SplunkLive! Utrecht 2017 - Coolblue Customer Presentation
-
Upload
splunk -
Category
Technology
-
view
174 -
download
1
Transcript of SplunkLive! Utrecht 2017 - Coolblue Customer Presentation
![Page 1: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/1.jpg)
Matthew Hodgkins | SplunkLive! Utrecht
![Page 2: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/2.jpg)
![Page 3: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/3.jpg)
A Little About Me
● Been at Coolblue 1.5 years
● Background in operations
● Focus is monitoring and logging
![Page 4: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/4.jpg)
Disappointment
![Page 5: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/5.jpg)
Whoops
![Page 6: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/6.jpg)
Agenda
● A little about Coolblue
● Logging in Coolblue before Splunk
● The migration to Splunk
● The benefits we found after moving
![Page 7: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/7.jpg)
![Page 8: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/8.jpg)
Business plan
![Page 9: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/9.jpg)
![Page 10: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/10.jpg)
![Page 11: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/11.jpg)
Picture from
last
hackathon
![Page 12: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/12.jpg)
Picture from
last
hackathon
![Page 13: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/13.jpg)
![Page 14: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/14.jpg)
![Page 15: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/15.jpg)
ELK Architecture
![Page 16: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/16.jpg)
Easy right?
# For e-commerce send logs here
10.0.0.2:6379
![Page 17: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/17.jpg)
Challenges
● Around 180 Developers
● Many Languages
○ C#
○ PHP
○ Python
○ Node.JS
○ Delphi
![Page 18: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/18.jpg)
ELK Architecture
![Page 19: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/19.jpg)
Challenges
# For e-commerce send logs here
10.0.0.2:6379
# For backoffice send logs here
10.0.10.2:6379
![Page 20: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/20.jpg)
Challenges
● Logs everywhere
○ Windows / Linux / Network Devices
○ Logging to disk
○ No standardization
![Page 21: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/21.jpg)
Offices
![Page 22: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/22.jpg)
ELK Architecture
![Page 23: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/23.jpg)
Physical stores
![Page 24: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/24.jpg)
Warehouses
![Page 25: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/25.jpg)
ELK Architecture
![Page 26: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/26.jpg)
Challenges
# For e-commerce send logs here
10.0.0.2:6379
# For backoffice send logs here
10.0.10.2:6379
# For amsterdam store send logs here
192.168.2.2:6379
# For rotterdam store send logs here
192.168.3.2:6379
![Page 27: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/27.jpg)
Challenges
● Storage
● Retention
![Page 28: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/28.jpg)
Microservices. Microservices Everywhere.
![Page 29: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/29.jpg)
![Page 30: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/30.jpg)
![Page 31: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/31.jpg)
![Page 32: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/32.jpg)
![Page 33: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/33.jpg)
The main reasons
● Amazing AWS integrations (Splunk App for AWS)
![Page 34: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/34.jpg)
The main reasons
● Amazing AWS integrations (Splunk App for AWS)
● Fully managed
![Page 35: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/35.jpg)
The main reasons
● Amazing AWS integrations (Splunk App for AWS)
● Fully managed
● No more worrying about architecture changes
with growth
![Page 36: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/36.jpg)
The migration
● Standardized logging frameworks
● Log however you want, as long as its JSON
● Reviewed a ton of dashboards
● Planned a new architecture
![Page 37: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/37.jpg)
The migration
● Standardized logging frameworks
![Page 38: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/38.jpg)
The migration
● Standardized logging frameworks
● Log however you want, as long as its JSON
![Page 39: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/39.jpg)
The migration
● Standardized logging frameworks
● Log however you want, as long as its JSON
● Reviewed a ton of dashboards
![Page 40: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/40.jpg)
The migration
● Standardized logging frameworks
● Log however you want, as long as its JSON
● Reviewed a ton of dashboards
● Planned a new architecture
![Page 41: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/41.jpg)
Splunk Cloud Architecture
![Page 42: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/42.jpg)
Splunk Cloud Architecture - AWS
![Page 43: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/43.jpg)
Splunk Cloud Architecture - On Premise
![Page 44: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/44.jpg)
So where are we now?
![Page 45: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/45.jpg)
So where are we now?
![Page 46: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/46.jpg)
Benefit - Easier Config
● Logging by convention
# wherever you are, send logs here
127.0.0.1:514
![Page 47: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/47.jpg)
Benefit - Easier To Test
![Page 48: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/48.jpg)
Benefit - Exploration
![Page 49: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/49.jpg)
Benefit - New apps are easy
● New service coming online?
○ Create an index for the service
![Page 50: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/50.jpg)
Benefit - New apps are easy
● New service coming online?
○ Create an index for the service
![Page 51: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/51.jpg)
Benefits - Templated dashboards
● Templated dashboards
![Page 52: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/52.jpg)
Benefits - Real Time Dashboards
● Templated dashboards
![Page 53: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/53.jpg)
Benefits - Audit Trails
● Templated dashboards
![Page 54: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/54.jpg)
Benefits - Overall Health
● Templated dashboards
![Page 55: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/55.jpg)
Benefits - Other Teams Onboard
● Templated dashboards
![Page 56: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/56.jpg)
Benefits - Time Saved
● Templated dashboards
![Page 57: SplunkLive! Utrecht 2017 - Coolblue Customer Presentation](https://reader035.fdocuments.in/reader035/viewer/2022062504/5a647bde7f8b9a3b568b49d5/html5/thumbnails/57.jpg)
● Know what’s important to you and your
customers
● Make logging as simple as possible
● Dashboard templating
Takeaways