Copyright2016SplunkInc.

SAPSuccessFactorsAlfredWanDirector,ServiceDeliveryOperationsHCMSuiteServiceOwner

2

Agenda Splunk@SAPSuccessFactors ITSIProofofConcept CreativeProjectsw/Splunk

Splunk @SAPSuccessFactors

4

AboutSAPSuccessFactors Marketleaderincloud-basedhumanresourcesapplicationindustry Supports5000customersand50millionregisteredendusers 10globaldatacentersacrossUS,Europe,APJ 10,000+VMs/BMsinproduction

5

AboutMe/OurTeam HCMSuiteServiceOwner(PerformanceEngineeringBackground) Teamof90people:SanFrancisco,Reston,Budapest,Bangalore,Shanghai Charter:applicationmanagementforourHCMsuite Focus:applicationtroubleshooting,performancetuning,capacitymanagement,

rootcauseanalysis,long-termproactivemeasure Dealwitheverythingthatimpactsapplications(byinvolvingresponsibleteams)

6

BeforeSplunk:Manual,Inefficient Hadtoanalyzelogsmanually Usedvariousscripts(shell,perl,etc.) Couldonlyviewoneserveratatime Noaggregatedview Lackofvisibility/analytics Heavilyrelyonexperiencedindividual

7

ChoosingSplunk InitiallypurchasedSplunkforlogmanagement

Saved100+logrequestticketsperweek AttendingSplunkLive!expandedmyperceptionofSplunk

DashboardsandReporting VariousVisualization Correlation

Startedusingitmoreextensively&gainedmultipleadditionaladvantages ReduceMTTR BusinessAnalysis EnvironmentCertification

WestillhaventunleashedthefullpowerofSplunk,butweregettingbetteratit.Wenowseeitas

muchmorethanalogcatching&indexingtool.

8

Splunk Benefits Increasedefficiency

Automatedpreviouslymanualprocesses Consolidatedworthwhiletools,retiredunnecessarytools

Higheravailabilityandperformance Achieving99.9%availability Bettercustomerperformanceexperience

Gainoffunctionaltime Freedupengineeringresources Eliminatingredundanciesintroubleshooting

Informationdiscovery,visibility Centralized,morepreciselogmanagement Aggregatedviewshelpusunderstandnavigationusage,outages,etc.

Sharingcluesandourfindingsaboutmajoractivities

thatwediscoverinSplunk with

executives&peershelpsourbusiness.

9

Splunk atSAPSuccessFactors Splunk Enterprise 5 TBlicense 10datacentersglobally,multipleenvironments USAshburndatacenterexample:

8indexers 2syslogs,1jobserver,1searchhead 1500+forwarders

10

LogsindexedatSAPSuccessFactors Syslogs F5 loadbalancerlogs

Switchlogs

Firewalllogs Bladelogs

OSlevelauditinglogs Webserverlogs

Applicationserverlogs

Databaselogs InternalAPMmetrics

11

DaytoDayOperations Centralize90+logsfromvariousoftiers,

applicationsintoSplunk

Real-timetroubleshootingcapability

Transparentviewinonestopshop

Connectthedots,revealcomprehensivestatusoftheapplicationsuite

Monitoringthekeycomponentsfromdashboard

SplunkAlertsviaemailorAPI

11

ITSIProofofConcept

13

NewSiteAvailabilityGoals ReduceMTTRby90% Optimizethetroubleshooting/investigationprocess Leverageexistingtoolsasmuchaspossible Allwithin3months!

14

Challengeswithexistingsolution

14

CHALLENGES

MultiplepointsolutionsPingdom,Zabbix,Optier,

Solarwinds

Minimalindicationofrootcause

RepeatedescalationsandWarRooms

Rapidgrowthacross10datacenters

PAINPOINTSCONCERNED

Complexity,teamsoperatinginsilos,massiveinfrastructure

ESCALATEDLongresolutiontimes

STRESSEDResourcedrainand

missedprojectdeadlines

SplunkITServiceIntelligenceMachineLearning-Powered,Analytics-DrivenITOperations

Simplifyserviceoperations

Prioritizeincidentswithcontext RedefinetheroleofIT

Combineevents&metricsacrosssiloswithease,flexibility&scaleindays

Unifysiloed monitoringLeveragemachinelearningtodetectanomalies&highlight

eventsthatmatter

Deliverbusiness&servicecontexttoprioritizeincidentinvestigation&action

Supportdecisions&communicateresultswithpowerfulservice-levelinsights

16

PersonalizedvisualizationsofourHCMservice Visualizecontextualinter-relationshipsacross

eachlayerofthestackfromWeb,ApplicationthroughDatabaseandNetwork

Illustratebusinessandserviceactivityusingindicatorsalignedwithstrategicgoals

OnceallthedatawasinSplunkwewereabletobuildtheKPIsandcreateglasstableswithinafewdays

GoalistocreatesyntheticservicehealthscoreswithweightedKPItofacilitateearlyalertingandfastresolution

16

17

OrganizedViewofPerformanceIndicators

17

OurOperationsteamwillbeableto:

BuildoutDeepDivestocorrelatecriticalKPIsforeachlayerofthestack

Example:wecannowtrackhighloadonserversandtieitbacktoJavaExceptions,longrunningSQLqueries

Compareperformanceovertimeandinrealtimetounderstandtrendsandidentifysystemicissues

18

Real-TimeViewofServiceandKPIHealthScoresSiteOperationsteamwillbeableto: Getearlywarningofemergingincidents

withaheatmapofservicehealthandKPIscores,metrics,sparklinesandalerts

Drilldownintoserviceandentitydetailsforin-depthtriage

18

19

TweakKPIWeightforHealthScore

19

Slidingbarapproachmakestheprocessveryintuitive

SimulatedSeverityhelpsuserunderstandhowtheweightimpactshealthscore

20

LearnWhatsNormalandAbnormal

20

Baselinenormaloperationsandalertonanomalousconditions

IdentifyabnormaltrendsandpatternsinKPIdata

21

BaselineTrendstoAdaptThresholds

21

UsestatisticstodynamicallyadaptKPIthresholdsbytime

MaintainandpreservelearnedthresholdstomonitorKPIandservicebehavior

CreativeProjectsw/Splunk

23

Long-termAPMDataRetentionIntegratedSplunkwithourinhouseAPMsolutionforlongerdataretentionusingtheODATAAPIs. Identifyusagepatterns

Capacityplanningforsurgeperiods

Insightstoimproveoverallbusiness

Proactivelydetectanomaliesandremediate

Businessanalysiswithhistoricdata

Machinelearningwithhistoricdatatoprojectusagegrowthscientifically

23

24

LogVerbosityAnalysis&LogFingerprinting Analyzewherethemostredundantlogsarecomingfrom

Reducetheverbosityoftopcontributors

Developlogfingerprintforhighlyredundantandheavy,butnecessarylogentries

Replaceheavyrawlogentrieswiththelightfingerprintentry

BuildSplunklookuptabletomatchthefingerprintwithrawlogentry

GoalistoimprovetheloggingefficiencysothatwecandomorewithSplunk

24

ThankYouy.wan@sap.com