Copyright © 2014 Splunk Inc. GeIng Deeper Insights into your Virtualiza@on and Storage with Splunk Stela Udovicic – Sr. Product Marke@ng Manager, Splunk Michael Donnelly – Senior SE, Virtualiza@on Technologies Specialist, Splunk Disclaimer During the course of this presenta@on, we may make forward-‐looking statements regarding future events or the expected performance of the company. We cau@on you that such statements reﬂect our current expecta@ons and es@mates based on factors currently known to us and that actual events or results could diﬀer materially. For important factors that may cause actual results to diﬀer from those contained in our forward-‐looking statements, please review our ﬁlings with the SEC. The forward-‐looking statements made in the this presenta@on are being made as of the @me and date of its live presenta@on. If reviewed aUer its live presenta@on, this presenta@on may not contain current or accurate informa@on. We do not assume any obliga@on to update any forward-‐looking statements we may make. In addi@on, any informa@on about our roadmap outlines our general product direc@on and is subject to change at any @me without no@ce. It is for informa@onal purposes only, and shall not be incorporated into any contract or other commitment. Splunk undertakes no obliga@on either to develop the features or func@onality described or to include any such feature or func@onality in a future release. 2 About Me !  Stela Udovicic, Sr. Product Marke@ng Manager, Solu@ons Marke@ng –  Responsible for IT Opera@ons use cases including networking, storage, *nix –  Over 15 years of experience with variety of networking technologies !  Michael Donnelly, Senior SE, Virtualiza@on Technologies Specialist –  Splunk administrator for 4 years, 20 years in IT –  8 years’ virtualiza@on experience, as sys admin and developer 3 Agenda !  !  !  !  Introduc@on Virtualiza@on Insights: Splunk App for VMware Storage Insights: Splunk App for NetApp Data ONTAP Integrated Insights Demo 4 Escala@ng IT Complexity… IP Phone Iden@ty VPN Finance Web Svr HR App Svr Email INFRASTRUCTURE APPLICATIONS SaaS/PaaS DB PACKAGED APPLICATIONS CUSTOM APPLICATIONS IaaS VITUALIZATION SERVERS STORAGE NETWORKING …Plaguing IT Opera@ons Complex, silo-‐based technologies Finance IP Phone Iden@ty Web Svr SaaS/PaaS HR App Svr Disconnected a nd o utdated point solu@ons VPN Email DB INFRASTRUCTURE APPLICATIONS PACKAGED APPLICATIONS IaaS CUSTOM APPLICATIONS Reac@ve brute-‐force problem resolu@on VITUALIZATION Over 80% of @me on maintaining not innova@ng SERVERS STORAGE NETWORKING What it’s Like in the Trenches Service Desk Database Admin Network Admin Sysadmin Virt. Admin Storage Admin Logs call. Applica@on is slow Checks database logs. Database stopped accep@ng connec@ons Stops working on deploying new services. Checks logs and performance. Network OK Checks UCS logs. Looks at the OS, everything is ﬁne, OS sees 40% disks u@liza@on Goes through VMs. Checks VMs and data stores health manually analyzes them Goes through volumes suppor@ng VMs. Iden@ﬁes issue Escalate Escalate Escalate Escalate Escalate >12-‐hour outage! 7 Boost Applica@ons Performance by Op@mizing Your Virtualiza@on Environment Maximize Your VirtualizaEon Investment Capacity OpEmizaEon for exceeding ApplicaEons SLAs 8 ProacEve Monitoring for Avoiding VirtualizaEon Risks Major Oil and Gas Company Gets Comprehensive Visibility into IT Infrastructure Beneﬁts: Reduced costs and MTTR Splunk App for NetApp Data ONTAP Storage Admin Splunk App for VMware VMware Admin Cisco ACI AnalyEcs for Splunk Splunk Aps for Windows/*nix OS Admin 9 ACI App Fabric/Network Admin Applica@ons Admin Virtualiza@on Insights The Virtual Datacenter Challenge Too Much Complexity and Too Lille Visibility Not enough data about virtualiza@on Virtualiza@on data alone doesn't solve problems Point solu@ons oﬀer inadequate analyses 11 Integrated Insights into Your VMware Environment ProacEve Monitoring Real-‐&me ac&onable insights into problem spots and health issues VMware vCenter Server(VC) Comprehensive AnalyEcs Real-‐&me and historical insights into performance, security, capacity, forecas&ng, outlier detec&on and change tracking APP APP OS OS Explore VM VM Monitor VMware vSphere Report Storage Network Devices End-‐to-‐end Visibility Physical Layer Scalable big data solu&on for holis&c visibility across all technology &ers 12 Servers Correlate Intelligent Analy@cs Across IT-‐@ers “There is no other tool out there that can Ee all the diﬀerent pieces together and facilitate analysis on diverse data sources. Splunk has become our primary analyEcs tool.” – James Lord Chief Architect, Cloud Opera&ons Characterize customer usage to trend and analyze usage palerns !   Establish baselines on infrastructure and applica@on performance !   Decrease costs with granular insights into applica@on and infrastructure behavior by op@mizing resource alloca@on !   Meet customer demand by burs@ng to the cloud !  13 One Splunk – Many Uses “Using Splunk for VMware gets us our data in one place, for many uses: capacity planning, event monitoring, performance analysis, security monitoring and more.” – Peter Cole Technical Lead, ITS Opera&ons !  A deﬁni@ve record of what happened in our environment –  !  14 Analyze and trend performance as well as user ac@vi@es very easily Useful for both opera@onal monitoring, capacity usage, performance metrics and for security monitoring Integrated Insights into Applica@on and OS Health Network Infrastructure SAN & NAS Networking Cri@cal Infrastructure Servers 15 Ac@ve Directory Splunk Environment Monitoring Your Virtualiza&on Environment Network Infrastructure VMware Environment vCenter Server ESXi Hosts SAN & NAS Networking Cri@cal Infrastructure Servers 16 Ac@ve Directory Splunk Environment Monitoring Your Actual Virtualiza&on Environment Network Infrastructure VMware Environment vCenter Server ESXi Hosts SAN & NAS Networking Cri@cal Infrastructure Servers 17 Ac@ve Directory Splunk Environment Monitoring Your Full Virtualiza@on Environment VMware Environment Network Infrastructure vCenter Server ESXi Hosts SAN & NAS Networking Cri@cal Infrastructure Servers 18 Ac@ve Directory Splunk Environment Monitoring Your Full Virtualiza@on Environment VMware Environment Network Infrastructure vCenter Server ESXi Hosts SAN & NAS Networking Cri@cal Infrastructure Servers 19 Ac@ve Directory Splunk Environment Storage Insights Splunk App for NetApp Data ONTAP 1 2 3 Central P roacEve Monitoring OperaEonal AnalyEcs Cross-‐Eer Visibility Reduced MTTR OpEmized Capacity, Performance Fast Time to Value 21 Cross-‐@er Opera@onal Visibility Ethernet NIC ESXi Data stores (virtual) Physical storage NetApp Controller Correlate NetApp data with applica@on, OS and virtualiza@on data for simpliﬁed troubleshoo@ng! 22 App Architecture API calls: Performance metrics 60s and inventory data 10 min Data CollecEon Node (DCN) NetApp Filers Dashboards, reports, ﬁeld extrac@ons Splunk App for NetApp Data ONTAP Log data via syslog Splunk HF/LF Mentor Graphics “The Splunk App for NetApp Data ONTAP delivers cluster-‐mode performance metrics monitoring that Mentor Graphics has not been able to achieve previously. The real value for us is all the NetApp logs, conﬁgura@on data and performance metrics the app exposes to Splunk soUware.” INSERT DASHBOARD – Lee Melvin, Technical Architect at Mentor Graphics Key Customer Beliefs !  !  Customizable reports and SLA metrics Future-‐proof monitoring – enables correla@on across diﬀerent domains such as NetApp and VMware 24 Sealle Cancer Care Alliance “Using Splunk NetApp App we gain instant visibility into what is happening in our NetApp storage. Splunk is the only solu@on we found that allows us to quickly and precisely see, analyze and correlate our data without having to be data or even Splunk experts.” INSERT DASHBOARD – IT Infrastructure Lead, SeaJle Cancer Care Key Customer Beneﬁts !  !  Signiﬁcant reduc@on in MTTR due to instant visibility into NetApp storage systems and correla@on with security and OS data Quick isola@on of storage incident without being storage experts 25 Integrated Insights Demo: Applica@ons, Virtualiza@on, Storage and OS Single Console Visibility into IT Infrastructure Reduce MTTR! Boost ApplicaEons SLAs! Reduce Costs! Maximize Your VirtualizaEon Investment OpEmized Performance and Capacity Cross-‐Eer Visibility 27 Special Oﬀer: Try Splunk MINT Express for Free! Splunk MINT oﬀers a fast path to mobile intelligence. How fast? Find out with a 6-‐month trial* •  Register for your free trial: •  Download the Splunk MINT SDKs Add the Splunk MINT line of SDK code and publish** Start geIng digital intelligence at your ﬁnger@ps! •  •  hlp://mint.splunk.com/conf2014oﬀer *Oﬀer valid for .conf2014 aJendees and coworkers of aJendees only. **Trial allows monitoring of up to 750,000 monthly ac&ve users (MAUs). 28 Thank You Backup slides: Donnelly Splunk for VMware Architecture Network Infrastructure Physical VMware environment Performance (API) vCenter Server Splunk DCN vCenter Logs ESXi logs ESXi Hosts SAN & NAS Networking Cri@cal Infrastructure Servers 31 Ac@ve Directory Splunk Environment Splunk for VMware – Required Connec@vity Physical VMware environment TCP 443 DCN TCP 8089 & 8008 API: TCP 443 TCP 9997 vCenter Server vCenter Logs: TCP 9997 TCP 9997 Syslog: TCP 1514 UDP 514 ESXi Hosts SAN & NAS Syslog Server Networking 32 Splunk Environment Deployment notes !  !  !  All of the ports men@oned in the previous slide are the default ports; Splunk can be adapted to use alternates If you’re using search head pooling – there are addi@onal details covered in the installa@on guide. You must use a dedicated search head (not pooled) to act as the Data Collec@on Scheduler During installa@on, the DCN will be conﬁgured either by SSH or remote console access; addi@onal conﬁgura@on is done via the Splunk web UI on TCP port 8000. Ensure that access by SSH/8000 or by CLI via console will be possible 33 Backup Slides: Stela Industry Leading Plazorm for Machine Data Machine Data: Any LocaEon, Type, Volume Online Services On-‐ Premises Servers Web Services Security Ad hoc search GPS Loca@on Networks Private Cloud Storage Public Cloud Monitor and alert Report and Custom analyze dashboards Packaged Applica@ons Desktops Messaging Online Shopping Cart Answer Any QuesEon Telecoms RFID Energy Meters Databases Web Clickstreams Smartphones and Devices Custom Applica@ons Call Detail Records Plaborm Support (Apps / API / SDKs) Enterprise Scalability Universal Indexing Developer Plaborm Industry Leading Plazorm for Machine Data Machine Data: Any LocaEon, Type, Volume Online Services On-‐ Premises Servers Web Services Ad hoc search Storage GPS Loca@on Report and Custom analyze dashboards Packaged Applica@ons Desktops Schema-‐ on-‐the-‐ﬂy Online Shopping Cart Public Cloud Monitor and alert Any amount, any loca@on, any source Security Networks Private Cloud Answer Any QuesEon Telecoms RFID Universal indexing Messaging Energy Meters Databases Web Clickstreams Smartphones and Devices Call Detail Records Custom Applica@ons No No need back-‐end to ﬁlter RDBMS Plaborm Support (Apps / Adata PI / SDKs) Enterprise Scalability Universal Indexing Developer Plaborm Splunk Enables the Connected Datacenter Business Insights Gain real-‐@me insight from your machine data to make beler-‐informed business decisions CLOUD SERVICES OperaEonal Visibility CUSTOM APPLICATIONS Gain opera@onal visibility to make beler-‐ informed IT decisions PACKAGED APPLICATIONS ProacEve Monitoring Monitor infrastructure to iden@fy issues, problems and alacks before they impact your customers and services INFRASTRUCTURE APPLICATIONS VIRTUALIZATION Search and InvesEgaEon Find and ﬁx problems across the organiza@on using machine data SERVER, STORAGE, NETWORKING 37 Central Proac@ve Monitoring !  Uniﬁed insights into NetApp ONTAP ﬁlers !  Increased storage visibility Easy iden@ﬁca@on of anomalies !  38 Flexible Opera@onal Analy@cs !  Proac@ve capacity planning !  Customizable SLA tracking 39 Key Considera@ons For Monitoring VMware Environments Provide access to underlying machine data to quickly iden@fy problem spots and troubleshoot issues in real-‐@me Persist data over @me to determine performance and u@liza@on trends for planning, analy@cs and op@miza@on Gain holis@c visibility across diverse infrastructures and heterogeneous technologies Key Beneﬁts Reduce MTTR Maximize ROI Reduce Costs Eliminate silos – gain visibility into virtualiza@on health in rela@on to applica@ons, storage, opera@ng systems, networks and other infrastructure components Improve infrastructure u@liza@on eﬃciencies and avoid over-‐provisioning with granular insights into resource consump@on Reclaim and reuse unused resources aUer they are no longer needed avoiding a virtual sprawl with detailed analysis on your virtual assets “ I now have built-‐in visibility into latencies caused by my storage and impact to the applica@on performance” “I can see how my workloads are using my vCPUs and RAM, thus avoiding high CPU wait @mes and op@mized resource u@liza@on” 41 “We’ve recycled inac@ve and abandoned VMs and avoided capital expenditure”