Business Value Breakfast Presentation

1. Positioning the Business Value
of Splunk Across Your
Organization
David Caradonna
Director, Global Business Value Consulting
dcaradonna@splunk.com
July, 2015

2. Agenda for Today’s Session
2
2 Overview of Enterprise Value
3 Best Practices for Documenting & Positioning Value
4 Summary / Q&A
1 Business Value @Splunk

3. Help Splunk customers, prospects, and partners
document the projected and already realized
business value of making machine data accessible,
usable, and valuable for everyone
Common Deliverables:
› CFO-Ready Business Cases
› Value Realization Studies
› Adoption Roadmaps and Maturity Assessments
› Customer and Use Case Benchmarks
Business Value Consulting @Splunk
3

4. Splunk show not be a Hidden Gem
4
Way cool,
dude.
What business
value do I get?
I can search
Syslog way faster
now!

5. IT Operations Application Delivery Security & Compliance
IT Value Centers
An overview of Splunk efficiencies, as reported by Splunk Customers

6. 6
Benchmarking Splunk Customer Success
15-45% reduction in high priority incidents
70-90% reduction in incident investigation time
67-82% reduction in business impact
5-20% increase in infrastructure capacity utilization
Documented through 400+ engagements worldwide
 Easy search
 Real time visualization
 Automated correlation of data sources
 Rapid analysis of system data
 Faster isolation of root causes
Customer FeedbackSplunk Capabilities
IT Operations

7. 7
Root Cause
Analysis
Up to 30% unknown
root causes, causing
incidents to recur
Incident
Troubleshooting
Lengthy log analysis done
manual
Incident
Triage
All hands on
deck, taking up
30 to 40 minutes
Failure
detection
Customer
informs IT
Before
Splunk
Service
Restoration
Fix is
implemented
Faster and more
comprehensive
root cause analysis
helping to reduce
incident recurrence
Faster investigation (MTTI)
through Splunk log search
and correlation capabilities
Faster triage
often conducted
by 1st level staff
without all
hands on deck
Better
detection
customer is
notified by IT
With
Splunk
Fix is
implemented
Splunk efficiencies with IT Operations
Event Mgmt Incident Mgmt Problem Mgmt

8. 8
Customer Successes – IT Operations
Reduced Sev1 and
Sev2 incidents by
43%
Reduced MTTR by
95% and reduce
escalations by 50%
Incident Avoidance
Reduced Mean
Time to Investigate
by 80%
Improved capacity
utilization and
avoided $200k in
infrastructure
Incident Investigation Capacity Mgmt

9. 9
Benchmarking Splunk Customer Success
80-90% faster development of reports and dashboards
70-90% reduction in QA test failure analysis and pre-
prod defect investigation
10-50% improvement in time to market
10-50% increase in value for key projects
Documented through 400+ engagements worldwide
 Easy search
 Real time visualization
 Automated correlation of data sources
 Rapid analysis of system data
 Faster isolation of root causes
Customer FeedbackSplunk Capabilities
Application Development

10. 10
Splunk Efficiencies with Application Delivery
typical
SDLC
Faster delivery of dashboards
provide real-time visibility across
all technology layers involved in
processing business service
transactions so bottlenecks can be
swiftly identified and addressed
Faster Mean Time to Market on
key projects through faster test
failure analysis and defect
remediation
Increased release value through
improved visibility on feature
efficiency patterns in order to better
assess needs for future releases
Faster pre-production defect
remediation through improved
investigation of root causes
Faster test failure analysis for
functional, performance and
security test runs through
analysis of test logs
Fewer escalations to developers from
fewer production outages means
developers are more focused on
innovating the business

11. 11
Customer Successes – Application Delivery
Faster Release Cycles Defect ManagementFaster Reporting
Shortened
development
cycles by 30%
Reduced reporting
time by 88%
Resolved a recurring
error regaining
3M Pounds in revenue
per year
Improved API
performance by 50%
reducing need for
infrastructure upgrades
and increasing user
satisfaction
Test Failure Analysis

12. 12
Benchmarking Splunk Customer Success
Security & Compliance
70-90% faster detection and triage of security events
70-90% faster investigation of security incidents
10-50% reduction in risk of data breach, IP theft,
fraud
70-90% reduction in compliance reporting time
Documented through 400+ engagements worldwide
 Easy search
 Real time visualization
 Automated correlation of data sources
 Rapid analysis of system data
 Faster isolation of root causes
Customer FeedbackSplunk Capabilities

13. 13
Splunk Efficiencies with Security & Compliance
1. Constant Triage of security events
2. Critical Decision on whether an event is worthy of deeper investigation
3. Deep Dive investigation of defined incidents
Source: 2014 Cyber Security Intelligence Index

14. Assess
Risk
Deep
Analysis
Monitor
Controls
Audit &
Comply
14
Splunk Efficiencies with Security & Compliance
Continuous compliance on
ALL components and policies
resulting in faster and simpler
audits
Faster implementation of critical
security controls (ex: SANS 20) across
ALL layers of the organization,
ultimately resulting in full enterprise
visibility and a reduction in risks
Faster deep dive investigation on
security incidents that require
further proactive and reactive
analysis
Faster 1st level triage on ALL security
attacks with less resources as
opposed to reviewing only a subset of
attacks

15. Splunk Security & Compliance Best Practices
15
RefertotheSplunkSANS20
whitepaperfordetailedusecasesand
examplesofhowcustomersuse
Splunkforsecuritytoachievethe
anticipatedimprovementwith:
FasterDetectionofSecurityEvents
FasterResearchandInvestigation
ReducedRiskswithDataBreachandFraud

16. 16
Value Beyond IT
Digital Marketing
• Increase response rate to
marketing campaigns
• Increase SEO efficiency
• Increase conversion rate
of visitors
• Increase average order
size
• Improve promotion of
content and/or services
• Reduce rate of abandoned
transactions
• Understand and optimize
customer behavior and
experience
• Increase revenue through
transaction reporting and
analysis
• Prevent revenue loss by
identifying miss-
configurations
• Increase customer loyalty
• Accelerate product
delivery with insights into
failures
• Increase efficiency in
analyzing feature adoption
and usage
• Gain more market share
through new offerings,
demographics, …
• Increase margins by
streamlining business
processes
• Negotiate better service
rates with external
providers
• Prevent penalties
associated with regulatory
requirements
• Improve efficiencies with
tracking customer orders
• Reduce order failure rates
Business ProcessProduct AnalyticsCustomer Experience

17. 17
Value Beyond IT
Digital Marketing Business ProcessProduct AnalyticsCustomer Experience
Increased conversion
by optimizing marketing funnel
Improved SEO and localized
content
Increased revenue with
higher shopping cart conversion
Improved user experience by
identifying broken product images
Provide real-time insights into
web, mobile product feature usage
Enable product innovation
Analyze content browsed, watched,
purchased; Boost revenue by
analyzing search on set-top box
82% improvement in site speed
Prevent revenue loss by real-time
identification of e-booking
misconfigurations
Provide analytics for site usage,
feature usage and adoption
Drive user experience enhancements
by refining features
Investigate complex customer order
issues in real time
Track current order status across
multi-tiered enterprise systems
Negotiate call rates by routing
calls to low-cost providers
Track flights in real time to gain
visibility into communication
handovers

18. 18
Example of an Enterprise Adoption Roadmap
time
“Self-funded”
big data strategySTABILIZE IT
OPERATIONS
1
› Optimized performance and reliability
› More efficient processes
› Improved capacity planning
› Fewer tools
SECURE
BUSINESS DATA
2
› Faster event detection and investigation
› Reduced fraud and IP theft
› Less risk of data breach
› Continuous compliance
INNOVATE BUSINESS
SERVICES FASTER
3
› Fewer developer disruptions
› Continuous development / innovation
› Faster time to market
OPTIMIZE BUSINESS
PROCESSES
4
› Contextual business intelligence
› Drive more revenue
› Drive process efficiencies
Incremental Steps with
a Big Picture Plan

19. Best Practices for Documenting and Positioning Value
41 3
Quantify
anticipated
benefits
Qualify
business
value
2
Taking your Splunk Deployment to the Next Level
Align
with key
objectives
Measure
your
success

20. Steps to Aligning with key objectives
1
Align
with key
objectives
• Align your project with something strategic
• Take a top-down approach
• Link your plan to Top-5 key objectives
• Explain how Splunk aligns to they objectives
• Use the Splunk Value Benchmarks to help you

21. 21
Common IT Goals Achieved with Splunk
Reduce/Avoid
Business
Expenditures
Infrastructure cost
avoidance
Future headcount
avoidance
Tools
consolidation
Improve
Internal
Efficiencies
Labor savings with
common IT
processes such as
incident, problem,
change, release,
security, audit,
test and defect
management
Increase
Revenue
Avoid revenue
impact from fewer
business outages
Faster delivery of
real-time business
analytics
Improved
innovation value
for key business
initiatives
Accelerate Time
to Market
Faster test failure
analysis
Faster remediation
of bugs and
defects
Fewer developer
disruptions
Protect &
Improve our
Brand
More reliable
business services
Faster response to
customer
requirements
Continuously
Secure our
Environment
Better detection
of cyber attacks
Faster response to
security incidents
Continuous
compliance
monitoring
Reduction in risk
for data breach,
fraud and IP theft

22. Qualify
business
value
2
Steps to Qualifying Business Value
• Identify common issues and roadblocks
• What’s hindering your key objectives
• Document why something should change or be added
• Describe the current challenges and pain points
• Describe the desired state

23. Example of Qualifying Business Value
Production Support
• Complex layers of technology stack
• Complex flow of data and calls across each layer
• Lack of end to end visibility on data flow
• Unclear customer impact during incidents
• Lengthy manual investigation of logs cause longer outages
• Investigation delays prevent real-time collaboration across teams
• Developer escalations required to assist with production issues
• Intermittent errors go unresolved for years (e-statements)
Application Releases
• Lengthy manual investigation to address release errors
• Impossible to gain real-time collaboration between support staff
and developers
• Often unclear whether errors are caused by code or infrastructure
• Not enough time during change windows to fix errors
• Releases at risk due to slow determination of errors
• Business can be impacted by 30-day release delays if release is
backed out
DESIRED STATE VISION:
• Complete visibility of data flow across all
layers
• Quickly isolate the particular area in the stack
that is causing issues
• Real-time collaboration between teams to
accelerate investigations of incidents and/or
release errors
• Proactively avoid issues before the business is
impacted
• Reduce MTTR with rapid log correlation and
root cause analysis
• Accelerate speed to investigate functional,
performance and security QA test runs and
resulting defects
• Deliver faster time to value on key business
projects

24. Steps to Quantifying Anticipated Benefits
• Collect internal Key Performance Metrics
• Leverage External Benchmarks to fill in the gaps
• Use Splunk Customer Benchmarks to guide your
efficiency calculations
• Business cases are not an exact science, don’t worry
about being too meticulous
• Keep it conservative!
3
Quantify
anticipated
benefits

25. Key Performance Metrics thatDrive Value
IT OPERATIONS
› # of sev1, sev2, sev3 incidents per month
› avg MTTR per Incident by severity
› # people involved in Incident investigation
› $ per hour of business impact
› % incidents requiring post incident reviews
› # hours for root cause analysis per incident
› # servers (physical + virtual)
› % servers virtualized
› $ cost per physical vs. virtual server
APP DELIVERY
› # developers
› % developer time spent troubleshooting
› # request for dashboards and reports per month
› # people to develop dashboards and reports
› # large, medium, small project releases per year
› $ business value per project release
› # months from project kick-off to prod release
› # test runs conducted per month
› # pre-prod defects investigated per month
SECURITY & COMPLIANCE
› # of security alerts per week
› # people for 1st first level triage
› avg time to triage an alert
› # security incidents per week
› # people involved per incident
› # sensitive records
› $ business fraud per year
› # audit activities per year
› # people hours per audit activity
Less than 10 KPIs per Value Center

26. Financial Analysis Made Easy
• Over 50 Value Calculators
• Driven by Actual Customer Results
• Complete Financial Analysis
• Best Practice TCO Models
Don’t Forget
• Follow the Impact
• Capture All the Value
• Summarize and Socialize
26
Quantifying Value with Splunk Tools

27. Forecast Future Value and ROI
“Work with your Rep to gain access to the IVA – Interactive Value Assessment”
Executive Report with Business Case Analysis
 Detailed use cases
 Benefit calculations
 Investment details
 ROI analysis
 Key goals
 Current pain points
 Proposed solution
 Adoption speed

28. Steps to Measuring your Success
• Leverage the use cases identified in the IVA as the
benchmark for tracking and validating your success
• Document your Top-3/Top-5 success stories
• Describe specific challenges that existed prior to Splunk
• Explain the business impact
• Describe the solution achieved with Splunk
4
Measure
your
success

29. Measuring your Success
With Splunk
1. How did Splunk help us address this scenario?
2. How fast were we able to implement a solution
with Splunk?
3. Are we able to detect or isolate circumstances
that were previously unnoticed or impossible
to find?
4. How often has this type of scenario surfaced
since Splunk has been in place?
Guidelines - Before | After Questions for each Success Story
Before Splunk
1. How often did this type of scenario occur, how long
did it take to resolve and how many people were
required?
2. What challenges did we face handling this type of
scenario before Splunk?
3. Did we have to do any manual work?
4. Did we invest in infrastructure or other resources to
address this before Splunk?
5. Did this cause direct financial impact?
6. Was customer service or customer loyalty affected?
7. How did this impact end-user productivity?
8. Did it affect our brand negatively, i.e. bad press or
negative social media hits?
5. How faster are we able to respond?
6. Has this freed a % of our staff time to focus on other
more important tasks?
7. Was this possible before Splunk?
8. Can we provide a dashboard screenshot?

30. Examples of a Customer Success Story
“Money follows money well spent”

31. Plan your Splunk Staffing Roles
Besureyouhavethestaffandskillstomaximizevalue
31
A successful and scalable deployment of
Splunk relies on the orchestration of key
roles and responsibilities, primarily
centered around:
 Architecture
 Administration
 User adoption (Power User)
 Application development

32. Splunk Roles & Recommended Training
32
Splunk
Roles
Using
Splunk
Splunk
Administration
Searching
and
Reporting
Creating
Knowledge
Objects
Advanced
Searching &
Reporting
Developing
Apps with
Splunk
Developing
with Splunk
SDKs
Architect Required Required Optional Optional Optional Optional Optional
Admin Required Required Optional Optional
Power User Required Required Required Optional
Developer Required Optional Required Required Optional Required Optional
for Splunk on-premises

33. Splunk Roles & Recommended Training
33
for Splunk Cloud
Splunk
Roles
Using
Splunk
Splunk
Administration
Searching
and
Reporting
Creating
Knowledge
Objects
Advanced
Searching &
Reporting
Developing
Apps with
Splunk
Developing
with Splunk
SDKs
Architect Required Optional Optional Optional Optional Optional
Admin Required Optional Optional
Power User Required Required Required Optional
Developer Required Required Required Optional Required Optional

34. Map Your Roles & Highlight Training Gaps
34
Splunk Admin
#name
Splunk
Developer
#name
Security
Power User
#name
Collaboration
Power User
#name
Database
Power User
#name
CRM
Power User
#name
Network
Power User
#name
Financial Apps
Power User
#name
Splunk Architect
#name
= Fully Trained = Partially Trained = Not assigned
Web
Power User
#name
Server
Power User
#name
Your Company

35. Bring it all together!
Quantified
Benefits
Drill down
Use Cases
Adoption
Curve
Key Objectives
Alignment
Current Pain
Paints
Desired
End State
Investment
Schedule
Financial
Performance
Training
Plan
Splunk
Customer
Benchmarks
KPIs to Track
your Success
 Covered by the WEB IVA
  
  
 


36. Questions? Thank you!