>> Announcer: Live from Las Vegas, it's theCUBE! Covering Splunk .conf19. Brought to you by Splunk. Okay, welcome back, everyone. This is day three live CUBE coverage here in Las Vegas for Splunk's .conf. Its 10 years anniversary of their big customer event. I'm John Furrier, theCUBE. This is our seventh year covering, riding the wave with Splunk. From scrappy startup, to going public company, massive growth, now a market leader continuing to innovate. We're here with the CEO, Doug Merritt of Splunk. Thanks for joining me, good to see you. >> Thank you for being here, thanks for having me. >> John: How ya feelin'? (laughs) >> Exhausted and energized simultaneously. (laughs) it was a fun week. >> You know, every year when we have the event we discuss Splunk's success and the loyalty of the customer base, the innovation, you guys are providing the value, you got a lot of happy customers, and you got a great ecosystem and partner network growing. You're now growing even further, every year it just gets better. This year has been a lot of big highlights, new branding, so you got that next level thing goin' on, new platform, tweaks, bringing this cohesive thing. What's your highlights this year? I mean, what's the big, there's so much goin' on, what's your highlights? >> So where you started is always my highlight of the show, is being able to spend time with customers. I have never been at a company where I feel so fortunate to have the passion and the dedication and the enthusiasm and the gratitude of customers as we have here. And so that, I tell everyone at Splunk this is similar to a holiday function for a kid for me where the energy keeps me going all year long, so that always is number one, and then around the customers, what we've been doing with the technology architecture, the platform, and the depth and breadth of what we've been working on honestly for four plus years. It really, I think, has come together in a unique way at this show. >> Last year you had a lot of announcements that were intentional announcements, it's coming. They're coming now, they're here, they're shipping. >> They're here, they're here. >> What is some of the feedback you're hearing because a lot of it has a theme where, you know, we kind of pointed this out a couple of years ago, it's like a security show now, but it's not a security show, but there's a lot of security in there. What are some of the key things that have come out of the oven that people should know about that are being delivered here? >> So the core of what we're trying to communicate with Data-to-Everything is that you need a very multifaceted data platform to be able to handle the huge variety of data that we're all dealing with, and Splunk has been known and been very successful at being able to index data, messy, non-structured data, and make sense of it even though it's not structured in the index, and that's been, still is incredibly valuable. But we started almost four years ago on a journey of adding in stream processing before the data gets anywhere, to our index or anywhere else, it's moving all around the world, how do you actually find that data and then begin to take advantage of it in-flight? And we announced that the beta of Data Stream Processor last year, but it went production this year, four years of development, a ton of patents, a 40 plus person, 50 plus person, development team behind that, a lot of hard engineering, and really elegant interface to get that there. And then on the other end, to complement the index, data is landing all over the place, not just in our index, and we're very aware that different structures exist for different needs. A data warehouse has different properties than a relational database which has different properties than a NoSQL column store in-memory database, and data is going to only continue to be more dispersed. So again, four plus years ago we started on what now is Data Fabric Search which we pre-announced in beta format last year. That went production at this show, but the ability to address a distributed Splunk landscape, but more importantly we demoed the integration with HTFS and S3 landscapes as the proof point of we've built a connector framework, so that this really cannot just be a incredibly high-speed, high-cardinality search processing engine, but it really is a federated search engine as well. So now we can operate on data in the stream when it's in motion. We obviously still have all the great properties of the Splunk index, and I was really excited about Splunk 8.0 and all the features in that, and we can go get data wherever it lives across a distributed Splunk environment, but increasingly across the more and more distributed data environment. >> So this is a data platform. This is absolutely a data platform, so that's very clear. So the success of platforms, in the enterprise at least, not just small and medium-sized businesses, you can have a tool and kind of look like a platform, there's some apps out there that I would point to and say, "Hey, that looks like a tool, it's really not a platform." You guys are a platform. But the success of a platform are two things, ecosystem and apps, because if you're in a platform that's enabling value, you got to have those. Talk about how you see the ecosystem success and the app success. Is that happening in your view? >> It is happening. We have over 2,000 apps on our Splunkbase framework which is where any of our customers can go and download the application to help draw value of a Palo Alto firewall, or ensure integration with a ServiceNow trouble ticketing system, and thousands of other examples that exist. And that has grown from less than 300 apps, when I first got here six years ago, to over 2,000 today. But that is still the earliest inning, for earliest pitch and your earliest inning journey. Why are there 20,000, 200,000, two million apps out there? A piece of it is we have had to up the game on how you interface with the platform, and for us that means through a stable set of services, well-mannered, well-articulated, consistently maintained services, and that's been a huge push with the core Splunk index, but it's also a big amount of work that we've been doing on everything from the separation between Phantom runbooks and playbooks with the underlying orchestration automation, it's a key component of our Stream Processor, you know, what transformations are you doing, what enrichments are you doing? That has to live separate than the underlying technology, the Kafka transport mechanism, or Kinesis, or whatever happens in the future. So that investment to make sure we got a effective and stable set of services has been key, but then you complement that with the amazing set of partners that are out here, and making sure they're educated and enabled on how to take advantage of the platform, and then feather in things like the Splunk Ventures announcement, the Innovation Fund and Social Impact Fund, to further double down on, hey, we are here to help in every way. We're going to help with enablement, we're going to help with sell-through and marketing, and we'll help with investment. >> Yeah, I think this is smart, and I think one of the things I'll point out is that feedback we heard from customers in conversations we had here on theCUBE and the hallway is, there's a lot of great feedback on the automation, the machine learning toolkit, which is a good tell sign of the engagement level of how they're dealing with data, and this kind of speaks to data as a value... The value creation from data seems to be the theme. It's not just data for data's sake, I mean, managing data is all hard stuff, but value from the data. You mentioned the Ventures, you got a lot of tech for good stuff goin' on. You're investing in companies where they're standing up data-driven companies to solve world problems, you got other things, so you guys are adjusting. In the middle innings of the data game, platform update, business model changes. Talk about some of the consumption changes, now you got Splunk Cloud, what's goin' on on (laughs) how you charge, how are customers consuming, what moves did you guys make there and what's the result? >> Yeah, it's a great intro on data is awesome, but we all have data to get to decisions first and actions second. Without an action there is no point in gathering data, and so many companies have been working their tails off to digitize their landscapes. Why, well you want a more flexible landscape, but why the flexibility? Because there's so much data being generated that if you can get effective decisions and then actions, that landscape can adapt very, very rapidly, which goes back to machine learning and eventual AI-type opportunities. So that is absolutely, squarely where we've been focused, is translating that data into value and into actual outcomes, which is why our orchestration automation piece was so important. One of the gating factors that we felt has existed is for the Splunk index, and it's only for the Splunk index, the pricing mechanism has been data volume, and that's a little bit contrary to the promise, which is you don't know where the value is going to be within data, and whether it's a gigabyte or whether it's a petabyte, why shouldn't you be able to put whatever data you want in to experiment? And so we came out with some updates in pricing a month and change ago that we were reiterating at the show and will continue to drive on a, hopefully, very aggressive and clear marketing and communications framework, that for people that have adjusted to the data volume metric, we're trying to make that much simpler. There's now a limited set of bands, or tiers, from 100 gigs to unlimited, so that you really get visibility on, all right, I think that I want to play with five terabytes, I know what that band looks like and it's very liberal. So that if you wind up with six and a half terabytes you won't be penalized, and then there's a complimentary metric which I think is ultimately going to be the more long-lived metric for our infrastructurally-bound products, which is virtual CPU or virtual core. And when I think about our index, stream processing, federated search, the execution of automation, all those are basically a factor of how much infrastructure you're going to throw at the problem, whether it's CPU or whether it's storage or network. So I can see a day when Splunk Enterprise and the index, and everything else at that lower level, or at that infrastructure layer, are all just a series of virtual CPUs or virtual cores. But I think both, we're offering choice, we really are customer-centric, and whether you want a more liberal data volume or whether you want to switch to an infrastructure, we're there and our job is to help you understand the value translation on both of those because all that matters is turning it into action and into doing. >> It's interesting, in the news yesterday quantum supremacy was announced. Google claims it, IBM's debating it, but quantum computing just points to the trend that more compute's coming. So this is going to be a good thing for data. You mentioned the pricing thing, this brings up a topic we've been hearing all week on theCUBE is, diverse data's actually great for machine learning, great for AI. So bringing in diverse data gives you more aperture into data, and that actually helps. With the diversity comes confusion and this is where the pricing seems to hit. You're trying to create, if I get this right, pricing that matches the needs of the diverse use of data. Is that kind of how you guys are thinkin' about it? >> Meets the needs of diverse data, and also provides a lot of clarity for people on when you get to a certain threshold that we stop charging you altogether, right? Once you get above 10s of terabytes to 100 terabytes, just put as much data in as you want. The foundation of Splunk, going back to the first data, is we're the only technology that still exists on the index side that takes raw, non-formatted data, doesn't force you to cleanse or scrub it in any way, and then takes all that raw data and actually provides value through the way that we interact with the data with our query language. And that design architecture, I've said it for five, six years now, is completely unique in the industry. Everybody else thinks that you've got to get to the data you want to operate on, and then put it somewhere, and the way that life works is much more organic and emergent. You've got chaos happening, and then how do you find patterns and value out of that chaos? Well, that chaos winds up being pretty voluminous. So how do we help more organizations? Some of the leading organizations are at five to 10 petabytes of data per day going through the index. How do we help everybody get there? 'Cause you don't know the nugget across that petabyte or 10 petabyte set is going to be the key to solving a critical issue, so let's make it easy for you to put that data in to find those nuggets, but then once you know what the pattern is, now you're in a different world, now you're in the structured data world of metrics, or KPIs, or events, or multidimensional data that is much more curated, and by nature that's going to be more fine-grained. There's not as much volume there as there is in the raw data. >> Doug, I notice also at the event here there's a focus on verticals. Can you comment on the strategy there, is that by design? Is there a vertical focus? >> It's definitely by design. >> Share some insight into that. >> So we launched with an IT operations focus, we wound up progressing over the years to a security operations focus, and then our doubling down with Omnition, SignalFx, VictorOps, and now Streamlio is a new acquisition on the DevOps and next gen app dev buying centers. As a company and how we go to market and what we are doing with our own solutions, we stay incredibly focused on those three very technical buying centers, but we've also seen that data is data. So the data you're bringing in to solve a security problem can be used to solve a manufacturing problem, or a logistics and supply chain problem, or a customer sentiment analysis problem, and so how do you make use of that data across those different buying centers? We've set up a verticals group to seed, continue to seed, the opportunity within those different verticals. >> And that's compatible with the horizontally scalable Splunk platform. That's kind of why that exists, right? >> That the overall platform that was in every keynote, starting with mine, is completely agnostic and horizontal. The solutions on top, the security operations, ITOps, and DevOps, are very specific to those users but they're using the horizontal platform, and then you wind up walking into the Accenture booth and seeing how they've taken similar data that the SecOps teams gathered to actually provide insight on effective rail transport for DB cargo, or effective cell tower triangulation and capacity for a major Australian cell company, or effective manufacturing and logistics supply chain optimization for a manufacturer and all their different retail distribution centers. >> Awesome, you know, I know you've talked with Jeff Frick in the past, and Stu Miniman and Dave Vellante about user experience, I know that's something that's near and dear to your heart. You guys, it has been rumored, there's going to be some user experience work done on the onboarding for your Splunk Cloud and making it easier to get in to this new Splunk platform. What can we expect on the user experience side? (laughs) >> So, for any of you out there that want to try, we've got Splunk Investigate, that's one of the first applications on top of the fully decomposed, services layered, stateless Splunk Cloud. Mission Control actually is a complementary other, those are the first two apps on top of that new framework. And the UI and experience that is in Splunk Investigate I think is a good example of both the ease of coming to and using the product. There's a very liberal amount of data you get for free just to experiment with Splunk Investigate, but then the onboarding experience of data is I think very elegant. The UI is, I love the UI, it's a Jupyter-style workbook-type interface, but if you think about what do investigators need, investigators need both some bread crumbs on where to start and how to end, but then they also need the ability to bring in anybody that's necessary so that you can actually swarm and attack a problem very efficiently. And so when you go back and look at, why did we buy VictorOps? Well, it wasn't because we think that the IT alerting space is a massive space we're going to own, it's because collaboration is incredibly important to swarm incidents of any type, whether they're security incidents or manufacturing incidents. So the facilities at VictorOps gave, on allowing distributed teams and virtual teams to very quickly get to resolution. You're going to find those baked into all products like Mission Control 'cause it's one of the key facilities of, that Tim talked about in his keynote, of indulgent design, mobility, high collaboration, 'cause luckily people still matter, and while ML is helping all of us be more productive it isn't taking away the need for us, but how do you get us to cooperate effectively? And so our cloud-based apps, I encourage any of you out there, go try Splunk Investigate, it's a beautiful product and I think you'll be blown away by it. >> Great success on the product side, and then great success on the customer side, you got great, loyal customers. But I got to ask you about the next level Splunk. As you look at this event, what jumps out at me is the cohesiveness of the story around the platform and the apps, ecosystem's great, but the new branding, Data-to-Everything. It's not product-specific 'cause you have product leadership. This is a whole next level Splunk. What is the next level Splunk vision? >> And I love the pink and orange, in bold colors. So when I've thought about what are the issues that are some of the blockers to Splunk eventually fulfilling the destiny that we could have, the number one is awareness. Who the heck is Splunk? People have very high variance of their understanding of Splunk. Log aggregation, security tool, IT tool, and what we've seen over and over is it is much more this data platform, and certainly with the announcements, it's becoming more of this data fabric or platform that can be used for anything. So how do we bring awareness to Splunk? Well, let's help create a category, and it's not up to us to create the category, it's up to all of you to create the category, but Data-to-Everything in our minds represents the power of data, and while we will continue internally to focus on those technical buying centers, everything is solvable with data. So we're trying to really reinforce the importance of data and the capabilities that something like Splunk brings. Cloud becomes a really important message to that because that makes it, execution to that, 'cause it makes it so much easier for people to immediately try something and get value, but on-prem will always be important as well 'cause data has gravity, data has risk, data has cost to move. And there are so many use cases where you would just never push data to the cloud, and it's not because we don't love cloud. If you have a factory that's producing 100 terabytes an hour in a area where you've got poor bandwidth, there's no option for a cloud connect there of high scale, so you better be able to process, make sense of, and act on that data locally. >> And you guys are great in the cloud too, on-premise, but final word, I want to get your thoughts to end this segment, I know you got to run, thanks for your time, and congratulations on all your success. Data for good. There's a lot of tech for bad kind of narratives goin' on, but there's a real resurgence of tech for good. A lot of people, entrepreneurs, for-profit, for-nonprofit, are doing ventures for good. Data is a real theme. Data for good is something that you have, that's part of the Data-to-Everything. Talk about the data for good real quick. >> Yeah, we were really excited about what we've done with Splunk4Good as our nonprofit focused entity. The Splunk Pledge which is a classic 1-1-1 approach to make sure that we're able to help organizations that need the help do something meaningful within their world, and then the Splunk Social Impact Fund which is trying to put our money where our mouth is to ensure that if funding and scarcity of funds is an issue of getting to effective outcomes, that we can be there to support. At this show we've featured three awesome charities, Conservation International, NetHope, and the Global Emancipation Network, that are all trying to tackle really thorny problems with different, in different ways, different problems in different ways, but data winds up being at the heart of one of the ways to unlock what they're trying to get done. We're really excited and proud that we're able to actually make meaningful donations to all three of those, but it is a constant theme within Splunk, and I think something that all of us, from the tech community and non-tech community are going to have to help evangelize, is with every invention and with every thing that occurs in the world there is the power to take it and make a less noble execution of it, you know, there's always potential harmful activities, and then there's the power to actually drive good, and data is one of those. >> Awesome. >> Data can be used as a weapon, it can be used negatively, but it also needs to be liberated so that it can be used positively. While we're all kind of concerned about our own privacy and really, really personal data, we're not going to get to the type of healthcare and genetic, massive shifts in changes and benefits without having a way to begin to share some of this data. So putting controls around data is going to be important, putting people in the middle of the process to decide what happens to their data, and some consequences around misuse of data is going to be important. But continuing to keep a mindset of all good happens as we become more liberal, globalization is good, free flow of good-- >> The value is in the data. >> Free flow of people, free flow of data ultimately is very good. >> Doug, thank you so much for spending the time to come on theCUBE, and again congratulations on great culture. Also is worth noting, just to give you a plug here, because it's, I think, very valuable, one of the best places to work for women in tech. You guys recently got some recognition on that. That is a huge accomplishment, congratulations. >> Thank you, thank you, we had a great diversity track here which is really important as well. But we love partnering with you guys, thank you for spending an entire week with us and for helping to continue to evangelize and help people understand what the power of technology and data can do for them. >> Hey, video is data, and we're bringin' that data to you here on theCUBE, and of course, CUBE cloud coming soon. I'm John Furrier here live at Splunk .conf with Doug Merritt the CEO. We'll be back with more coverage after this short break. (futuristic music)

>> Announcer: Live from Las Vegas, it's theCUBE! Covering Splunk .conf19. Brought to you by Splunk. >> Okay, welcome back, everyone. It's theCUBE's live coverage here in Las Vegas for Splunk's .conf 2019. It's the 10th year of .conf and we have two great guests, Rick Fitz, senior vice president, general manager of groups at Splunk, and Karthik Rau, vice president, area GM of SignalFx. The big story is SignalFx acquired by Splunk. Rick, you sponsored that. Guys, welcome to theCUBE, great to see you guys again. >> Yeah, great to be here, Jeff. >> Great to be here. >> They just broke a world record for the bike on intro there. >> Rick: They did. >> Pretty exciting what's going on here, a lot of records being broken. Splunk just continues to move the needle on capabilities, product, platform, brand messaging. SignalFx coming, we've been reporting on it since their founding, really in your wheelhouse, you guys bought them for a good number, a big number? >> Rick: Yup. >> Why? What's going on? Why the interest in SignalFx? >> You know, for a long time, we've been watching, I would say, perhaps, patiently, watching the market and the trends, and we were really waiting for a time where the new application architecture was really going to kind of start to take hold, where this cloud native trend that we've been seeing where people are building applications, where people are actually delivering applications to market in quite a different way, would finally get some escape velocity, and we've been watching patiently for that to occur. And as we saw that last year start to accelerate, really, we went out and surveyed the entire market and, of course, at the end of that survey, resulted in the acquisition of SignalFX, and also of Omnition. And so we bought those two companies, and have combined them to deliver on our vision of what we've trying to do for DevOps. >> Rick, you and I had a conversation in 2015 here in theCUBE at the .Conf at that time, you were on the IoT, you saw this wave, again, you've been patient. What about IT operations that's happening now that makes this so critical for Splunk? 'Cause IT operations, we know what automation's doing, machine learning toolkit, getting a lot of rave reviews. People love to automate things, but more apps are coming. What's the motivation now? What was the critical linchpin for you to make this happen? >> Yeah, exactly. What we're seeing is, in traditional IT operations is this world where developers build these monolithic applications, hand 'em off to operations, and they operate it. And then in the same conversation, you'll get handed over to somebody running, if you will, developer engineering or cloud engineering or they have various different levels for it but you're really dealing with an engineering organization and they're being tasked with digitization of their enterprise and very strategic investments are being made there, but they're also being asked to build things at high availability, high scalability, and highly reliable with lots of change. So it's kind of the competitive advantage of the enterprise. And as I was seeing that occur more and more I just saw the distance between IT operations and development, kind of, separate, and I said, wow, that's interesting 'cause it's being driven by this new application architecture, or cloud native architecture. And I didn't want to be left behind. I wanted to actually be able to build a bridge for IT operations into this future. And I think this future trend is something that's going to be lasting for the next 10, 15 to 20 years. So I think this is very strategic to Splunk and very important for us to get right for the long-term, but I also see my role as part of Splunk, is to make sure that we take IT operations into this new world, because these new worlds, and if you will, the existing worlds, those operating models are quite different. >> John: Yeah. >> They operate differently. They think differently. They, in one they own their code, they're on call. In another one they're waiting for something to fix so then they try to, you know, we're waiting for something to break and then they fix it. So we're trying to actually help enterprises across that entire gambit with some pattern. >> And certainly with security the theme here, at this event, this is a security event too, on top of everything right? So, this is what it's turned into. >> Rick: That's right. >> Data is driving a lot of security polemetry and data's important for security, so. >> Yeah. >> I mean, that's operations. >> That's right. And your apps have to be secured, in both worlds. >> Yeah. >> So, I think Splunk has a role to play in helping in this transformation for all of IT as it becomes much more developer centric. And, of course, as I said, that is really one of the strategic reasons why we led the acquisition Citadel FX in Omni. >> Well, we're looking forward to seeing how you handle the acquisition, of course, we were fans of the deal. Karthik, I got to ask you, every single company in observability space is going public. So, why, you could have gone public, why Splunk? Why sell to these guys? What made it a fit for you? >> Well, ultimately, we look at a number of things, or we looked at a number of things in making the decision and we wouldn't have done this with anyone other than Splunk. Just a strategic fit was just so great on so many levels. You know, when we started the company our goal was to solve the modern dream observability challenges for anyone building a cloud native application, and we knew that was going to be a long road. They're going to be a lot of things we needed to invest in and develop. And so we started on the metric side. We layered on distributive tracing and we took a philosophy that we wanted to build an enterprise great, scalable, robust, feature-rich set of technologies. We weren't in the market to build, you know, SMB, kind of very simple, limited type of a product. We're really focused on the larger, more sophisticated customers. And so, as we looked at continuing to extend our portfolio, one of the things that we needed to invest in was in the logging space because, when you think about the trifecta of monitoring data types that you need, you know, logging is a big part of it. And we knew that we wouldn't be able to go and build a logging system from the ground up that would be robust enough to support enterprise use cases, and so we started a partnership conversation with Rick and team, and it just became very clear through that process that there was a tremendous amount of product fit, vision fit, culture fit, values fit. Just everything was so aligned that we realized that we could do so much more together as one company. So, we rounded out the solution portfolio, or the technology portfolio quite substantially over night by becoming a part of Splunk and then the other part of it too is, you know, we saw as we were dealing with customers, we were dealing mostly with native cloud native, cloud first customers. But a lot of the customers that we were, that were prospects, that we were talking too were more traditional enterprises who were not 100% of the way there yet. Some of them weren't even 10% of the way there yet. And it was difficult for us to really engage in conversations early with them, to help them understand what does it mean to shift from traditional IT ops to DevOps because we didn't have a relationship with them on the IT ops side of things, and so, the other thing that we were really excited about being a part of Splunk is we can be a part of that conversation from the very beginning when the customer, you know, maybe they're just beginning to think about it and they don't have the urgency of doing it today but we can be there with them from the very beginning and help them get there on their timelines. >> This is an interesting discussion point because what you're highlighting and we've had conversations about your company about being a platform, not just a tool. So, you're getting at is that as you guys started getting more market share, you're platform needs, you needed logging. And meet the market leader, right here right? >> Yeah. >> That's right. >> So, you guys need them, so, partnering's hard when you're trying to build a platform. Now, you can have a platform that enables partners to build on top of it, but components of a full baked platform, it's hard to partner. Rick, what's your thoughts and reaction to that, because that's my statement, but do you agree with it? It's hard to partner in the platform, it's core competency. Look it, he struggled with logging 'cause he'd have to build out a boat load of new investment and you guys are already, just to catch up. >> Yeah, that's right. And I think the thing that needs to be stated here is in your large scale enterprises, they are truly looking for the best to breed, highly scalable environments, right, that we're talking about here. And, they want, they encouraged us to take a step in this direction. It was an obvious choice and I think that has been the reaction that we've kind of heard universally. Like, this is a great idea. This is a really strategic thing that you've Splunk folks have actually done. And so that's really encouraging and so I would agree with you. Partnering, and we were talking through it, but as we were talking, it's like, this is better not to partner in this case. >> John: Better together. >> One of the things that's really important is that logs, you know, that's what were all about. We've actually spent a lot of time in trying to invest into this streaming world of dealing with things in stream. And these guys have perfected it for Metrix, which is, that's the strategic aspect of this. And then combining what they had already done with Tracing, with Omnition, it just doubles down on this future of this application architecture that I mentioned. >> Some MMAs have a couple flavors to them. You buy a company, you throw them under a general manager, an executive, they kind of live there. Founders lead, you get the core tech, some team. The other scenario is full team comes in, hits the ground running. They're building out. They're going to own the build-out. It's seems to me based upon the Omnition acquisition, you're giving Karthik and team, kind of some reign here. >> Rick: Yeah. >> To go build this out. Is that how you guys see it? >> Yeah, that's exactly right. And so, both Speros and Karthik report to me. I'm their onboarding czar, as it were. But were really what we're going to focus on is customer success and achieving our business case. And really capitalizing on the opportunity. These guys were running a hundred miles an hour and we got to get them to got a thousand miles and we're only going to make adjustments to the business case in order to achieve that. And that's what we're here to do is to shepherd this organization in its entirety to the greatness that I think we all see out there. We're going to do that in a very careful, cautious way. >> Karthik, Omnition is a acquisition stealth company. Kind of a commitment saying hey, here's some more horsepower. Talk about how that happened and what's the purpose behind that acquisition. >> Well, I can let Rick talk to how it happened. And I'll talk about the other plans, so. >> When we surveyed the market we actually found that people have certain strengths. These guys that actually started their journey into tracing. I guess their first release was last December and so they've made some strides. And we kind of found Omnition through this discussion and we went like, oh my gosh. And we were in the process of doing the acquisition, doing due diligence. And we set everything on their roadmap is what these guys have done and vice versa. This is another combination that we can't pass up. This is, and what I told him the day we closed, I said, if you had the capital you would have done this, and he's like, yeah I would've. (chuckles) >> One of the things that Rick had asked me during our process was, what are the top three things that you would invest in if you had Slunk resources behind you. And I said Microservices APM, Microservices APM, Microservices APM, and so. >> And I got a big grin 'cause I obviously couldn't disclose what we doing but.. >> You know, the Omnition team, they're still in stealth so there's not a whole lot out there on the web about them. It's a phenomenal team. They've got people who are committers on some major open source projects, deeply technical, very, very shared philosophy to what we had a SignalFx in terms of open instrumentation, not having any proprietary lock in how you collect an instrument data. Very similar philosophies around leveraging the power of analytics and monitoring. And we just actually focused on different parts of the problem because we're both relatively early in this effort. So, we effectively doubled up the teams capacity over night and accelerated our roadmap by several quarters, so, I'm really excited about what we can do together with them. >> Well, are they the Bay area or they from.. >> They are Bay area base, yes. >> Okay cool. Well, I want to get your guys' thoughts on the keynote today. Feedback was authentic, kind of very cool keynote. As you guys bring this together, Rick, Karthik team, the optics, the messaging, what's the core positioning? What's, as you guys look at wholistic view now that you've invested in and are building out for customers, what's the posture? Take us through the keynote positioning. What's the marketplace, customer message around the future here? >> Yeah, I think it's really clear that what we're trying to do for IT organizations and application development organizations is build solutions that are modern and helpful to their core mission. And, by the way as I mentioned, in the world of new development, it's different, it's a different solution set. It's a different approach, a different operating model than it is in current IT operations. And so, one of the key messages we wanted to resonate is that we have the right solutions in both these worlds for you and that we're trying to develop an operating model of reactive response, a quick response, or engaging the right person in the problem, through our use of VictorOps for example, and using that as a way to be very intelligent about how we educate the people that are engaging in resolution process. So, we are trying to create a bridge to both worlds so that they can both be successful. And then under pit that, of course, with automation that can be leveraged in both worlds as well. So, that's what we're trying to convey. We know it's early days, by the way, these guys have been with the company for three weeks, so, it's kind of like, wow. >> Culture shock. >> Culture shock. >> Throw into deep water. Yeah, let's throw you out on stage in front of 11,000 people and see if you can swim and they did phenomenal, by the way. But that was kind of the key message and we're so excited because we just, we feel like were just in the first inning of perhaps a 19 or 20 inning game, 'cause I think it's going to be a lot of fun. >> Karthik: Yeah it is. >> And it's going to be close out here but we're really excited to be able to bring this to market. >> I mean, it's amazing coming in now three weeks in to see the breath of technology that's available and that's going platform. And, you know, what struck me today watching the keynote was just, you know it's such a feature rich and such a broad platform from everything in the, with the core, indexing capabilities that everyone's known about a long time. All of the ML, the additional capabilities we're going to bring in on the metric side. >> Yeah. >> And then the use cases just across every persona, there's just so much that we can do. >> What do you think of the culture? Are they run hard? They a playful company? They like to work hard, play hard? >> Yup. >> But they also are focused on real customer value. They got great engaged communities. What's your take of the culture so far? >> Yeah, absolutely. I mean culture fit was a really important part for us if we're going to be acquired by a company and be a part of a larger organization. Their kindred spirits I feel to the way we ran SignalFx. It's a very customer focused organization, great technology and engineering culture. And it's hard to find both, right? It feels like every organization is very important and very well respected. It's not like heavily skewed to it's just all about engineers, it's all about sales, it's very balanced culture and it's very customer focused. >> Guys, congratulations. Big deal. They don't see these kind of mega deals, they come along once in a while. It's a big bet. Good luck with everything, Rick. Thanks for coming on. Final question for both of you, what's the big take-a-way to take back to the office as you leave .Conf this week? What's going to resinate the most with you guys that you're going to take back as feedback? >> For me its, you know, I get my energies from customer conversations. We all do here at Splunk. If you're having a bad day, go talk to a customer and then they walk you and stop you in the hall and say, you know we really thank you again doing what you do. And so it just, I take back from this always that what we do matters and is important and just keep chugging along at it because we're doing some really good work out there that's really helping lives. And that's really important. >> John: That's good therapy. >> Yeah. >> When a bad day, talk to a customer. >> Go talk to a customer. >> I love you guys. (laughs) What's your take-a-way? >> I'm just, I'm thrilled at the number of customers who are coming up to me and saying how excited they are about the acquisition and working with us. You know, that's really re-affirming for me and it's just super exciting to see what we have ahead of us. >> You guys have a great tech following. A lot of tech leaders who knew you guys, knew you had good stuff so congratulations. Great Validation. >> Yup. Thank you. >> John: Good job >> Thank you John. >> Thanks you guys for coming on theCUBE. Great insight. Thanks for sharing all that data. (laughs) Data to everywhere here on theCUBE. I'm John Furrier, more coverage after this short break. (upbeat music)

(funky music) >> Live from San Francisco, it's theCube, covering RSA Conference 2019 brought to you by Forescout. >> Hey welcome back everybody Jeff Frick here with theCUBE. We're at the RSA Conference at downtown San Francisco Moscone Center, they finally finished the remodel. We're excited to be in the Forescout booth, we've never been in the Forescout booth before, psyched that they invited us in. But we've got an old time CUBE alumni and a special company in my heart, was my very first CUBE event ever was Splunk.conf 2012. >> I did not know that Jeff. >> Yeah so we're live. We have Doug Merritt on he's a CEO of Splunk. Doug great to see you. >> Thanks Jeff, good to see you again also. >> Yeah so we've been doing Splunk.conf since 2012. >> The early days. The Cosmo Hotel and it was pouring rain that week. >> That was the third year. >> Probably the third year? >> Second year, yeah long time ago, it's grown. >> 2012 wasn't that big but this is a crazy show. You've been coming here for a while. Security is such an important part of the Splunk value proposition, just general impressions of RSA as you've been here for a couple of days. >> Yeah, it's amazing to see how the show has grown over the years, security's gone from this, kind of backwater thing that a few weird people did in the corner, that only understood the cyber landscape, to something that boards care about now. And that, obviously has helped with this show, I don't know what the attendee numbers are like, but tens of thousands of people. >> Oh yeah. >> You can't walk down a hallway without bumping into 10 brand new companies that were launched in the past year, and the security space and make the biggest challenge people that I have, and I think that other people have is, how do you tell different, where's the wheat from the chaff? What is really important in security and how do you tell different companies and different trends apart, so you can actually focus on what matters? >> Right, I just feel for the seed-sows, right, I mean, you guys have a big ecosystem at .conf, but those are all kind of complimentary things around the core Splunk solution. This is, you've got co-opetition, competition, how does somebody navigate so many options? 'Cause at the end of the day you don't have unlimited resources, you don't have unlimited people to try to figure all these pieces of the puzzle out. >> Yeah, and the CSOs have got a really tough job, the average CSO has got well over a hundred different vendors you're dealing with, and with Splunk what we're very focused on, and where I think we add value is that we become, if done right, we become the abstraction layer that creates a brain and nervous system that allows all those different products, and all of them have got unique capabilities. When you think about the complexity of all the networking, all the compute, all the storage, all the end point landscapes that's only getting worse for the cloud, because now there's more services with more varieties across more cloud vendors. How do you get visibility on that? >> Right, right. >> And you need products at those different junctures, 'cause protect and prevent and defend is still an important function for CSOs, but when we know that you can't prevent everything. >> Right. >> And things will go wrong, how do you know that, that is actually occurring? And what the splunk value prop is, we are the, we don't have as much of a point of view on any one product, we aggregate data from all the products, which is why so many people are partners, and then help companies with both raw investigations, given that if something goes wrong with our schema less data structure, but then also with effective monitoring and analytics that's correlating data across those tens, hundreds or thousands of different technologies. So you can get a better feel for what are the patterns that make sense to pay attention to. >> I think you just gave me like 10 questions to ask just in that answer, you covered it all. 'Cause the other thing, you know, there's also IoT now and OT and all these connected devices so, you know the end points, the surface area, the throughput is only going up by orders of magnitude. >> Without a doubt. >> It's crazy. >> I saw some stats the other day that, globally at this point there's, I may get these off by one digit, but lets say there's 80,000 servers that are the backbone of the entire internet. There's already over 11 billion connected devices, going back to that IoT theme. So the ramifications at the edge and what that means are so profound and companies like Forescout, as a key partner of Splunk's, help make sure that you're aware of; what are all the different elements that are ever hitting my network in a way. And what do they look like and what, what should I be doing, as different things pop on and pop off and, again, we're trying to be the interpretation and brain layer for that, so that they are more and more intelligent to the actions they're taking, given their depth of domain, their deep knowledge of what a camera should look like, or what a windows PC should look like or what a firewall should look like given the configurations that are important to that company. >> Before we turned on the cameras you made an interesting comment. We used to talk about schema on read versus schema on write, that was the big, kind of big data theme, and you guys are sitting on a huge data flow, but you had a really kind of different take, because you never really know, even with schema on read it seems you know what the schema is but in today's changing environment you're not really sure what it is you're going to be looking for next right? And that can evolve and change over time, so you guys have kind of modified that approach a little bit. >> Yeah, I think we are this year you'll see us really reemphasizing that core of Splunk. That the reason you'd have an investigative lake, and I don't think most people know what a schema is period, much less read or write so my new terminology is hey you need a very thorough investigative lake. Going back to the discussion we were having, with so much surface area, so many network devices, so many servers, so many end points, what tool do you have that's reading in data from all of those, and they all are going to have crazy formats. The logs around those are not manageable. To say you can manage logs and centralize. Centralized logs I get, manage those words don't work together. >> Right. Logs are chaotic by nature, you're not going to manage them, you're not going to force every developer and every device to adhere to a certain data structure so it can neatly fit into your structured database. >> Right. >> It is too chaotic, but more importantly, even if you could you're going to miss a point, which is, once you structure data, you're limited with the types of questions you can ask, which means you had to visualize what the questions would be in the first place. In this chaotic environment you don't know what the questions going to be. The dynamics are changing way to quickly, so the investigative lake is truly, our index is not schematized in any way, so you can ask a million questions once versus a schematized data store where it is; I ask one question >> A million times. a million times. And that's super efficient for that, but, the uniqueness of Splunk is, the investigative lake is the fabric of what we do, and where I think our customers, almost have forgotten about Splunk is, read all that data in. I know we've got a volume based licensing model that we're working on customers, were working to solve that for you, that's not the, I'm not trying to get data in so that we can charge more, I'm trying to get data in so that everybody has got the capacity to investigate, 'cause we cannot fail in answering what, why, when, where, how, and stuff'll go wrong, if you can't answer that, man you're in big trouble. And then on top of that let's make sure you've got right monitoring capability, the right predictive analytics capability; and now with tools like Phantom, and we bought a company called victorOps, which is a beautiful collaboration tool, let's make sure you've got the right automation and action frameworks so that you can actually leverage peoples skills across the investigative, monitoring and analytical data stores that at Splunk we help with all four of those. >> Right, right, again, you touch on a lot of good stuff. We could go for hours but we don't have you all day. But I want to follow up on a couple of things, because one of the things that we hear over and over and over is the time to even know that you've been breached. The time to know that you have a problem, and again, by having all that data there you can now start adjusting your questions based on that way you now know. But I think what's even more kind of intriguing to me is, as nation states have become more active, as we've seen the politicalization of a lot of things, you know, what is valuable today is a much varied, much more varied answer than just tapping into a bank account or trying to steal credit card numbers. So it really supports, kind of this notion that you're saying, which you don't have a clue what the question is that you're going to need to ask tomorrow. So how do you make sure you're in a position, when you find out what the question is, that you can ask it? >> And that's the design architecture I like about splunk as a company is that our orientation is, if you're dealing with a world of chaos, allow that chaos to exist and then find the needles in the haystack, the meaning from that chaos, and then when you find the meaning, now you know that a monitor is worthwhile, because you've validated root cause and it exists. And when your monitor is kicked a few times, and you know it's legit, build a predictive routine, because you now know it's worth trying to predict, because you've seen this thing trip a number of times, which inverts the way that most people, that all of us were taught. Which is start with the end in mind, because garbage in equals garbage out, so be really thoughtful in what you want and then you can structure everything, it's like well, that's not the way the world works. What if the question we asked 15 years ago was, what if you couldn't start with the end in mind, what would you have to do? Well you'd have to have a schema less storage vehicle and a language that allows you to ask any question you want and get structure on the question, but then you still need a structure. So you're going to structure them one way or the other, how do you make sure you've got high quality structure, and in our dynamic landscape that's always going to change. >> Right, well the good news is 2020 next year so we'll all know everything right? >> Yeah, exactly. >> We'll have the hindsight. So the last thing before I let you go is really to talk about automation, and just the quantity and volume and throughput of these systems. Again, one, escalating, just 'cause it's always escalating, but two, now adding this whole connected devices and IoT, and this whole world of operational technology devices, you just, you can't buy your way out of it, you can't hire your way out of it, you have to have an increasing level of automation. So how are you kind of seeing that future evolve over the next couple of years? >> I've been meeting with a lot of customers obviously this week, and one of them said, the interesting part about where we are now is, you can't unsee what you've seen. And where we were five years ago, as most people in security and IT; which are natively digitized, they still didn't know how to wrap there arms around the data. So they just didn't see it, they were like the ostrich. Now with tools like Splunk they can actually see the data, but now, what do I do with it? When I've got a billion potential events per day, how do I deal with that? And even if I could find enough manpower, the skills are going to be changing at such a constant basis, so I think this security, orchestration, automation, response; SOAR, area and we were fortunate enough to form a great relationship with phantom a couple of years ago and add them to the Splunk fold, exactly a year ago, as, I think, the best of the SOAR vendors, but it's a brand new category. Because companies have not yet had that unseeing moment of, holy cow, what do I do, how do I even deal with this amount of information? And adding in automation, intelligent automation, dynamic automation, with the right orchestration layer is an absolute imperative for these shops going forward, and when I look at a combination of phantom and their competitors there's still less then a thousand companies in a sea of a million plus corporate entities, globally, that have licensed these products. So we're at the very beginning of this portion of the wave. But there's no way that companies will be able to be successful without beginning to understand what that means, and wrapping their minds around how to use it. What we're so excited about with Splunk, is traversing investigate, monitor, analyze and automate up and down continuously, we think is the key to getting the best value from this really, really diverse and chaotic landscape and then having phantom as part of the fold helps a lot, because you can get signal on, did I do the right automation? Did It actually achieve the goal that my brain told me to do, or not? And if not, what do I adjust in the brain? Do I go after different data, do I structure the data a different way? But that up and down the chain of check and balance, am I doing the right stuff is something that-- >> And do it continuously. >> It's got to be continuous. >> It's got to be continuous. So we're sitting in the Forescout booth, so talk about how Forescout plays. I mean you guys have been sitting on those (mumbles), really fundamental core date, they're really kind of been opening up a whole different set of data, so how is that kind of working out? >> Yeah, so I'm really thankful for the relationship, mostly because they're a great company and I love their CEO, but mostly, if you go customer back, it's a very important relationship. Which is the proliferation of devices, developments continues to grow, and most companies aren't even aware of the number of devices that exist in their sphere, much less how they should look, and then what vulnerabilities might exist because of changes in those devices. So the information flow of, here's what's in the eco-sphere of a customer into Splunk is really helpful, and then the correlation that Splunk drives, so that Forescout gets even more intelligent on what corrective actions to what type of actions period do I take across this sea of devices is a really important and beneficial relationship for our customers. >> Excellent, so I'll give you the last word, little plug for Splunk.conf coming up in October. >> Yeah, I'm really excited about conf, excited to have you guys there again. We've been on a really intense innovation march for the past few years. This last conf we introduced 20 products at conf, which was a record. We're trying to keep the same pace for conf 2019 and I hope that everyone gets a chance to come, because we're going to both be, moving forward those products that we talked about, but, I think really surprising people, with some of the directions that were taking, the investigate, monitor, analyze and act capabilities both as a platform and for security IT and our other key buy-in centers. >> Alright, well we'll see you there Doug, thanks for stopping by. >> Thank you, Jeff. >> Great seeing you. >> He's Doug, I'm Jeff, you're watching theCUBE, we're in the Forescout booth at RSA Conference 2019, thanks for watching we'll see ya next time. >> Thank you. (electronic music)

(energetic music) >> Live from Orlando, Florida, it's theCUBE covering .conf 18, brought to you by Splunk. >> We're back in Orlando, Splunk .conf 2018, I'm Dave Vellante, Stu Miniman, and this is theCUBE, the leader in live tech coverage. Doug Merritt is here, the CEO of Splunk, long time CUBE guest, great to see you again. >> Thank you, Dave, great to be here. >> So, loved the keynote yesterday and today. You guys have a lot of fun, I was laughing my you-know-what off at the auditions. They basically said, Doug wasn't a shoo in for the keynote, so they had these outtake auditions. They were really hilarious, you guys are a lot of fun. You got the great T-shirts, how do you feel? >> It's been a, my favorite time of year is .conf, both because there's usually so much that we're funneling to our customers at this time, but being here is just infectious, it's, and one of the things that always amazes me is it's almost impossible to tell who are the customers and who are the employees. That just, I think Devonia this morning said it's a family affair, and it's not just a family affair, it's that there's a shared passion, a shared, almost culture and value set, and there's, it just is a very inspiring and naturally flowing type of event and I know I'm biased because I'm the CEO of Splunk, but I don't, I just don't know of events that feel like our, like .conf does. There's a lot of great shows out there, but this has got a very unique feel to it. >> Well, we do a lot of shows, as you know, and I've always said, .conf, I think ServiceNow, does a great job obviously, re-invent the tableau shows. That energy is there, and the other thing is, we do, when we go to these shows, a lot of times, you'll look at the keynotes and say, are there any products being announced? You guys, that wasn't a problem here. You guys announced this -- >> Not this year. >> Bevy of products, I mean, it's clear the R and D is translating into stuff that people can consume, and obviously that you can sell, so that's huge. >> I'm really excited about the product roadmap right now, and it's, that was, when I got the job, almost three years ago, one of the key areas I leaned forward and the board was excited about it was, what, where or how are we going to take this product beyond the amazing index and search technology that we have? And this show, it takes a while to progress the roadmap to the point that you can get the type of volume that we have here, but this show was the first time that I felt that we had laid enough of the tracks, so you could see a much, much broader landscape of capabilities, and now it's a challenge of packaging and making sure our customers are successful with it, with the product that we just have, the products we've announced. >> Cloud caught a lot of companies and a lot of end user companies, flatfooted. You guys have embraced the cloud, not only with the AWS partnership, which we're going to talk about, but also the business model. You're successfully transitioning from a company with perpetual license model, to a ratable model, which is never easy. Wall Street is killing companies who try to do that. Why have you been successful doing that? You know, give us an update. >> Yeah, so five years ago, less than 20% of our contracts were, had any type of subscription orientation to it, whether it's a multi-year term or a cloud. We'd just launched our cloud four years ago. And we moved from there to we had told the street there would be 65% term in subscription by the end of this year and updated guidance at the end of the second quarter, which is just a month and change ago, that we've already hit the 75% mark that we were set in for next year, so it's been a pretty rapid progression and I think there're two elements that have helped us with that. One: cloud continues to catch fire and so the people's orientation on "Do I do something in the cloud?" four years ago they were much more nervous, so less nervous today. But data is growing at such a huge rate and people are still wrapping their heads around, "How do I take advantage of this data, how do I even begin to collect this data and then how do I take advantage of it?" And the elasticity that comes in the cloud and that comes with term contracts, we can flex out and flex back in, I think it's just a much more natural contracting motion than you bought this big, perpetual thing and pay maintenance on it, especially when someone is growing as fast as data is growing. >> Well and it requires you to communicate differently to the financial analysts. >> It does. >> Obviously, billings, you know, was an important metric. You've come up with some new metrics to help people understand the real health of the business. And one of the other metrics that strikes me, and you see this with some of the successful companies, I actually think Aneel Bhusri was sort of the modern version of this, is the number of seven figure deals. You're startin' to hit that, and it's not, the way he's phrased it was pretty good. It's not something you're trying to engineer, it's the outcome -- >> Yes. >> of having great, loyal customers, it's not something you try to micromanage. >> Right, and that's, just recently we dropped six figure deals, which, when I joined, you got this wonderful dynamic forecasting system that sits on top of sales for us, and so as head of sales, where I started, you're really paying attention to deals. I'd go down to a hundred thousand dollar deals that would track throughout the quarter. And now it's hard to get it down to the six figures 'cause we've got a big enough envelope of seven figure deals. So the business has changed pretty dramatically from where it was, but it is an outgrowth of our number one customer priority, which is, or number one corporate priority, which is customer success. 'Cause that investment by companies, when you get to a million dollars plus, in most cases that's a million annually, you better believe in and trust that vendor, 'cause that's no longer an easy, small departmental sale. You're usually at the CIO, CFO type level. So it's something that we're very honored by, that people trust us enough to get that footprint of Splunk to be that size and to feel like they're getting a value from Splunk to justify that purchase. >> Alright we'll get off the income statement, Stu, and you can read about all that stuff, and we're going to get into, we've got a lot of ground to cover with you, Doug. Jump in here, Stu. >> Yeah, so Doug, I've really enjoyed talking to some of your customers that, you know, most of them started on premises with you and now many of them, they're using Splunk cloud, it's really kind of a hybrid model, and it's been really interesting to watch the maturation of your partnership with Amazon, and being the leader in the cloud space. Give us a little bit of color as to what you're hearing from the customers, you said three, four years ago, you know, they were obviously a little bit more cautious around it, and bring us inside a little bit that partnership. >> Sure, so the first piece that, as part of Splunk, that I think is a little bit different than other vendors is because we are both a lower level infrastructural technology, right, data is, the way I frame what we do is there's these raw materials, which are all these different renditions of data around, and companies increasingly have to figure out how to gather together these different raw materials, put them together different ways, for the output that is driving their business. And we are the manufacturing parts provider that makes it easy for them to go and pick up any of these different compounds and then actually do what they want to do, which is make things happen with data. And that middle layer is really important and we have never taken a super strong stance either, we started on prem, but as we moved to cloud, we never took a strong stance saying everything should be in the cloud or everything should be on prem because data has gravity, there is physics to data. And it doesn't always make sense to move data around and it doesn't always make sense to keep data stagnant, so having that flexibility, being able to deploy your collection capability, whether it's ours or third party, your storage capability, and then your process and your search, what are you going to do with the data, anywhere that makes sense for a customer, I think, is important. And that's part of that hybrid story, is as people increasingly trust and interview us and other cloud vendors to build core apps and then house a lot of their data, we absolutely need to be there. And I think that momentum of the cloud is certainly as secure and, in many cases, more secure than my on prem footprint, and the velocity of invention that some like ABDS is driving allows me to be much more agile and effectively drive application development and leading edge capability, I think just has people continuing to trust the cloud service providers a little bit more. >> Yeah well, we're here in the pavilion, and seeing your ecosystem grow, we've been at re:Invent for about five years, that ecosystem is just so >> It's been amazing. >> massive and full, give us a little bit about the relationship with Amazon and how you look at that, how Amazon looks at a company like yours. >> Yeah, it's been, so one, whenever you're playing with a highly inventive and hugely successful company like Amazon, my orientation and what I convey back to the company is our job is to be more inventive, more agile, and continue to find value with our maniacal focus every day being the data landscape. Data is a service and outcomes is a service, so our job is run faster than Amazon. And I think that this show and our announcements help illustrate that our invention cycle is in high tilt gear and for what we do, we are leaning in in a really aggressive way to add that value. With that backdrop, Andy and I formed this partnership four years ago. He felt there's enough value in Splunk and we were a good enough partner and the way we consume their services that he would commission and quota their sales reps whenever a Splunk sale was done in the ADBS landscape, which I think has been really helpful for us, but we obviously are a huge customer of ADBS's and they become an increasingly large customer of ours and finally gave us approval with their three year renewal a quarter ago to publicly reference them as a sizeable customer for us. >> Oh, okay, congratulations on that. And something I've really, it's really crystallized for me: so many administrators out there, you look at their jobs, you know, what are they? It's like okay, I'm the security expert, I'm the network certified person. You're really, your users here, you know, they are the beacons of knowledge, they are the center of data, is really what they are. You know, Splunk's a tool, they're super excited about the product, but it's data at the center of what Splunk does and therefore, you're helping them in just such a critical aspect of what is happening in the industry today. >> Yeah, the key aspects of the keynote, of my keynote, were we are moving to a world where data is the product that people care about so the whole object is how do you make things happen with data and the people that can get that done increasingly are becoming the most valuable players on the field, so what infrastructure, what tooling, what capability exists that allows people from all departments, you know, we're very heavy within IT and security, but increasingly HR departments, finance departments, marketing departments, sales departments, manufacturing departments will not be successful without a really competent group of folks that understand how to make things happen with data and our job is to lower that bar so you don't have to go to Carnegie Mellon for four years and get a Masters in Computer Science and Data Science to be able to be that most valuable person on the field. >> I want to take a moment, I want to explain why I'm so bullish on Splunk. We had a conversation with Susan St. Ledger yesterday. Digital transformation is all about data. >> Yup. >> And you guys are all about data, there's the cliche which is "data is the new oil" and we've observed, well not really. I could put oil in my car, I can put oil in my house, I can't put it in both places, but data? I can use that same data in a lot of different use cases and that's exactly what you guys are doing now as you expand into line of business -- >> Yup. >> With Splunk Next. >> Yup. >> So you've announced that, you showed some cool demos today. I'd like you to talk about how you're going from your core peeps, the IT ops guys and the sec ops guys, and how, what your plan is to go to lines of business. More than just putting the data out there, you've come up with some new products that make it simpler, like business work flows, but what else are you doing from a go to market standpoint and a partnership standpoint, how do you see that playing out? >> Yeah, I think that the innovation on product, there are three key pillars that we're focusing on. Access data, any type of data, anywhere it lives. Make sure that we're driving actionable outcomes with that data, and acquisitions like Phantom and VictorOps have been a key pillar of that, but there's other things we're doing. And then, expand the capability of finding those outcomes to a much broader audience by lowering the bar. So the three key themes across the portfolio. But all of those are in service of the developers at a customer site, the developers in the ecosystem, to make it easier for them to actually craft a set of solutions that help a retailer, help a discrete manufacturer, help a hospital actually make things happen with data. 'Cause you could certainly start with a platform and build something specific for yourself but it's much easier if you start with a solution. And a lot of the emphasis we've been putting over the past two to three years is how do we up that platform game. And the many, many, 20 different product announcements that we rolled at this .conf and one of them that I'm also very excited about is our developer cloud where we've really enhanced the API layer that interacts with the different services that the entire Splunk portfolio represents. Not just the search and index pieces that people are familiar with but everything from orchestration to role based access to different types of visualization so a very broad API layer that's a well-mannered, restful set of APIs that allows third parties to much more crisply develop, excuse me, applications to compliment the 1800 apps that are already part of our Splunk base and right behind me is a developer pavilion where we've got the first hand full of early adopter OEM partners that are building their first sets of apps on top of that API framework. >> Dozens of them, it's actually worth walking around to see. Now, so that developer cloud is a lever, those developers are a lever for you to get into lines of business and build those relationships through the software, really, and through the apps. Same thing for IOT. >> Yup. >> Industrial IOT. Now, we've observed, and a lot of the IT companies that we see are trying to take a top down approach into IOT and we don't think it's going to work. It's, we talk about process engineers, it's operations technology people, they speak a different language. It's not going to be a top down, here, IT. >> A very different audience. >> It's going to be a bottoms up set of standards coming from the OT world. The brilliance of what you guys have, it's the data, you know, it's data coming off machines, data, you don't care. And so, you're in a good position to do a bottoms up in IOT and we heard some of that today. Now, there are some challenges. A lot of that data is still analog, okay, you can't really control that. A lot of the devices aren't instrumented, they're not connected, you can't control that. But once they become instrumented and connected and that analog data gets digitized, you're in a really good position, but then you got to build out the ecosystem as well. >> Yup. >> So talk about how you're addressing some of those challenges in industrial IOT. >> Yup, man, it's a great subject 'cause I think that the trying to rely on standards is the wrong approach. The velocity across this digital landscape is so high and my view over the past 30 years, I think it's only accelerated now, is there's going to be more and more varieties of data with different formats than there's ever been, and we've seen it in the past five years. Just look at the variety of services on top of AWS, which didn't even exist ten years ago, but and they now have hundreds of services and there is no organizing principle across those services as far as data definition. So it's a very chaotic data landscape and I don't think there's any way to manage it other than to embrace the chaos and work a little bit more bottoms up, you know, grab this data, don't worry about cleansing it, don't worry about structuring it, just make sure you have access to it and then make sure that you've got tools like Splunk that allow you to play with the data and try and find the patterns and the value inside of that data, which is where I think we're very uniquely suited as a technology set. Helping the ecosystem come to that realization is a key aspect of what we're doing. We're trying to attack it the same way we attacked the IT security piece which is pick a handful of verticals and really focus on the players, both the marquis anchor tenants, the BMWs, the Siemens', the Deutsche Bahn railroads of the world, as customers. And through that, get access to the key influencers and consultants and advisors to those industries and start to get that virtuous circle of "I actually have more data than I think I have." Even though there's some analog machines, there's so many different ways to attach to the signal that those machines are emitting and it may not be bi-directionally addressable, but at least you can see what's happening within those machines without a full manufacturing floor rip and replace. And everyone is excited about doing that. The advisors to the industry are excited, the industry themselves are excited. We had BMW on stage who walked through how they're using Splunk to help on everything from product design all the way through to predictive maintenance and feedback on the quality of the cars that they're rolling out. We've all heard stories that there's more lines of code in the Ford F150 and these other vehicles than there is within Facebook right now, so we all are dealing with rolling and sitting in building's and house's data centers. How do you make sure that you're able to pay attention what's happened within that data center? So I think that that is as big or bigger of an opportunity than what we've done with IT and security, it just has its own pace of understanding and adoption. >> Carnival Cruise Line, another one, Stu. We had those guys on today and they basically look, they have a lot of industrial equipment on those ships, so they're excited. >> Yeah, absolutely. Alright, so Doug, we started the beginning talking about the last couple years, how we measure Splunk has changed. Going to more subscription models, talk about how many customers you have. I look at developers, I look at IOT, whole different set of metrics. So if you look at Splunk Next, how do we measure you, going forward? What is success for your team and your customers going forward? >> Yeah, and the whole orientation around Splunk Next, as I'm sure Susan covered, it's not a product, it's a messaging framework. People are so used to Splunk being all about the collection of data within the index and searching in said index, and we're increasingly moving, we're complementing the index, the index is a incredibly unique piece of IP for us. But there's a lot of other modalities that can complement what that index does and Splunk Next represents all of our investments in next generation technologies that are helping in with everything from stream processing to distributed compute capability, next generation visualizations, et cetera. The metric that I care about over time is customer adoption and customer success. How many use cases are being deployed at different customers? How many companies, both customers and partners, are incorporating Splunk in what they do every day? You're getting OEM Splunk, making Splunk a backbone of their overall health and success. And ultimately that needs to translate into revenue, so revenue and bookings will always be a metric that we care about, but I think the leading indicators within theses different markets of rate of adoption of technology and, more importantly, the outcomes that they're driving as they adopt this technology, are going to be increasingly important. >> Yeah, I just have to tell you, when you talk about your customers not only excited, but it's a deeper partnership when you talk to insurance company out of Toronto that, like, they're talking to the people that they insure about, should they be using Splunk and how do they do that. It just, a much deeper, and you know, deeper than a partnership model for your customers. >> It's one of the things I love about this conference, is it's, we were talking about earlier, it's hard to tell the customers from the employees, like, there's a, there's a, this whole belief and purpose that everybody shares, which I adore about being here. But when you look at a sea of data, we've thought traditionally looked at the data we manufacture, typically data that's historic and at rest from our ERP systems. This next wave is certainly all the data that's happening within our organizations but increasingly it's all the data that's available in the world at large. And whether it's insurance or automotive or oil and gas, the services that I'm going to have to deliver to customers require me to farm data outside of my walls, data inside my walls, combine those two, to come up with unique value added services for my customers. So it's great to hear that, that our customers are on that journey 'cause that's where we all need to go to be successful. >> And there's a definitely alignment there. Doug, I know you're super busy, we got to go. Thanks so much for coming on theCUBE. Give you the last word, .conf 18 takeaways. >> (laughs) Unbelievable excitement and enthusiasm. A huge array of products that, I think, broaden the aperture of what Splunk does so dramatically that people are really trying to digest, "What should, how should I be thinking about Splunk moving forward?" And I'm, we started a whole series of transformations three years ago, and I'm really excited that they're all starting to land and I can't wait for the slow realization of the impact that our customers are counting on us to provide and that we'll increasingly be known for across the data landscape. >> Well and the landscape is messy and, as you said, the messiest part of that landscape is the data landscape. You guys are helping organize that, curate it. And hopefully we're helping curate some of the, from some of the noise and distracting to the signal to you on theCUBE. Doug, thanks so much for coming on theCUBE, great to see you again. >> Thank you Dave, thank you Stu, you guys do a great job. >> Thanks, we appreciate that. >> Thanks for being here with us. >> Alright, keep it right there, buddy. We'll be back with our next guest from .conf 18 from Orlando, we'll be right back. (digital music)

(upbeat music) >> Announcer: Live from Orlando Florida, it's theCUBE, covering .conf18. Brought to you by Splunk. >> Welcome back to .conf18 everybody. I'm Dave Vellante with Stu Miniman, and you're watching theCUBE, the leader in live tech coverage. We love to go out to the events, extract the signal from the noise. A lot of focus today, Stu, on security and Haiyan is here. Haiyan Song is the Senior Vice President and General Manager of Security at Splunk. Great to see you again. >> Thank you for having me. >> You're very welcome. Fifth time I think for you on theCUBE So you're super alum. And really always appreciate your deep knowledge. As I said, today was security day. A lot of customers talking about security. It's obviously a strong hold of Splunk. But, give us the update. What's new this year with you? We talked a year ago in D.C. What's happening with you guys? >> Well this is the year that we really went out and shared our vision of what SOC looks like in 2020. And we call it the Vision of SOC 2020. And on a very high level, we envision that in a couple of years with the technology like analytics, and operations, automation, orchestration, we envision that 90% of the Tier 1 work that a SOC analyst would be doing will be automated. And with that automation we are envisioning that most of the time, more than 50% of the time, the SOC analyst can actually focus on detection logic and really responding to things, that requires the human skills and insights. And we're also envisioning that by that time, there will be a place, one place, where things for response gets orchestrated versus people have to go to twenty different places trying to figure out what's going on. So, that sort of, from a business perspective but to deliver that, there's really, sort of ten, we share the ten big we call it core capabilities, that capability road map to SOC 2020. And for us, we feel really fortunate that with the acquisition of Phantom, we are really able to bring that full stack together, to deliver that capability. So we have data platform. You heard all the exciting news on what we are doing, with data fabric search, stream processing, and amplifying the performance analytics. You heard all those things that we're putting into IT, and security, ES, UBA, and then last but not least is the ability to orchestrate, to automate, to collaborate. So I think we're really uniquely positioned, because we can bring all three together. That's the full stack to deliver on that vision. >> So let's talk a little bit more about that vision. So, I mean my rudimentary understanding is you really had a reactive mode in the past. It's kind of herding cats, trying to figure out, okay I'm going to to try to respond to an incident. Then you started to use data and analytics to try to prioritize, to focus on those things that aren't going to be a false positive or of high value. What you're putting forth is a vision where a lot of that heavy lifting goes away. Machine intelligence is either augmenting, or making decisions about which items to go after. Talk more about that world. What does it look like? What's the role of the security professional in that new world? >> Yeah, there's two parts we do in the Security Operations Center. Detecting things and responding things and taking care of sort of the incidents. So a lot of the things you really touched on is how we have applied machine learning and analytics and really leveraging the business context. The feature we talked about, the distribute, the data fabric search is a really powerful tool. Now we can reach out and get lot more information to help you make better decisions to reduce the reshow of noise to signal, or signal to noise, and whichever way you want to see it up and down. So, that world we expect more machine learning, more data modeling, more threat modelings so we can really sort of incorporate business, sort of context, so risks become a one key thing to help people prioritize. That's our product ES, and UBA, and you heard about the whole predictive capabilities in IT. I think all of those will be sort of that world. And the second part of what we do is if something does happen now we really got the signal. What do you do about it? We envision that world lot of initial men did prep work. Like, oh I want to find out if this ID belongs to which organization? Is this really a signature in the virus total, sort of database and what happened, so that whole prep hopefully, will be done for you before you even get started into an incident. And furthermore, if we have responded to those type of incidents before, we actually would like to give you a recommendation, this is what happened before, this is what worked, and why don't you think about this playbook and automate this part? So, I think the world in 2020, is going to be a lot of augmentation. >> One of the things we've heard from a number of your customers, is security in DevOps and how they are using the DevOps mentality to make security more pervasive and integrated in everything they do. Could you explain how Splunk fits into that discussion? >> Yeah, so DevSecOps, I think that's, sort of, the term you might be eluding to and I think the cloud adoption, the acceleration, and the new IT is really, sort of, bringing that into focus for us. Splunk plays to that in several ways. We have a security business, we have a IT business, and you may have heard we just acquired another company called VictorOps after Phantom. So they're really helping the DevOps world and try to coordinate and enable collaboration. So we definitely expect that capability will show up in the security side to help the DevOps, DevSecOps' world and we are also, as a company, taking data security really seriously. So we are putting a lot of, you know, you saw the data stream processing and one of the capabilities to obfuscate credit card and for GDPR and a lot of other things, there's that mending. You got to give people the control of things so there is a lot of that. We're taking into consideration and putting that into the product and the other thing is, really, we ourselves operate probably one of the biggest, sort of, cloud capabilities on AWS and we have infused a lot of best practices around, how do you automate? How do you protect? How do you be compliant? And how do you insure customer have control? And there's a lot of work we're doing there and practicing DevSecOps ourselves. >> Haiyan, in thinking about the Splunk portfolio and in the context of the vision that you guys laid out, how does Splunks existing portfolio fit in to that vision and where are the gaps? What has to evolve, whether it's your capabilities, or the industry's MI, ML, or machine learning capabilities? Where are the gaps? >> So I think in many ways the ten core capabilities were laid out. I going to try to go through them in my head. So. >> Okay. >> Ingest. Detect. Predict. and then automate. Orchestrate. Recommend. Investigate. Case Management. Collaborate. And reporting. So those are the ten. When we were sharing with our audience, we actually look at our ES, UBA, and Phantom. We are able to give them all those capabilities to get started on their path for SOC 2020. But we also realize and recognize that all those capabilities, I'll give you an example, Case Management, now there is more and more requirements coming to the security side to say I want you to bring all the different things together, and I want you to take in the automated playbooks and how this plays into those, so there's always room for us to continue to enhance those capabilities. But, we also see the opportunity for us to bring all those things in a more seemless way into, sort of, one full stack, the full stack that gives you, you know, I don't know if you heard the term, powering the OODA Loop? Right, the observe, orient, decide, and act. And that was really, sort of, military strategy for the fighter pilots to say the whole premise is whoever can power that loop, and execute the fastest, wins. >> It's like readying fire but more data focused. >> More data focused, I like that. So for us, it's really how do we bring the portfolio together, so they can really power that loop in a very intuitive way. And in a very open way. I want to make sure that I iterate that reiterate our commitment to be open. There's data layer, there is analytics layer, there's operational layer. We want to be that company can bring the full stack make them work really well. But, in the meantime work well with other data, with other analytics, detection engines, and other ways to operate. So being open is very important. >> And you'll automate as many of those or all of those ten that you mentioned. Do you automate the run book? >> Automated run book is what Phantom is all about and the run book gets more and more sophisticated and I think we give people the ways to say if on day one, you don't want to automate everything, especially shutting down his email, then you have the choice. But, it's as you learn, as you become more confidence, and you have that under your control. How much you want to automate, and hopefully, as more automated actions are taken, we get to analyze those and start making recommendations so you become more comfortable with that. >> So I understand New York Presbyterian was in your session. And, you were talking about going beyond security. I often like to say that security and privacy are two different sides of the same coin. But, when they talked about going, well share with us, what you learned from them. >> Yeah you have really the best phrase to say they are both sides and as a security professional in the digitized world I don't think you have a boundary to say my job starts with SOC and ends with SOC. It goes way beyond. It goes into data privacy. It goes into even fraud analytics, because a lot of things are happening online. It also goes into compliance. And, it's interesting that we thought years ago, compliance was driving investment. I think now with GDPR, with some of the data privacy challenges we've seen, that's impacting the masses, the criticalness of compliance is actually coming back. So the story that I was super impressed that our customer, New York Presbyterian shared with us is they had a challenge of really managing all this sort of patient records, and try to understand the staff's activities. Because, the auditors have a certain set of things. You know you shouldn't be snooping around the patient's record, if its your neighbor, or your buddy. So they used Splunk and they powered, sort of, us with a lot of the data from various applications. They have probably 20 data sources, that's very healthcare centric. We partnered up, we had our product expert, and fraud experts on that. And, we built a privacy platform, a early version of that, and they showed it to their privacy officers, and they basically said we've not seen anything like this to give us the flexibility and ease of use to be able to bring everything together. And, they did even more than that. If you have time I'll share with you on the opiate diversion capabilities they started building with. >> Dave: Oh, yeah talk about that, yeah please >> So we were thinking, we're just going to help them with compliance that makes their organization more compliant and better, but they didn't stop there. They said well, based on the power we're able to, really, leverage from the Splunk platform, we see the data we have for our pharmacies, there's a lot of prescription, sort of, information and with the world that's battling the opiate epidemic, we think we can actually analyze the data and give us early patterns and earnings, warnings of what might be happening. So, that's the next project we're partnering up. And for us we have technology, and customer have domain knowledge, have data. I think that's a great partnership. And they are willing, they are wanting us to go evangelize 'cause they want the whole industry to benefit, they want the nation to benefit. >> Well we saw this week on 60 Minutes, did you see that story? The one pharmaceutical company got in big trouble and a doctor went to jail. The pharmaceutical company was shipping 500 million Oxycontin pills into Florida. This is a state with a population of 20 million. Something was wrong. Obviously those were hitting the streets. And, this individual this doctor went to jail for life. So, data analysis could identify that. >> Data was there. I think it's the inside to look for the ways, to look for those things and having that inside drive decisions is really the partnership we have with our customers >> We're seeing that, g'head Stu. >> Yeah I was just, you spoke on a panel of the Grace Hopper event. >> Haiyan: Last week. >> We've been hearing great messages of diversity at this show. You had the Carnival Cruise CEO up on stage giving some great discussion points yesterday. Maybe you could share a little bit of your experience at the show and the panel that you were on. >> The Grace Hopper is such an amazing event and we see so many college grads and people, sort of, starting their career and that is like the go to place. And I see all the big companies, big, or small actually, putting so much effort to try to really evangelize to that audience. 'Cause California just passed, the Governor just signed into law, they require a woman on the board, as part of the requirements because diversity is being proven to bring better decision making into the board and I, myself, can tell you that my security leadership team over the years become more and more diverse. I don't think diversity is just gender diversity. I think diversity needs to go beyond gender. It's background where people who are from the private sector, from the government, where people from different Geo's of the world. That sort of richness of perspective always give us the best, sort of, angles to think about and validating, and debating on our, sort of, strategies. And going back to Grace Hopper, the panel that I was on was really sharing with the people who are there, what are some of the things that you should be prepared for if you want a cyber security career. And the part is not try to, oh here's a high bar. We really try to encourage everyone, whether you're technical, or you just having great analytical skills. I think one of my fellow panelist, she made a comment I thought was super funny. She was a CEO of a company and she said, sometimes women just have to have enough confidence and to go take the risk, grab the opportunity. She use the word, sometimes you have to fake it until you prove it and until you make it. And she's really just encouraging the attendees, just step up take the opportunity. I am in total agreement with that. >> Lean in baby. >> Lean in. That's another way to do it. >> Haiyan thanks so much for coming back in theCUBE. Really great to see you again. >> Thank you for having me. >> You're very welcome. All right, keep it right there everybody. Stu and I will be right back with our next guest. Right after this short break. We're live from Orlando, Splunk .conf18 You're watching theCUBE. (upbeat music)

>> Live from Orlando, Florida, it's theCUBE, covering .conf2018! Brought to you by Splunk. (techno music) >> Welcome back to Orlando, everybody. We're here with theCUBE covering Splunk.conf2018. I'm Dave Vellante with my co-host, Stu Miniman. Chris Crocco is here, he's the Lead Solutions Engineer at ViaSat. Great to see you, thanks for coming on theCUBE. >> Well, thanks for having me. I appreciate it. >> You're very welcome. Let's start with ViaSat. Tell us what you guys do and what your role is all about. >> So ViaSat is a global communications and technology company primarily focused on satellite-based technologies, anything from government services to commercial aviation and residential service. >> And what does a Lead Solutions Engineer do? >> My primary role is to help us kind of transition from a traditional operations state into more of a DevOps environment including monitoring, alerting, orchestration and remediation. >> Oh, we love this conversation, don't we? Okay. The basic question is, and I know it's hard, but it's subjective, it's kind of if you think about the majority of your organization in the context of DevOps, on a scale of one to five, five being nirvana, so let's assume you're not at five 'cause it never ends, right? You're constantly evolving. Where would you say you are? Are you just getting started? Are you more like a four, 4 1/2, what do you think? >> That's a good question. I would say we're probably three on our way to four. We've had a lot of growing pains, we've had a lot of learning opportunities. The processes of DevOps are getting pretty well-entrenched and right now, we're working on making sure that the culture sticks with the DevOps. >> That's critical, right? >> I mean, that's really where the rubber meets the road is that organizational and political. Without getting into the dirt of it, give us what it looked like before and where you are today. >> Sure. Prior to our shift to DevOps, which was mainly motivated by our latest spacecraft, ViaSat-2, we had a very traditional operational model where we had everything funneled through a Network Operations Center, we had a Technical Operations Team, and if they weren't able to triage and remediate issues, they kicked it over the fence to engineers and developers who would then throw something back. There wasn't a lot of communication between the two organizations, so when we did find recurring problems, recurring issues in our network and in our environment, it took a long time to get those resolved and we had to have a large volume of staff there just to kind of put out the fires. With the transition of DevOps, one of the things that we've been focusing on is making sure that our development teams, our engineering teams understand the customer experience and how it's impacted by what they do, and de-centralizing that operation structure so all of the triage work goes to the people who actually work on those services. So it's a pretty big paradigm shift but it's also helping us solve customer problems faster and get better education about what the customer experience is to the people who actually make it better. >> And roughly, what was the timeframe that it took to go from that really waterfall model to the structure that you have today? >> We've been going for about two or three years now in this transition. Like I said, the first year or so was kind of bumpy and we've really kind of ramped up over the past year in terms of the amount of teams that are practicing DevOps, the amount of teams that are in an agile and scrum model. So overall, two to three years to get to where we are today. >> So the problem with the traditional model is you have time to deployment is slower, that means time, the value is slower, a lot of re-work. Here, you take it. No, you take it. Hey, it worked when I gave it to you, a lot of back and forth, and not a lot of communication creates frustration, not a lot of collaboration and teamwork, then you're working through that now. How large is the team? >> My team is five people. We have 4,500 people roughly at ViaSat as a whole. I believe roughly 2,000 of them are in an engineering or technical role. >> Okay, but in the previous model, you had developers and you had operations folks, is that right? And your five are sort of split over those or was it a much, much larger corpus of folks? >> It was a very large distribution of people. It was very engineering and developer-centric. We still had a Core Operations Team of 60 to 100 people based in our Denver office. We're keeping our headcount relatively the same with respect to our operations and we're growing a lot in terms of those DevOps teams. So as those teams continue to grow, we're adding more operational resources to them and kind of inserting a lot of that knowledge into other parts of the organization. >> You're doing a lot more with the same. Are you coming from the ops side or the dev side? >> I come from the ops side. I actually started my career with ViaSat in our knock in Denver. From there, I transitioned into a ops analyst role and then we created the Solutions Engineering Team and I took the lead on that. >> Chris, can you tell us how Splunk plays into your DevOps? Did you start using it in the knock and kind of go from there? >> We did, actually. Splunk started out as just a tool for us to see how many modems were offline in the knock. It was up on the video wall and we would see spikes and know that there was a problem. And as we've made this transition at DevOps, a lot of teams that were using other solutions, other open-source and home-grown solutions were kind of organically pivoting to Splunk because it was a lot easier for them to use for alerting dashboards, deep-data analysis, a lot of the things they needed to do their job effectively. So as we've grown as a company, as we've grown in this organizational model, Splunk has kind of grown along with that in terms of use case. >> That growth is predominately in IT operations and security, correct? >> Well, it's actually pretty interesting. It's kind of all over the board in our organization. It started in IT operations and security, but we have people in our marketing department using it to make sales and campaign decisions. We have executive leadership looking at it to see the performance of our spacecraft, we have exploratory research being done with it in terms of what's effective and what's not for our new spacecraft that will be coming out, the ViaSat-3 Constellation. So it's really all over the board in our organization. >> That's interesting, Stu, you're not the first customer who's told us that no, it's not just confined to IT, it's actually seeping through the organization. Despite the fact that we heard a bunch of announcements today, I don't know if you saw the keynotes, making it simpler for lines of business folks to actually utilize Splunk, so given that a lot of your teams in the business are actually using it already, what do you think these announcements will do for them? Maybe you haven't had time to evaluate it, but essentially, it's making it easier for business people, you know, simplifying it. >> Yeah, you know, all of the announcements in the keynotes over the past two days have been really, really exciting. Everything that I was hoping for got checked off the list. So I think one of the big things that it's going to allow us to do is get our customer-facing teams and our customer care organizations more involved with the tool. And getting them the information that they need to better serve customers that are calling in, and potentially even prevent the situations that customers have to call in for in the first place. So giving them a lot of account information quickly, giving them the ability to access information that is PCI and PII-compliant but still allowing them to get the data they need to service an individual customer, all of those things I think are really going to be impacted by the announcements in this conf. >> So you were the keynote yesterday. >> I was! >> Were you shaking the phone? >> I was, yeah. >> Which group were you, were you orange? >> We were orange group, yeah. >> We were orange, too! But we were sitting in the media section and all the media guys were sitting on their hands but we had a lot of devs and ops guys shaking with us. It's like when you do the wave at Fenway Park when it gets behind home plate, everybody just kind of sits down, but we were plugging hard. Alright, Chris, what else has excited you about .conf2018? School stuff that you've seen, some innovations, things you've learned. >> Well, I'm really excited about the app for infrastructure. That's something that we've been trying to get for ITSI for a long time now in terms of NED-level monitoring and NED-level thresholding. I think that's going to complement our business really, really well. The advancements that they're doing with the metrics store, specifically with things like Syslog are really, really exciting. I think that that's going to allow us to accelerate our data and make it more performant. The S3 compliant storage is absolutely fantastic and it comes in black now and that's really, really fantastic. >> Oh right! The dark mode! >> Dark mode, yup. >> You mentioned the ITSI. Have you used the VictorOps pieces before or is that something you're looking to do? >> We haven't looked at VictorOps as of yet. We're an xMatters customer right now so we've been using their integration that they built out and it's on Splunk base. But VictorOps, it'll be interesting to see how that organization changes now that it's part of the Splunk. >> So dark mode actually, it's one of those things that it really got such a loud ovation. It was funny, I was actually talking to a couple Splunkers that are like, "We want that dark mode t-shirt." Which I think you have to be a user and you need to sign up for some research thing that they're doing, and they're giving out the black shirt that has like gray text on it. >> Awesome! >> Why does that resonate with you, the dark mode? >> Well, it was actually what they talked about in the keynote. If you have it up on a video wall, which we have in various parts of our company, or if you're sitting in a dark office, something like that, looking at a really white screen for a long period of time, it's not easy on your eyes, it's hard to look at for a long period of time. And generally speaking, a lot of our presentation layers go towards that visual format. So I think this is going to allow us to make it much more appealing to the people who are putting this up on screens in front of people. >> Your responsibility extends out into the field, I presume. The data that's in the field, is that true? >> It does. >> Okay, so I'm interested in your reaction to the industrial IoT announcements, how you see or if you see your organization taking advantage of that. >> Well, we're a very vertically integrated company so we actually manufacture a lot of the devices that we use and that we provide to our customers. I think a lot of our manufacturing capabilities would really benefit from that. Anything from building antennas for ground segment that actually talked to the spacecraft. It's the modems that we put in people's houses, that entire fabrication process I think would benefit a lot. I really loved the AR presentation that they did where they were actually showing the overlay of metrics on a manufacturing line. I think that's something that would be fantastic for us, particularly for sending somebody to an antenna or a ground station to replace a piece of equipment. We can overlay those metrics, we can overlay all of that, we can use the industrial analytics piece of that to actually show which piece of hardware is most affected and how best to replace that. So a lot of opportunities there for our company. >> So I wonder if you could help us understand what's, from your perspective, on Splunk's to-do list. We're going to have Doug Merritt on a little later. If you had Doug right here and he said, Chris, what can we do to make your life better? What would you tell him? >> You know, I think a couple of the things that would make it better, and it looks like they're heading this direction, is streaming in and streaming out. You know, streaming in is of course important, that's where a lot of your data lives, but you also have to be able to send that out to Kafka, to Kinesis, to other places, so other people can consume the output of what Splunk is doing. So I think that would be a really, really important thing for us to socialize the benefit of Splunk. And then vertically integrating the incident management chain, it looks like something that's on their roadmap and I'd be interested to see what their roadmap looks like in terms of pulling in Phantom, pulling in VictorOps, pulling in some of these other technologies that are now in the Splunk umbrella to really make that end-to-end process of detecting, directing and remediating issues a lot more efficient. >> Okay, and do you see at some point that the machine will actually do, the machine intelligence will do a lot of that remediation? >> I think so. >> Do you see the human still heavily involved? >> Well, I think one of the important things is for a lot of these remediation things, we shouldn't have a human involved, right? Particularly things that are well-known issues. Human beings are expensive and human beings are important, and there are a lot more important things that they can be doing with their time than putting out fires. So if we can have machines doing that for them, it frees them up to do a lot more cool stuff. >> You're right. Alright, Chris, well listen, thanks very much for coming on theCUBE. It was great to have you. >> Yeah! Appreciate it very much. >> Thanks for your insights. Alright, keep it right there, everybody. Stu and I will be back with our next guest. You're watching theCUBE from Orlando Splunk.conf2018. Be right back. (techno music)

(upbeat music) >> Live from Orlando, Florida, it's theCUBE covering .conf18. Brought to you by Splunk. >> Hello everybody, welcome to Orlando. This is theCUBE, the leader in live tech coverage, and we're here at Splunk conf .conf 2018. The hashtag is #splunkconf18. My name is Dave Vellante, I'm here with my co-host Stu Miniman. Stu it's great to be in Orlando again. Last year we were in D.C. This is our seventh year covering Splunk.conf and we've seen the company really move from essentially analyzing log files on PRAM in a perpetual license model, to now a company that is permeating all of IT into the lines of business. Security, IT performance, application performance, moving into IOT. Really becoming a mature company. It's a company with $1.7 billion in revenue forecasted for this year. They were talking about a $17 billion market cap, they're growing at 36%, and they're a company Stu, that is in the process of successfully going from a perpetual license model to a renewable model. Splunk set the goal of being 75% renewable by 2020. Sounds like renewable energy, but repeatable renewable from a subscription standpoint, they're already there. So you're seeing that in the execution. This is your first .conf, or conf as they like to say. We were at the ESPN Wide World of Sports Center, you saw what, what's the number, 8,000 people? >> Yeah I think 8,000 at the show this year, it's strong growth, and Dave I've been hearing from the team for years the excitement of the show, the passion of the show, saw like, right over near where we were sitting there's the whole group of that was the Splunk trust. They've got the fezzes on, a lot of them have superhero capes on, and it's what you'd expect from a passionate, technical maybe even geeky audience. Things like, we're announcing the S3 API-compatible storage. Everybody's like, yay we're so excited for this. It's hardcore techies. >> What was the other big clap? Screen? >> Yeah, that's right dark mode. We're going to go to dark mode, I don't have to play with the CSS. Anybody that's played with a website, changing these things is not trivial. I click a little button and the joke was this was the bright one for the executives, but when I'm down in the gamer center I don't want this glaring screen here, so I can switch it over to dark mode. And people were pretty excited about that. >> So again the roots of Splunk, they took log data and analyzed it. Doug Merritt the CEO, talked today talked about, making things happen with data. I thought he did a really good job of laying out the past, putting the past behind us in terms of he said, "I've been to I can't tell you "how many Master Data management classes "trying to optimize the database, "trying to codify business processes "and harden those business processes." The problem is data is messy. Data is growing so fast, business processes are changing so fast, the competition is moving so fast, customers are changing. So you have to be able to organize your data in the moment. So, the whole idea that, even go back to the early big data days and Hadoop, the whole idea was to bring five megabytes of compute to a petabyte of data. And no schema on write, or what some call schema on read. Splunk was really a part of that. Put the data, get the data organized in a way that you can look at in in a moment, but then let the data flow. So that has definite implications in terms of how you think about data. It's not trying to get the data all perfect so you can use it, it's trying to get the data into your data ocean, as we like to say, and then have the tooling to be able to analyze it very, very quickly. They announced Splunk 7.2 today which is a big deal. Some things, we'll talk about a few of the features, obviously focused on performance, but one of the things they talked about was basically being able to split storage and compute. So previously you had to add essentially a brick of storage and compute simultaneously. We've heard about these complaints for years in the conversion infrastructure space, it's obviously a problem in the software space as well. Now customers are able to add storage or compute in a granular fashion, and they're cozying up to Amazon doing S3 compatible store. >> Dave, I love that message that he put out there you said, "life is messy. "You can't try to control the chaos, "you want to be able to ride those waves of data "take advantage of them and not overly "make things rigid with structure." Because once you put things in place you're going to get new data or something else that's going to come along and your structure is going to be blown away. So when you need to search things you want to be able to look at them in that point in time but be able to ride those waves, flow with the data, live the way your data lives. That's definitely something that resonates in this community. Dave, something I've watching this space, as an infrastructure guy and watching the Cloud movement, there were a lot of reasons why traditional big data failed. I kind of never looked at Splunk like most of those other big data companies. Yes they had data, yes they're part of the movement of taking advantage of data, but they weren't, oh well we have this one tool that we're going to create to do it all, like some of the new players. They're playing with all the latest things. You want tentraflow, you want to do the A.I, the ML. Splunk is ready to take advantage of all of these new waves of technologies, and they've done a couple of acquisitions like VictorOps in the space that they keep growing and the goal is, you mentioned the revenue, but Splunk today has I think it's 16,000 customers. They have a short term goal of getting to 20,000 but with what they started talking about in the keynote today, Splunk Next, they really want to be able to do an order of magnitude of more customers and when you get great customer examples like Carnival Cruises. The CEO I thought, talked about the sea of data. Lots of good puns in the keynote there but mobile cities floating around and lots of data that they want to be able to get the customer experience and make sure the customer gets what they need and make sure that Carnival knows what they have to make sure that they're running better and optimizing their business too, so great example. Looking forward to talking to them on theCUBE. >> Well and they have many dozens, I think it's in last quarter, it was like 60 plus deals over a million dollars. They have many $10 million plus deals. That's an outcome of happy customers, it's not like they're trying to engineer those deals. I'm sure some of the sales guys would love to do that. But that's a metric that I think was popularized by the likes of Aneel Bhusri at Workday, certainly Frank Slootman at ServiceNow. It's one that Wall Street watches and Splunk it's an indicator. Splunk is doing some very very large deals that underscores the commitment that many customers are making to Splunk. Having said that, there are many more that are still smaller users of Splunk. There's a lot of upside here. And they're going into a serious TAM expansion that's something we're going to talk to Doug Merritt about. Making acquisitions of a company, VictorOps was their most recent acquisition sort of security orchestration and management. They're doing, the ecosystem is growing, they're doing bigger deals or partnerships with the likes of Accenture, Deloitte is here, EY. Accenture actually has a huge space at this event, and those are indicators. I want to go back to something you said earlier about the failure of big data. Certainly big data failed to live up to the hype in many ways. You didn't see a lot of wholesale replacement of traditional databases and EDWs. You did see a reduction in cost, that was the big deal. But clearly enterprise data warehouses and ETL, they're still a fundamental part of people's data strategies despite what Doug Merritt saying, hey, the data is messy and you've just got to let it flow, essentially what he's saying. There is still a need for structured data and mixing, sort of, interacting of structured and unstructured data. Bringing transaction data and systems of intelligence together, analytic data. But the one thing that big data did do and the Hadoop movement, it did a couple things: one is, architecturally it pushed data out and back in the day you had to get a big Unix box and stuff everything in there. It was your god box of data. And you had Oracle licenses and Sun Microsystems boxes and it was very expensive. And you had a couple of people who knew how to get the data out. So the goal of democratizing data, what it did is, it is messy. Data went out to the distributed nodes and now the edge. But it brought attention to the importance of data and the whole bromide of data driven companies. And so now we're in a position to make a new promise and that promise is A.I, machine learning, machine intelligence, which seems to be substantive. We talk a lot on theCUBE is this old wine, new bottle? And we had an event in New York last month and the consensus from a lot of practitioners and others in the room was: no there's something substantive, the data substrate is now in place. Now it's all about taking advantage of it. Tooling is still complex but emerging or evolving. And I think the cloud, to your point, is a huge part of that. By integrating data pipelines in the cloud it dramatically simplifies the deployment model and the complexity of managing big data. >> Yeah, Dave, as you said, there used to be these giant boxes and some of these initiatives I needed 18 months, you know, millions of dollars and a large time you either need to be a country or a multi-national company to be able to put this thing together. I remember one of the earliest case studies that David Floyer did when we were looking at big data it was how do I take that 18 month deployment and drive it down to more like a six week deployment, and when you talk about A.I, ML, and deep learning, the promise is that a business user should be able to get answers in a much much shorter window. So actionable on that data, being able to do things with it not just looking backwards but hear the team. So I want to be able to be proactive, I want to be able to be responsive. I want to even predict what my client is going to need and be ready for it. >> So as Doug Merritt said that digital and physical worlds they're coming together. They don't stop evolving. They're organic. Your data model has to be flexible. It's a sea of data. It's an ocean of data. It's not a confined data lake, as John Furrier and others like to say. And so I was happy to hear Doug Merritt talking about a sea. We use the term oceans because that's really what it is. And oceans are unpredictable, they're sometimes really harsh, they can sometimes be messy. But they're constantly evolving and so I think that kind of metaphor works in this world of Splunk. We've got two days here of coverage. A lot of customers coming on today, in fact, Splunk is one of those companies that puts many customers on theCUBE, which we love. We love to dig in to the case studies. We've got some ecosystem partners. Some of the big SIs are coming on and of course, we're going to hear from some of the product people at Splunk that go to market people. Doug Merritt will be on tomorrow. And a number of folks. I'm Dave Vellante, @DVellante on Twitter. He's @Stu. Stu Miniman. Keep it right there, buddy. We'll be back with our next guest right after this short break. You're watching day one from Splunk conf18 in Orlando. Be right back. (soft bouncy music)