Your team is up and running with Splunk. Now you want to maximize your investment and solve additional business problems. Attend this session led by a Splunk expert on how to expand beyond the initial use case. Learn how to how to capture, document and present Splunk's data and present impactful ways to calculate ROI using concrete metrics; cost savings, time savings, efficiency gains, and competitive advantage.

1. Taking'Splunk'to'the'
Next'Level'for'Management
Doug%May
Director,%Global%Business%Value%Consulting
Splunk>
March&11,&2015

2. Legal'Notice
During the course of this presentation, we may make forward looking statements regarding future
events or the expected performance of the company. We caution you that such statements reflect
our current expectations and estimates based on factors currently known to us and that actual events
or results could differ materially. For important factors that may cause actual results to differ from
those contained in our forward-looking statements, please review our filings with the SEC. The
forward-looking statements made in this presentation are being made as of the time and date of its
live presentation. If reviewed after its live presentation, this presentation may not contain current or
accurate information. We do not assume any obligation to update any forward looking statements
we may make. In addition, any information about our roadmap outlines our general product direction
and is subject to change at any time without notice. It is for informational purposes only and shall
not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to
develop the features or functionality described or to include any such feature or functionality in a
future release.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk™, Splunk Cloud™,
Splunk Storm® and SPL™ are registered trademarks or trademarks of Splunk Inc. in the United
States and/or other countries. All other brand names, product names or trademarks belong
to their respective owners. © 2014 Splunk Inc. All rights reserved.

3. Help Splunk customers, prospects, and partners
document the projected and already realized
business value of making machine data accessible,
usable, and valuable for everyone
Common Deliverables:
› CFO-Ready Business Cases
› Value Realization Studies
› Adoption Roadmaps and Maturity Assessments
› Customer and Use Case Benchmarks
Business Value Consulting @Splunk
3

4. Why Position Business Value?
4
Your%process%requires%it
Create%and%maintain%visibility
Replicate%success%across%the%org
Accelerate%enterprise%adoption
Maximize%business%results

5. Splunk is a Hidden Gem
5
Way%cool,%
dude.
What%business%
value%do%I%get?
I’m%invincible!%

6. Top Challenges to Documenting Value
Lack'of'Splunk'
and'Industry'
Benchmarks
x
Data
Lack'of'Tools'to'
Make'Value'
Measurement'Easy
x
Tools
Not'Enough'
Time'to'Assess'
Your'Value
x
Time

7. Splunk Can Help Documenting Value
All'Splunk'Tools'
Are'Available'to'
All'of'You
ToolsTime
Tools,'Content'
and'Team'Will'
Save'You'Time
Access'to'Splunk'
and'Industry'
Benchmarks
Data

8. Best Practices for Documenting & Positioning
Value
Taking your Splunk deployment to the next level
4
Measure and
Track Your
Success
1
Align with Key
Business
Objectives
Qualify and
Quantify
Business Value
2 3
Incremental
Steps with a
Big Picture Plan

9. Value is in the Eye of the Beholder
1
Align with Key
Business
Objectives
Did%you%know%you%can%save%
15%%on%your%car%insurance%
when%you%call%Geico?
Is%that%important%to%you?
Maybe%it’s%not.

10. Link your project to important goals and strategies to prioritize your project
Aligning with Company Priorities
10
Profit
Double&revenues&while&
increasing&margins
Productivity
Design&and&implement&to&
most&effective&and&
efficient&business&system
People
Attract,&engage,&and&
retain&the&best&talent
Partners
Become&a&critical&part&of&
our&customers’&growth&
strategies
Portfolio
Double&servings&per&day&
and&be&#1&provider
Planet
Create&advantage&by&
fulfilling&our&Live&
Positively&commitments
“We&also&launched&a&productivity%and%
reinvestment%program%to%create%$550%
million%to%$650%million%in%annual%savings%by%
2015.&By&freeing&up&resources&via&supplyH
chain&optimization,&improved&marketing&
effectiveness,&operational&excellence&and&
systems&standardization,&we%can%invest%more%
in%innovation,&marketing&and&additional&
“feet&on&the&street”%to%drive%our%growth.”&&H
CEO
From%investor%presentations,%annual%reports,%
and%executive%presentations

11. Steps to Qualify Value
• Align%your%project%with%something%strategic
• Document%why%something%should%change%or%be%added
• Describe%the%current%challenges%and%the%desired%state
• Summarize%and%socialize%O gain%support
• Then%quantify%that%impact
• Summarize&and&Socialize
Qualify and
Quantify
Business Value
2

12. Qualifying Value Example
12
Visibility'to'Environment'Health'&'User'Exp.
! Brute%force%approach%providing%visibility%to%key%
processes%isn’t%working%and%won’t%scale
! Operations%still%lacks%complete%endOtoOend%visibility%
to%the%environment’s%health,%use%and%trends
! Blinds%spots%still%exist%in%monitoring%and%data%access%
for%Operations%which%could%help%improve%
troubleshooting%and%uptime%/%availability
Incident'/'Issue'Notification
! Brute%force%approach%to%proactive%monitoring%isn’t%
working%consistently%and%won’t%scale
! There’s%a%“Waterfall%effect”%– small%issues%go%
without%broader%notification%triggering%other%issues%
eventually%leading%to%a%bigger%incident
! Users%are%aware%of%issues%before%Operations%and%
call%the%helpdesk%
! All%the%lights%are%“green”%but%still%~65%%of%incidents%
overall%are%reported%first%by%the%business
Troubleshooting'Incidents'/'Issues
! Operations%troubleshooting%is%cumbersome%and%
suboptimal
! It’s%still%manual%across%IT%silos
! It’s%difficult%to%find%root%cause%of%incidents%quickly
! Performance%issues%are%difficult%to%resolve
! Outages%and%impact%are%elongated%due%to%manual%
efforts%and%silos
! Teams%are%distracted%from%their%core%work%when%
they’re%troubleshooting
Recurring'Incidents'/'Issues
! The%Problem%Management%process%isn’t%working%
because%there%are%many%high%severity%incidents%still%
without%root%cause%determined
! As%a%result,%Operations%is%solving%the%same%problems%
again%and%again
! Opportunities%exist%to%improve%on%incident%avoidance%
since%@25%+%of%incidents%are%repeats
DESIRED%STATE%VISION:
Complete%visibility%to%
environment%health%&%trends%
across%full%application%stack%for%all%
stakeholders
Proactively%avoid%issues%before%
the%business%is%impacted
Reduce%MTTR%with%rapid%root%
cause%analysis

13. Quantifying Value with Splunk Tools
Financial'Analysis'Made'Easy
• Over%40%Value%Calculators
• Driven%by%Actual%Customer%Results
• Complete%Financial%Analysis
• Best%Practice%TCO%Models
Don’t'Forget
• Follow%the%Impact
• Capture%All%the%Value
• Summarize&and&Socialize
13

14. Execute Against a Strategy
Take directional, incremental steps
• Avoid%being%reactive%– don’t%drive%by%data%source
• Develop%a%plan%to%expand%Splunk
• Link%the%plan%to%strategic%company%goals
• Document%the%anticipated%value
• Set%baselines%for%success
3
Incremental
Steps with a
Big Picture Plan

15. Measuring & Tracking Success
Helping you take it to the next level
• Demonstrating'success'will'help'further'the'cause
• Tell%the%story%of%your%Splunk%usage
• Compare%your%success%against%Splunk%customer%
benchmarks
• Assess%your%usage%and%staff%maturity
• Then%bring%it%all%together
4
Measure and
Track Your
Success

16. Measure Success with Value Realization
“Money follows money well spent”
• Summarize%
BEFORE%and%
AFTER%Splunk
• Capture%
metrics%of%
improvement
• Socialize%your%
success

17. Splunk IT Operations Benchmarks
Know what to project and/or compare how you’re doing
17
Reduced%Sev1%and%
Sev2%incidents%by%43%
Reduced%MTTR%by%
95%%and%reduced%
escalations%by%50%
Improved%capacity%
utilization%and%avoided%
$200k%in%infrastructure
15%'to 45%'reduction%in%system%incidents
70%'to 90%'faster%investigation%of%system%incidents
67%'to 82%'reduction%in%financial%impact%from%outages
5%'to 20%'optimization%with%server%capacity%allocation

18. Splunk Application Support/Dev Benchmarks
Know what to project and/or compare how you’re doing
18
15%'to 45%'reduction%in%application%incidents
70%'to 90%'faster%investigation%of%QA%defects%and%incidents
10%'to 50%'faster%time%to%market
10%'to 50%'increase%in%value%for%key%projects
Went%from%1%
release/day%to%8%
because%of%Splunk
Shortened%their%
development%
cycles%by%30%
Reduced%the%number%of%
incidents%leading%to%9M%
Euro%per%year%in%revenue%
recaptured

19. Splunk Security & Compliance Benchmarks
Know what to project and/or compare how you’re doing
19
70%'to 90% improvement%with%detection%and%research%of%events
70% to 90% faster%investigation%of%security%incidents
10% to 50% lower%risks%with%data%breaches,%fraud%and%IP%theft
70% to 90% reduction%in%compliance%labor
Reduced%investigation%
effort%by%more%than%75%
Reduced%the%time%to%
report%on%SAS70%
compliance%by%83%
Reduced%the%number%of%
security%incidents%by%80%

20. Usage Maturity Assessment – IT OPS
Drive expansion through highlighting value opportunities
20
Groups
%'Data'
Indexed
Log'
Collection
Incident'
Investigation
Root'Cause'
Analysis
Proactive'
Alerting
Operational'
Dashboards
Business
Analytic
s'
Capacity'
PlanningLevel'1'
Triage
Level'2'&'
3'
Escalation
Virtualization 0%
OS'_ Unix 25%
OS'_ Windows 0%
Storage 33%
Network 100%
=%Splunk%fully%in%use% =%Splunk%partially%in%use% =%Splunk%not%in%use

21. Usage Maturity Assessments – App Dev
Drive expansion through highlighting value opportunities
21
Top'Apps
%'
Indexed
Evaluate'and Assess'Needs Develop'and'Release
Data'Collection Business'Insight
Test'Failure'
Analysis
Defect'
Investigation
SAP 0%
Warehouse'Mgt 0%
E_Commerce'Website 0%
Call'Center 0%
=%Splunk%fully%in%use% =%Splunk%partially%in%use% =%Splunk%not%in%use

22. Usage Maturity Assessments – Security
Drive expansion through highlighting value opportunities
22
Data'
Sources
%'
Indexed
Log'
Collection
Level'1'
Triage
Monitoring'/'
Alerting
Investigations
Incident
Response
Compliance'
Reporting
Routine'
Log'
Reviews
Threat'Intel:
(3rd Party)
70%
Threat Intel:
(OS%Blacklist)
70%
Network:
(Firewall)
90%
Network:
(IDS/IPS)
90%
Endpoint:
(PCLM)
80%
Access'&'
Identity'Mgt
75%
=%Splunk%fully%in%use% =%Splunk%partially%in%use% =%Splunk%not%in%use
Currently%handled%by%MSSP

23. Usage Maturity Assessments – Security Controls
Drive expansion through highlighting value opportunities
23
Critical'Control In'Place?
Monitor'unauthorized'devices'or'software
Monitor'unmanaged'devices'or'software'
Monitor'configuration'compliance'
Monitor'patch'compliance'
Monitor'malware'defense
Monitor'application'software'security
Monitor'wireless'access'control
Analyze audit'logs'with'time_based'correlation'
Critical'Control In'Place?
Monitor'use'of'ports,'protocols,'and'services'
Monitor'controlled'use'of'admin'privileges
Monitor'perimeter'IDS
Monitor'controlled'/'uncontrolled access
Monitor'orphan,'expired,'miss'use'of'accounts
Monitor'potential'exfiltration'of'information
Monitor'secure'IP'restriction'policies'
Maintain'data'going'back'months
=%Splunk%fully%in%use% =%Splunk%partially%in%use% =%Splunk%not%in%use

24. A Real Customer Example - Operations
MostcommonusesofSplunkdeliveringvalue
Business'
Service'
Components
%''of'
Data
Indexed
Log'/'Data'
Collection
Incident'Investigation
Root'Cause'
Analysis
Proactive'
Alerting
Operational'
Dashboards
Business'
AnalyticsLevel'1'
Triage
Level'2'&'3'
Escalation
Custom'Web'Apps 80%
3rd Party'Web_Apps 100%
Apps 75%
Web'Server 50%
Database 100%
OS 100%
Network 95%
=%Splunk%fully%in%use% =%Splunk%partially%in%use% =%Splunk%not%in%use
E_Commerce'Site

25. Splunk Staffing Roles
Be sure you have the staff and skills to maximize value
25
A%successful%and%scalable%deployment%of%
Splunk%relies%on%the%orchestration%of%key%
roles%and%responsibilities,%primarily%
centered%around:
" Architecture
" Administration
" User%adoption%(Power%User)
" Application%development

26. Basic Communication Framework
26
Architect
Admin
Works%with%power%users%to%determine%
which%data%sources%should%be%indexed%
to%meet%each%department’s%needs
Scales%the%Splunk%architecture%to%meet%
business%demand
Power'Users Department%Users
Adds%data%sources%to%the%Splunk%
platform%according%to%business%needs
Assist%power%users%with%the%
development%of%advanced%dashboards,%
alerting%and%reporting
Maintains%the%Splunk%SW%and%it’s%
infrastructure%for%optimal%performance%
1%Power%user%per%department
Provides%basic&support&for%new%and%existing%reports%
and%dashboards
Works%with%their%group%to%identify%opportunities%
where%Splunk%can%provide%value%%

27. Splunk Roles & Recommended Training
27
Splunk'
Roles
Using%
Splunk
Splunk%
Administration
Searching%
and%
Reporting
Creating%
Knowledge%
Objects
Advanced%
Searching%&%
Reporting
Developing
Apps%with%
Splunk
Developing%
with%Splunk
SDKs
Architect Required Required Optional Optional Optional Optional Optional
Admin Required Required Optional Optional
Power%User Required Required Required Optional
Developer Required Optional Required Required Optional Required Optional
for%Splunk%onOpremises

28. Map Your Roles & Highlight Training Gaps
28
Splunk%Architect
#name
Splunk%
Developer
#name
Security
Power%User
#name
Collaboration
Power%User
#name
Database
Power%User
#name
CRM
Power%User
#name
Network
Power%User
#name
Financial'Apps
Power%User
#name
Splunk%Architect
#name
=%Fully%Trained =%Partially%Trained =%Not%assigned
Web
Power%User
#name
Server
Power%User
#name
Your'Company

29. Position%Value%in%
Expansion%Area
Taking%it%to%the%Next'Level
Value'Opportunity:''
• faster detection,%
• faster investigation,%
• faster root%cause%
analysis%of%application%
incidents
• fewer'developer%
escalation
After'3'to'6'
months
After'3'to'6'
months
Document%Success%for%
Server%&%Network%teams
Document%Success%for%
App%&%DB%teams
Position%Value%in%
Expansion%Area
Application'
Development
Value'Opportunity:''
• faster'test%analysis,%
• faster'investigation%of%preO
production%bugs,%
• faster'releases%cycles
Position%Value%in%
Expansion%Area
Security'&'
Compliance
Value'Opportunity:''
• faster'detection,%%faster triage,%
• faster investigation%of%security%incidents
Value%Realized:%%
• faster detection,%
• faster investigation,%
• faster root%cause%
analysis%of%system%
incidents
IT'Operations
Application'
Support

30. Best Practices for Documenting & Positioning
Value
Taking your Splunk deployment to the next level
4
Measure and
Track Your
Success
1
Align with Key
Business
Objectives
Qualify and
Quantify
Business Value
2 3
Incremental
Steps with a
Big Picture Plan