it. >> Thank you for including me. >> How about that? 2010. >> That's amazing. It was really in this-- >> Really in this building. Yeah, we had to sort of bury our way in, tunnel our way into the Blogger Lounge. We did four days. >> Weekends, yeah. >> It was epic. It was really epic. But I'm glad they're back in Boston. AWS was going to do June in Houston. >> Okay. >> Which would've been awful. >> Yeah, yeah. No, this is perfect. >> Yeah. Thank God they came back. You saw Boston in summer is great. I know it's been hot, And of course you and I are from this area. >> Yeah. >> So how you been? What's going on? I mean, it's a little crazy out there. The stock market's going crazy. >> Sure. >> Having the tech lash, what are you seeing? >> So it's an interesting time. So I ran a company in 2008. So we've been through this before. By the way, the world's not ending, we'll get through this. But it is an interesting conversation as an investor, but also even the customers. There's some hesitation but you have to basically have the right value prop, otherwise things are going to get sold. So we are seeing longer sales cycles. But it's nothing that you can't overcome. But it has to be something not nice to have, has to be a need to have. But I think we all get through it. And then there is some, on the VC side, it's now buckle down, let's figure out what to do which is always a challenge for startup plans. >> In pre 2000 you, maybe you weren't a CEO but you were definitely an executive. And so now it's different and a lot of younger people haven't seen this. You've got interest rates now rising. Okay, we've seen that before but it looks like you've got inflation, you got interest rates rising. >> Yep. >> The consumer spending patterns are changing. You had 6$, $7 gas at one point. So you have these weird crosscurrents, >> Yup. >> And people are thinking, "Okay post-September now, maybe because of the recession, the Fed won't have to keep raising interest rates and tightening. But I don't know what to root for. It's like half full, half empty. (Ed laughing) >> But we haven't been in an environment with high inflation. At least not in my career. >> Right. Right. >> I mean, I got into 92, like that was long gone, right?. >> Yeah. >> So it is a interesting regime change that we're going to have to deal with, but there's a lot of analogies between 2008 and now that you still have to work through too, right?. So, anyway, I don't think the world's ending. I do think you have to run a tight shop. So I think the grow all costs is gone. I do think discipline's back in which, for most of us, discipline never left, right?. So, to me that's the name of the game. >> What do you tell just generally, I mean you've been the CEO of a lot of private companies. And of course one of the things that you do to retain people and attract people is you give 'em stock and it's great and everybody's excited. >> Yeah. >> I'm sure they're excited cause you guys are a rocket ship. But so what's the message now that, Okay the market's down, valuations are down, the trees don't grow to the moon, we all know that. But what are you telling your people? What's their reaction? How do you keep 'em motivated? >> So like anything, you want over communicate during these times. So I actually over communicate, you get all these you know, the Sequoia decks, 2008 and the recent... >> (chuckles) Rest in peace good times, that one right? >> I literally share it. Why? It's like, Hey, this is what's going on in the real world. It's going to affect us. It has almost nothing to do with us specifically, but it will affect us. Now we can't not pay attention to it. It does change how you're going to raise money, so you got to make sure you have the right runway to be there. So it does change what you do, but I think you over communicate. So that's what I've been doing and I think it's more like a student of the game, so I try to share it, and I say some appreciate it others, I'm just saying, this is normal, we'll get through this and this is what happened in 2008 and trust me, once the market hits bottom, give it another month afterwards. Then everyone says, oh, the bottom's in and we're back to business. Valuations don't go immediately back up, but right now, no one knows where the bottom is and that's where kind of the world's ending type of things. >> Well, it's interesting because you talked about, I said rest in peace good times >> Yeah >> that was the Sequoia deck, and the message was tighten up. Okay, and I'm not saying you shouldn't tighten up now, but the difference is, there was this period of two years of easy money and even before that, it was pretty easy money. >> Yeah. >> And so companies are well capitalized, they have runway so it's like, okay, I was talking to Frank Slootman about this now of course there are public companies, like we're not taking the foot off the gas. We're inherently profitable, >> Yeah. >> we're growing like crazy, we're going for it. You know? So that's a little bit of a different dynamic. There's a lot of good runway out there, isn't there? >> But also you look at the different companies that were either born or were able to power through those environments are actually better off. You come out stronger in a more dominant position. So Frank, listen, if you see what Frank's done, it's been unbelievable to watch his career, right?. In fact, he was at Data Domain, I was Avamar so, but look at what he's done since, he's crushed it. Right? >> Yeah. >> So for him to say, Hey, I'm going to literally hit the gas and keep going. I think that's the right thing for Snowflake and a right thing for a lot of people. But for people in different roles, I literally say that you have to take it seriously. What you can't be is, well, Frank's in a different situation. What is it...? How many billion does he have in the bank? So it's... >> He's over a billion, you know, over a billion. Well, you're on your way Ed. >> No, no, no, it's good. (Dave chuckles) Okay, I want to ask you about this concept that we've sort of we coined this term called Supercloud. >> Sure. >> You could think of it as the next generation of multi-cloud. The basic premises that multi-cloud was largely a symptom of multi-vendor. Okay. I've done some M&A, I've got some Shadow IT, spinning up, you know, Shadow clouds, projects. But it really wasn't a strategy to have a continuum across clouds. And now we're starting to see ecosystems really build, you know, you've used the term before, standing on the shoulders of giants, you've used that a lot. >> Yep. >> And so we're seeing that. Jerry Chen wrote a seminal piece on Castles in The Cloud, so we coined this term SuperCloud to connote this abstraction layer that hides the underlying complexities and primitives of the individual clouds and then adds value on top of it and can adjudicate and manage, irrespective of physical location, Supercloud. >> Yeah. >> Okay. What do you think about that concept?. How does it maybe relate to some of the things that you're seeing in the industry? >> So, standing on shoulders of giants, right? So I always like to do hard tech either at big company, small companies. So we're probably your definition of a Supercloud. We had a big vision, how to literally solve the core challenge of analytics at scale. How are you going to do that? You're not going to build on your own. So literally we're leveraging the primitives, everything you can get out of the Amazon cloud, everything get out of Google cloud. In fact, we're even looking at what it can get out of this Snowflake cloud, and how do we abstract that out, add value to it? That's where all our patents are. But it becomes a simplified approach. The customers don't care. Well, they care where their data is. But they don't care how you got there, they just want to know the end result. So you simplify, but you gain the advantages. One thing's interesting is, in this particular company, ChaosSearch, people try to always say, at some point the sales cycle they say, no way, hold on, no way that can be fast no way, or whatever the different issue. And initially we used to try to explain our technology, and I would say 60% was explaining the public, cloud capabilities and then how we, harvest those I guess, make them better add value on top and what you're able to get is something you couldn't get from the public clouds themselves and then how we did that across public clouds and then extracted it. So if you think about that like, it's the Shoulders of giants. But what we now do, literally to avoid that conversation because it became a lengthy conversation. So, how do you have a platform for analytics that you can't possibly overwhelm for ingest. All your messy data, no pipelines. Well, you leverage things like S3 and EC2, and you do the different security things. You can go to environments say, you can't possibly overrun me, I could not say that. If I didn't literally build on the shoulders giants of all these public clouds. But the value. So if you're going to do hard tech as a startup, you're going to build, you're going to be the principles of Supercloud. Maybe they're not the same size of Supercloud just looking at Snowflake, but basically, you're going to leverage all that, you abstract it out and that's where you're able to have a lot of values at that. >> So let me ask you, so I don't know if there's a strict definition of Supercloud, We sort of put it out to the community and said, help us define it. So you got to span multiple clouds. It's not just running in each cloud. There's a metadata layer that kind of understands where you're pulling data from. Like you said you can pull data from Snowflake, it sounds like we're not running on Snowflake, correct? >> No, complimentary to them in their different customers. >> Yeah. Okay. >> They want to build on top of a data platform, data apps. >> Right. And of course they're going cross cloud. >> Right. >> Is there a PaaS layer in there? We've said there's probably a Super PaaS layer. You're probably not doing that, but you're allowing people to bring their own, bring your own PaaS sort of thing maybe. >> So we're a little bit different but basically we publish open APIs. We don't have a user interface. We say, keep the user interface. Again, we're solving the challenge of analytics at scale, we're not trying to retrain your analytics, either analysts or your DevOps or your SOV or your Secop team. They use the tools they already use. Elastic search APIs, SQL APIs. So really they program, they build applications on top of us, Equifax is a good example. Case said it coming out later on this week, after 18 months in production but, basically they're building, we provide the abstraction layer, the quote, I'm going to kill it, Jeff Tincher, who owns all of SREs worldwide, said to the effect of, Hey I'm able to rethink what I do for my data pipelines. But then he also talked about how, that he really doesn't have to worry about the data he puts in it. We deal with that. And he just has to, just query on the other side. That simplicity. We couldn't have done that without that. So anyway, what I like about the definition is, if you were going to do something harder in the world, why would you try to rebuild what Amazon, Google and Azure or Snowflake did? You're going to add things on top. We can still do intellectual property. We're still doing patents. So five grand patents all in this. But literally the abstraction layer is the simplification. The end users do not want to know that complexity, even though they ask the questions. >> And I think too, the other attribute is it's ecosystem enablement. Whereas I think, >> Absolutely >> in general, in the Multicloud 1.0 era, the ecosystem wasn't thinking about, okay, how do I build on top and abstract that. So maybe it is Multicloud 2.0, We chose to use Supercloud. So I'm wondering, we're at the security conference, >> RE: INFORCE is there a security Supercloud? Maybe Snyk has the developer Supercloud or maybe Okta has the identity Supercloud. I think CrowdStrike maybe not. Cause CrowdStrike competes with Microsoft. So maybe, because Microsoft, what's interesting, Merritt Bear was just saying, look, we don't show up in the spending data for security because we're not charging for most of our security. We're not trying to make a big business. So that's kind of interesting, but is there a potential for the security Supercloud? >> So, I think so. But also, I'll give you one thing I talked to, just today, at least three different conversations where everyone wants to log data. It's a little bit specific to us, but basically they want to do the security data lake. The idea of, and Snowflake talks about this too. But the idea of putting all the data in one repository and then how do you abstract out and get value from it? Maybe not the perfect, but it becomes simple to do but hard to get value out. So the different players are going to do that. That's what we do. We're able to, once you land it in your S3 or it doesn't matter, cloud of choice, simple storage, we allow you to get after that data, but we take the primitives and hide them from you. And all you do is query the data and we're spinning up stateless computer to go after it. So then if I look around the floor. There's going to be a bunch of these players. I don't think, why would someone in this floor try to recreate what Amazon or Google or Azure had. They're going to build on top of it. And now the key thing is, do you leave it in standard? And now we're open APIs. People are building on top of my open APIs or do you try to put 'em in a walled garden? And they're in, now your Supercloud. Our belief is, part of it is, it needs to be open access and let you go after it. >> Well. And build your applications on top of it openly. >> They come back to snowflake. That's what Snowflake's doing. And they're basically saying, Hey come into our proprietary environment. And the benefit is, and I think both can win. There's a big market. >> I agree. But I think the benefit of Snowflake's is, okay, we're going to have federated governance, we're going to have data sharing, you're going to have access to all the ecosystem players. >> Yep. >> And as everything's going to be controlled and you know what you're getting. The flip side of that is, Databricks is the other end >> Yeah. >> of that spectrum, which is no, no, you got to be open. >> Yeah. >> So what's going to happen, well what's happening clearly, is Snowflake's saying, okay we've got Snowpark. we're going to allow Python, we're going to have an Apache Iceberg. We're going to have open source tooling that you can access. By the way, it's not going to be as good as our waled garden where the flip side of that is you get Databricks coming at it from a data science and data engineering perspective. And there's a lot of gaps in between, aren't there? >> And I think they both win. Like for instance, so we didn't do Snowpark integration. But we work with people building data apps on top of Snowflake or data bricks. And what we do is, we can add value to that, or what we've done, again, using all the Supercloud stuff we're done. But we deal with the unstructured data, the four V's coming at you. You can't pipeline that to save. So we actually could be additive. As they're trying to do like a security data cloud inside of Snowflake or do the same thing in Databricks. That's where we can play. Now, we play with them at the application level that they get some data from them and some data for us. But I believe there's a partnership there that will do it inside their environment. To us they're just another large scaler environment that my customers want to get after data. And they want me to abstract it out and give value. >> So it's another repository to you. >> Yeah. >> Okay. So I think Snowflake recently added support for unstructured data. You chose not to do Snowpark because why? >> Well, so the way they're doing the unstructured data is not bad. It's JSON data. Basically, This is the dilemma. Everyone wants their application developers to be flexible, move fast, securely but just productivity. So you get, give 'em flexibility. The problem with that is analytics on the end want to be structured to be performant. And this is where Snowflake, they have to somehow get that raw data. And it's changing every day because you just let the developers do what they want now, in some structured base, but do what you need to do your business fast and securely. So it completely destroys. So they have large customers trying to do big integrations for this messy data. And it doesn't quite work, cause you literally just can't make the pipelines work. So that's where we're complimentary do it. So now, the particular integration wasn't, we need a little bit deeper integration to do that. So we're integrating, actually, at the data app layer. But we could, see us and I don't, listen. I think Snowflake's a good actor. They're trying to figure out what's best for the customers. And I think we just participate in that. >> Yeah. And I think they're trying to figure out >> Yeah. >> how to grow their ecosystem. Because they know they can't do it all, in fact, >> And we solve the key thing, they just can't do certain things. And we do that well. Yeah, I have SQL but that's where it ends. >> Yeah. >> I do the messy data and how to play with them. >> And when you talk to one of their founders, anyway, Benoit, he comes on the cube and he's like, we start with simple. >> Yeah. >> It reminds me of the guy's some Pure Storage, that guy Coz, he's always like, no, if it starts to get too complicated. So that's why they said all right, we're not going to start out trying to figure out how to do complex joins and workload management. And they turn that into a feature. So like you say, I think both can win. It's a big market. >> I think it's a good model. And I love to see Frank, you know, move. >> Yeah. I forgot So you AVMAR... >> In the day. >> You guys used to hate each other, right? >> No, no, no >> No. I mean, it's all good. >> But the thing is, look what he's done. Like I wouldn't bet against Frank. I think it's a good message. You can see clients trying to do it. Same thing with Databricks, same thing with BigQuery. We get a lot of same dynamic in BigQuery. It's good for a lot of things, but it's not everything you need to do. And there's ways for the ecosystem to play together. >> Well, what's interesting about BigQuery is, it is truly cloud native, as is Snowflake. You know, whereas Amazon Redshift was sort of Parexel, it's cobbled together now. It's great engineering, but BigQuery gets a lot of high marks. But again, there's limitations to everything. That's why companies like yours can exist. >> And that's why.. so back to the Supercloud. It allows me as a company to participate in that because I'm leveraging all the underlying pieces. Which we couldn't be doing what we're doing now, without leveraging the Supercloud concepts right, so... >> Ed, I really appreciate you coming by, help me wrap up today in RE:INFORCE. Always a pleasure seeing you, my friend. >> Thank you. >> All right. Okay, this is a wrap on day one. We'll be back tomorrow. I'll be solo. John Furrier had to fly out but we'll be following what he's doing. This is RE:INFORCE 2022. You're watching theCUBE. I'll see you tomorrow.

(upbeat music) >> Hello everyone, welcome back to theCUBE's coverage of splunk.com 2021 virtual. We're here live in the Splunk studios. We're all here gettin all the action, all the stories. Garth Fort, senior vice president, Chief Product Officer at Splunk is here with me. CUBE alumni. Great to see you. Last time I saw you, we were at AWS now here at Splunk. Congratulations on the new role. >> Thank you. Great to see you again. >> Great keynote and great team. Congratulations. >> Thank you. Thank you. It's a lot of fun. >> So let's get into the keynote a little bit on the product. You're the Chief Product Officer. We interviewed Shawn Bice, who's also working with you as well. He's your boss. Talk about the, the next level, cause you're seeing some new enhancements. Let's get to the news first. Talk about the new enhancements. >> Yeah, this was actually a really fun keynote for me. So I think there was a lot of great stuff that came out of the rest of it. But I had the honor to actually showcase a lot of the product innovation, you know, since we did .conf last year, we've actually closed four different acquisitions. We shipped 43 major releases and we've done hundreds of small enhancements, like we're shipping code in the cloud every six weeks and we're shipping new versions twice a year for our Splunk Enterprise customers. And so this was kind of like if you've seen that movie Sophie's Choice, you know, where you have to pick one of your children, like this was a really hard, hard thing to pick. Cause we only had about 25 minutes, but we did like four demos that I think landed really well. The first was what we call ingest actions and you know, there's customers that are using, they start small with gigabytes and they go to terabytes and up to petabytes of data per day. And so they wanted tools that allow them to kind of modify filter and then route data to different sort of parts of their infrastructure. So that was the first demo. We did another demo on our, our visual playbook editor for SOAR, which has improved quite a bit. You know, a lot of the analysts that are in the, in the, in the SOC trying to figure out how to automate responses and reduce sort of time to resolution, like they're not Python experts. And so having a visual playbook editor that lets them drag and drop and sort of with a few simple gestures create complex playbooks was pretty cool. We showed some new capabilities in our APM tool. Last year, we announced we acquired a company called Plumbr, which has expertise in basically like code level analysis and, and we're calling it "Always On" profiling. So we, we did that demo and gosh, we did one more, four, but four total demos. I think, you know, people were really happy to see, you know, the thing that we really tried to do was ground all of our sort of like tech talk and stuff that was like real and today, like this is not some futuristic vision. I mean, Shawn did lay out some, some great visions, visionary kind of pillars. But, what we showed in the keynote was I it's all shipping code. >> I mean, there's plenty of head room in this market when it comes to data as value and data in motion, all these things. But we were talking before you came on camera earlier in the morning about actually how good Splunk product and broad and deep the product portfolio as well. >> Garth: Yeah. >> I mean, it's, I mean, it's not a utility and a tooling, it's a platform with tools and utilities. >> Garth: Yeah >> It's a fully blown out platform. >> Yeah. Yeah. It is a platform and, and, you know, it's, it's one that's quite interesting. I've had the pleasure to meet a couple of big customers and it's kind of amazing, like what they do with Splunk. Like I was meeting with a large telco on the east coast and you know, they actually, for their set top boxes, they actually have to figure out in real time, which ads to display and the only tool they could find to process 15 million events in real time, to decide what ad to display, was Splunk. So that was, that was like really cool to hear. Like we never set out to be like an ad tech kind of platform and yet we're the only tool that operates at that level of scale and that kind of data. >> You know, it's funny, Doug Merritt mentioned this in my interview with him earlier today about, you know, and he wasn't shy about it, which was great. He was like, we're an enabling platform. We don't have to be experts in all these vertical industries >> Garth: Yep >> because AI takes care of that. That's where the machine learning >> Garth: Yeah >> and the applications get built. So others are trying to build fully vertically integrated stacks into these verticals when in reality they don't have to, if they don't want it. >> Yeah, and Splunk's kind of, it's quite interesting when you look across our top 100 customers, you know, Doug talks about like the, you know, 92 of the fortune 100 are kind of using Splunk today, but the diversity across industries and, you know, we have government agencies, we have, you know, you name the retail or the vertical, you know, we've got really big customers, they're using Splunk. And the other thing that I kind of, I was excited about, we announced the last demo I forgot was TruSTAR integration with Enterprise Security. That's pretty cool. We're calling that Splunk Threat Intelligence. And so That was really fun and we only acquired, we closed the acquisition to TruSTAR in May, but the good news is they've been a partner with us like for 18 months before we actually bought em. And so they'd already done a lot of the work to integrate. And so they had a running start in that regard, But other, one other one that was kind of a, it was a small thing. I didn't get to demo it, but we talked about the, the content pack for application performance monitoring. And so, you know, in some ways we compete in the APM level, but in many ways there's a ton of great APM vendors out there that customers are using. But what they wanted us to do was like, hey, if I'm using APM for that one app, I still want to get data out of that and into Splunk because Splunk ends up being like the core repository for observability, security, IT ops, Dev Sec Ops, et cetera. It's kind of like where the truth, the operational truth of how your systems works, lives in Splunk. >> It's so funny. The Splunk business model has actually been replicated. They call it data lake, whatever you want to call it. People are bringing up all these different metaphors. But at the end of the day, if you guys can create a value proposition where you can have data just be, you know, stored and dumped and dumped into whatever they call it stored in a way >> Garth: We call it ingest >> Ingested, ingested. >> Garth: Not dumped. >> Data dump. >> Garth: It's ingested. >> Well, I mean, well you given me a plan, but you don't have to do a lot of work to store just, okay, we can only get to it later, >> Garth: Yep. >> But let the machines take over >> Garth: Yep. >> With the machine learning. I totally get that. Now, as a pro, as a product leader, I have to ask you your, your mindset around optimization. What do you optimize for? Because a lot of times these use cases are emerging. They just pop out of nowhere. It's a net new use case that you want to operationalize. So balancing the headroom >> Yep. >> Or not to foreclose those new opportunities for customers. How are customers deciding what's important to them? How do you, because you're trying to read the tea leaves for the future >> Garth: A little bit, yeah. >> and then go, okay, what do our customers need, but you don't want to foreclose anything. How do you think about product strategy around that? >> There's a ton of opportunity to interact with customers. We have this thing called the Customer Advisory Board. We run, I think, four of them and we run a monthly. And so we got an opportunity to kind of get that anecdotal data and the direct contact. We also have a portal called ideas.splunk.com where customers can come tell us what they want us to build next. And we look at that every month, you know, and there's no way that we could ever build everything that they're asking us to, but we look at that monthly and we use it in sort of our sprint planning to decide where we're going to prioritize engineering resources. And it's just, it's kind of like customers say the darndest things, right? Sometimes they ask us for stuff and we never imagined building it in a million years, >> John: Yeah. >> Like that use case around ads on the set top box, but it's, it's kind of a fun place to be like, we, we just, before this event, we kind of laid out internally what, you know, Shawn and I kind of put together this doc, actually Shawn wrote the bulk of it, but it was about sort of what do we think? Where, where can we take Splunk to the next three to five years? And we talked about these, we referred to them as waves of innovation. Cause you know, like when you think about waves, there's multiple waves that are heading towards the beach >> John: Yeah. >> in parallel, right? It's not like a series of phases that are going to be serialized. It's about making a set of investments. that'll kind of land over time. And, and the first wave is really about, you know, what I would say is sort of, you know, really delivering on the promise of Splunk and some of that's around integration, single sign-on things about like making all of the Splunk Splunk products work together more easily. We've talked a lot in the Q and a about like edge and hybrid. And that's really where our customers are. If you watch the Koby Avital's sort of customer keynote, you know, Walmart by necessity, given their geographic breadth and the customers they serve has to have their own infrastructure. They use Google, they use Azure and they have this abstraction layer that Koby's team has built on top. And they use Splunk to manage kind of, operate basically all of their infrastructure across those three clouds. So that's the hybrid edge scenario. We were thinking a lot about, you mentioned data lakes. You know, if you go back to 2002, when Splunk was founded, you know, the thing we were trying to do is help people make sense of log files. But now if you talk to customers that are moving to cloud, everybody's building a data lake and there's like billions of objects flowing into millions of these S3 buckets all over the place. And we're kind of trying to think about, hey, is there an opportunity for us to point our indexing and analytics capability against structured and unstructured data and those data lakes. So that that'll be something we're going to >> Yeah. >> at least start prototyping pretty soon. And then lastly, machine learning, you know, I'd say, you know, to use a baseball metaphor, like in terms of like how we apply machine learning, we're like in the bottom of the second inning, >> Yeah. >> you know, we've been doing it for a number of years, but there's so much more. >> There's so, I mean, machine learning is only as good as the data you put into the machine learning. >> Exactly, exactly. >> And so if you have, if you have gap in the data, the machine learning is going to have gaps in it. >> Yeah. And we have, we announced a feature today called auto detect. And I won't go into the gory details, but effectively what it does is it runs a real-time analytics job over whatever metrics you want to look at and you can do what I would consider more statistics versus machine learning. You can say, hey, if in a 10 minute period, like, you know, we see more errors than we see on average over the last week, throw an alert so I can go investigate and take a look. Imagine if you didn't have to figure out what the right thresholds were, if we could just watch those metrics for you and automatically understand the seasonality, the timing, is it a weekly thing? Is it a monthly thing? And then like tell you like use machine learning to do the anomaly detection, but do it in a way that's more intelligent than just the static threshold. >> Yeah. >> And so I think you'll see things like auto detect, which we announced this week will evolve to take advantage of machine learning kind of under the covers, if you will. >> Yeah. It was interesting with cloud scale and the data velocity, automations become super important. >> Oh yeah. >> You don't have a lot of new disciplines emerge, like explainable AI is hot right now. So you got, the puck is coming. You can see where the puck is going. >> Yeah >> And that is automation at the app edge or the application layer where the data has got to be free-flowing or addressable. >> Garth: Yeah. >> This is something that is being talked about. And we talked about data divide with, with Chris earlier about the policy side of things. And now data is part of everything. It's part of the apps. >> Garth: Yeah. >> It's not just stored stuff. So it's always in flight. It should be addressable. This is what people want. What do you think about all of that? >> No, I think it's great. I actually just can I, I'll quote from Steve Schmidt in, in sort of the keynote, he said, look like security at the end of the day is a human problem, but it kind of manifests itself through data. And so being able to understand what's happening in the data will tell you, like, is there a bad actor, like wreaking havoc inside of my systems? And like, you can use that, the data trail if you will, of the bad actor to chase them down and sort of isolate em. >> The digital footprints, if you will, looking at a trail. >> Yeah. >> All right, what's the coolest thing that you like right now, when you look at the treasure trove of, of a value, as you look at it, and this is a range of value, Splunk, Splunk has had customers come in with, with the early product, but they keep the customers and they always do new things and they operationalize it >> Garth: Yep. >> and another new thing comes, they operationalize it. What's the next new thing that's coming, that's the next big thing. >> Dude that is like asking me which one of my daughters do I love the most, like that is so unfair. (laughing) I'm not going to answer that one. Next question please. >> Okay. All right. Okay. What's your goals for the next year or two? >> Yeah, so I just kind of finished roughly my first 100 days and it's been great to, you know, I had a whole plan, 30, 60, 90, and I had a bunch of stuff I wanted to do. Like I'm really hoping, sort of, we get past this current kind of COVID scare and we get to back to normal. Cause I'm really looking forward to getting back on the road and sort of meeting with customers, you know, you can meet over Zoom and that's great, but what I've learned over time, you know, I used to go, I'd fly to Wichita, Kansas and actually go sit down with the operators like at their desk and watch how they use my tools. And that actually teaches you. Like you, you come up with things when you see, you know, your product in the hands of your customer, that you don't get from like a CAB meeting or from a Zoom call, you know? >> John: Yeah, yeah. >> And so being able to visit customers where they live, where they work and kind of like understand what we can do to make their lives better. Like that's going to, I'm actually really excited to gettin back to travel. >> If you could give advice to CTO, CISO, or CIO or a practitioner out there who are, who is who's sitting at their virtual desk or their physical desk thinking, okay, the pandemic, were coming through the pandemic. I want to come out with a growth strategy, with a plan that's going to be expansive, not restrictive. The pandemic has shown what's what works, what doesn't work. >> Garth: Sure. >> So it's going to be some projects that might not get renewed, but there's doubling down on, certainly with cloud scale. What would advice would you give that person when they start thinking about, okay, I got to get my architecture right. >> Yeah. >> I got to get my playbooks in place. I got to get my people aligned. >> Yeah >> What's what do you see as a best practice for kind of the mindset to actual implementation of data, managing the data? >> Yeah, and again, I'm, I'm, this is not an original Garth thought. It actually came from one of our customers. You know, the, I think we all, like you think back to March and April of 2020 as this thing was really getting real. Everybody moved as fast as they could to either scale up or scale scaled on operations. If you were in travel and hospitality, you know, that was, you know, you had to figure how to scale down quickly and like what you could shut down safely. If you were like in the food delivery business, you had to figure out how you could scale up, like Chipotle hit two, what is it? $2 billion run rate on delivery last year. And so people scrambled as fast as they could to sort of adapt to this new world. And I think we're all coming to the realization that as we sort of exit and get back to some sense of new normal, there's a lot of what we're doing today that's going to persist. Like, I think we're going to have like flexible rules. I don't think everybody's going to want to come back into the office. And so I think, I think the thing to do is you think about returning to whatever this new normal looks like is like, what did we learn that was good. And like the pandemic had a silver lining for folks in many ways. And it sucked for a lot. I'm not saying it was a good thing, but you know, there were things that we did to adapt that I think actually made like the workplace, like stronger and better. And, and sort of. >> It showed that data's important, internet is important. Didn't break, the internet didn't break. >> Garth: Correct. >> Zoom was amazing. And the teleconferencing with other tools. >> But that's kind of, just to sort of like, what did you learn over the last 18 months that you're going to take for it into the next 18 years? You know what I mean? Cause there was a lot of good and I think people were creative and they figured out like how to adapt super quickly and take the best of the pandemic and turn it into like a better place to work. >> Hybrid, hybrid events, hybrid workforce, hybrid workflows. What's what's your vision on Splunk as a tier one enterprise? Because a lot of the news that I'm seeing that's, that's the tell sign to me in terms of this next growth wave is big SI deals, Accenture and others are yours working with and you still got the other Partnerverse going. You have the ecosystems emerging. >> Garth: Yep. >> That's a good, that means your product's enabling people to make money. >> Garth: Yeah. Yeah, yeah, yeah. >> And that's a good thing. >> Yeah, BlueVoyant was a great example in the keynote yesterday and they, you know, they've really, they've kind of figured out how, you know, most of their customers, they serve customers in heavily regulated industries kind of, and you know, those customers actually want their data in a Splunk tenant that they own and control and they want to have that secure boundary around that. But BlueVoyant's figured out how they can come in and say, hey, I'm going to take care of the heavy lifting of the day-to-day operations, the monitoring of that environment with the security. So, so BlueVoyant has done a great job sort of pivoting and figuring out how they can add value to customers and do, you know, because they they're managing not just one Splunk instance, but they're managing 100s of Splunk cloud instances. And so they've got best practices and automation that they can play across their entire client base. And I think you're going to see a lot more of that. And, and Teresa's just, Teresa is just, she loves Partners, absolutely loves Partners. And that was just obvious. You could, you could hear it in her voice. You could see it in her body language, you know, when she talked about Partnerverse. So I think you'll see us start to really get a lot more serious. Cause as big as Splunk is like our pro serve and support teams are not going to scale for the next 10,000, 100,000 Splunk customers. And we really need to like really think about how we use Partners. >> There's a real growth wave. And I, and I love the multiples wave in parallel because I think that's what everyone's consensus on. So I have to ask you as a final question, what's your takeaway? Obviously, there's been a virtual studio here where all the Splunk executives and, and, and customers and partners are here. TheCUBE's here doing all the presentations, live by the way. It was awesome. What would you say the takeaway is for this .conf, for the people watching and consuming all the content online? A lot of asynchronous consumption would be happening. >> Sure. >> What's your takeaway from this year's Splunk .conf? >> You know, I, it's hard cause you know, you get so close to it and we've rehearsed this thing so many times, you know, the feedback that I got and if you look at Twitter and you look at my Slack and everything else, like this felt like a conf that was like kind of like a really genuine, almost like a Splunk two dot O. But it's sort of true to the roots of what Splunk was true to the product reality. I mean, you know, I was really careful with my team and to avoid any whiff of vaporware, like what were, what we wanted to show was like, look, this is Splunk, we're acquiring companies, you know, 43 major releases, you know, 100s of small ones. Like we're continuing to innovate on your behalf as fast as we can. And hopefully this is the last virtual conf. But even when we go back, like there was so much good about the way we did this this week, that, you know, when we, when we broke yesterday on the keynote and we were sitting around with the crew and it kind of looking at that stage and everything, we were like, wow, there is a lot of this that we want to bring to an in-person event as well. Cause so for those that want to travel and come sit in the room with us, we're super excited to do that as soon as we can. But, but then, you know, there may be 25, 50, 100,000 that don't want to travel, but can access us via this virtual event. >> It's like a time. It's a moment in time that becomes a timeless moment. That could be, >> Wow, did you make that up right now? >> that could be an NFT. >> Yeah >> We can make a global cryptocurrency. Garth, great to see you. Of course I made it up right then. So, great to see you. >> Air bump, air bump? Okay, good. >> Okay. Garth Fort, senior vice president, Chief Product Officer. In theCUBE here, we're live on site at Splunk Studio for the .conf virtual event. I'm John Furrier. Thanks for watching. >> All right. Thank you guys. (upbeat music)