 Hello everyone, welcome back to theCUBE's coverage of Splunk.com 2021 virtual, but we're here live in the Splunk studios. We're all here getting all the action, all the stories, Garth Ford, Senior Vice President, Chief Product Officer at Splunk is here with me, CUBE alumni, great to see you. Last time I saw you, we were at AWS, now here at Splunk, congratulations, new role. Thank you, great to see you again. Great keynote and great team, congratulations. Thank you, thank you, it's a lot of fun. So let's get into the keynote a little bit on the product, the Chief Product Officer. We interviewed Sean, Vice, who's also working with you as well, he's your boss. Talk about the next level, because you're seeing some new enhancements, let's get to the news first, talk about the new enhancements. Yeah, this is actually a really fun keynote for me, so I think there was a lot of great stuff that came out of the rest of it, but I had the honor to actually showcase a lot of the product innovation. Since we did .conf last year, we've actually closed four different acquisitions, we shipped 43 major releases, and we've done hundreds of small enhancements, like we're shipping code in the cloud, every six weeks, and we're shipping new versions twice a year for our Splunk Enterprise customers, and so this is kind of like, if you see that movie, Sophie's Choice, you know where you have to pick one of your children, like this was a really hard, hard thing to pick, because we only had about 25 minutes, but we did like four demos that I think landed really well. The first was what we call ingest actions, and there's customers that are using, they start small with gigabytes, and they go to terabytes, and up to petabytes of data per day, and so they wanted tools that allow them to kind of modify, filter, and then route data to different parts of their infrastructure, so that was the first demo. We did another demo on our Visual Playbook Editor for SOAR, which has improved quite a bit. A lot of the analysts that are in the SOC trying to figure out how to automate responses and reduce time to resolution, like they're not Python experts, and so having a Visual Playbook Editor that lets them drag and drop and sort of with a few simple dressers create complex playbooks was pretty cool. We showed some new capabilities in our APM tool. Last year we announced we acquired a company called Plumber, which has expertise in basically code-level analysis, and we're calling it always on profiling. So we did that demo, and gosh, we did one more. But four total demos, I think people are really happy to see, the thing that we really tried to do was ground all of our sort of tech talk in stuff that was real and today. This is not some futuristic vision. I mean, Shawn did lay out some great visionary pillars, but what we showed in the keynote was, it's all shipping code. I mean, there's plenty of headroom in this market when it comes to data as value and data in motion, all these things. But we were talking before, you came on camera earlier in the morning about actually how good Splunk product, and broad and deep the product portfolio is. Splunk, I mean, it's not a utility in a tooling, it's a platform with tools and utilities. It's fully blown out platform. Yeah, it is a platform and you know, it's one that's quite interesting. I've had the pleasure to meet a couple of big customers and it's kind of amazing like what they do with Splunk. Like I was meeting with a large telco on the East Coast and they actually, for their set top boxes, they actually have to figure out in real time which ads to display. And the only tool they could find to process 15 million events in real time to decide what ad to display was Splunk. So that was like really cool to hear. Like we never set out to be like an ad tech kind of platform and yet we're the only tool that operates at that level of scale and that kind of data. You know, it's funny, Doug Merritt mentioned this in my interview with him earlier today about, you know, and he wasn't shy about it, which is great. He's like, we're an enabling platform. We don't have to be experts in all these vertical industries because AI takes care of that. That's where the machine learning and the applications get built. So others are trying to build fully vertically integrated stacks into these verticals when in reality they don't have to. They don't want to. Yeah, and Splunk's kind of, it's quite interesting when you look across our top 100 customers, you know, Doug talks about like the, you know, 92 of the Fortune 100 are kind of using Splunk today, but the diversity across industries and, you know, we have government agencies. We have, you know, you name the retail or the vertical, you know, we've got really big customers that are using Splunk. And the other thing that I kind of, I was excited about, we announced the last demo I forgot was TrueStar Integration with Enterprise Security. That's pretty cool. We're calling that Splunk Threat Intelligence. And so that was really fun. And we only acquired, we closed the acquisition to TrueStar in May, but the good news is they've been a partner with us like for 18 months before we actually bought them. And so they'd already done a lot of the work to integrate. And so they had a running start in that regard. But one other one that was kind of a, it was a small thing. I didn't get to demo it, but we talked about the content pack for application performance monitoring. And so, you know, in some ways we compete in the APM level, but in many ways there's a ton of great APM vendors out there that customers are using. But what they wanted us to do was like, hey, if I'm using APM for that one app, I still want to get data out of that into Splunk. Because Splunk ends up being like the core repository for observability, security, IT ops, DevSecOps, et cetera. It's kind of like where the truth, the operational truth of how your systems works, lives in Splunk. It's so funny. The Splunk business model has actually been replicated. They call it data lakes, whatever you want to call it. People are bringing up all these different metaphors. But at the end of the day, if you guys can create a value proposition where you can have data just be stored and dumped into whatever you want to call it, stored in a way. We call it ingested. Ingested, ingested. Not dumped. Data dumped. Well, I mean, well, you can mid-play it, but you don't have to do a lot of work to store it. It's okay, we can only get to it later, but let the machines take over with machine learning. I totally get that. Now as a product leader, I have to ask you your mindset around optimization. What do you optimize for? Because a lot of times these use cases are emerging. They just pop out of nowhere. It's a net new use case that you want to operationalize. So balancing the headroom, or not to foreclose those new opportunities for customers. How are customers deciding what's important to them? How do you, because you're trying to read the tea leaves for the future and then go, okay, what do customers need? But you don't want to foreclose anything. How do you think about product strategy? There's a ton of opportunity to interact with customers. We have this thing called the customer advisory board. We run, I think four of them and we run a monthly. And so we got an opportunity to kind of get that anecdotal data and the direct contact. We also have a portal called ideas.splunk.com where customers can come tell us what they want us to build next. And we look at that every month. And there's no way that we could ever build everything that they're asking us to, but we look at that monthly and we use it in sort of our sprint planning to decide where we're going to prioritize engineering resources. And it's just, it's kind of like customers say the darkest things, right? Sometimes they ask us for stuff and we never imagined building it in a million years. Like that use case around ads on the set top box. But it's kind of a fun place to be. We, just before this event, we kind of laid out internally what Sean and I kind of put together this doc, actually Sean wrote the bulk of it, but it was about sort of what do we think, where can we take Splunk in the next three to five years? And we talked about these, we refer to them as waves of innovation. Cause you know, like when you think about waves, there's multiple waves that are heading towards the beach in parallel, right? It's not like a series of phases that are going to be serialized. It's about making a set of investments that'll kind of land over time. And the first wave is really about, you know, what I would say is sort of, you know, really delivering on the promise of Splunk. And some of that's around integration, single sign-on things about like making all of the Splunk products work together more easily. We've talked a lot in the keynote about like edge and hybrid. And that's really where our customers are. If you watch Kobe Avatar's sort of customer keynote, you know, Walmart by necessity, given their geographic breadth and the customers they serve has to have their own infrastructure. They use Google, they use Azure, and they have this abstraction layer that Kobe's team has built on top. And they use Splunk to manage kind of, you know, operate basically all of their infrastructure across those three clouds. So that's the hybrid edge scenario. We're thinking a lot about, you mentioned data lakes. You know, if you go back to 2002 when Splunk was founded, you know, the thing we were trying to do is help people make sense of log files. But now, if you talk to customers that are moving to cloud, everybody's building a data lake. And there's like billions of objects flowing into millions of these S3 buckets all over the place. And we're kind of trying to think about, hey, is there an opportunity for us to point our indexing and analytics capability against structured and unstructured data in those data lakes. So that'll be something we're going to at least start prototyping pretty soon. And then lastly, machine learning. You know, I'd say, you know, to use a baseball metaphor, like in terms of like how we apply machine learning, we're like in the bottom of the second inning. You know, we've been doing it for a number of years, but there's so much more that we could do. I mean, machine learning is only as good as the data you put into the machine learning. Exactly. And so if you have, if you have gap in the data, the machine learning is going to have gaps in it. Yeah. And we announced a feature today called auto-detect. And I won't go into the gory details, but effectively what it does is it runs a real-time analytics job over whatever metrics you want to look at. And you can do what I would consider more statistics versus machine learning. You can say, hey, if in a 10 minute period, like, you know, we see more errors than we see on average over the last week, throw an alert so I can go investigate and take a look. Imagine if you didn't have to figure out what the right thresholds were. If we could just watch those metrics for you and automatically understand the seasonality, the timing. Is it a weekly thing? Is it a monthly thing? And then, like, tell you, like, use machine learning to do the anomaly detection, but do it in a way that's more intelligent than just the static threshold. And so I think you'll see things like auto-detect, which we announced this week, will evolve to take advantage of machine learning kind of under the covers, if you will. Yeah, it was interesting to include cloud scale and the data velocity. Automation has become super important. You have a lot of new disciplines emerge like explainable AI is hot right now. So you got, the puck is coming. You can see where the puck is going. Yeah. Automation at the app edge, or the application layer, where the data's got to be free-flowing or addressable. Yeah. This is something that is being talked about. We talked about data divide with Chris earlier about the policy side of things. And that data is part of everything. It's part of the apps. It's not just stored stuff. So it's always in flight. It should be addressable. This is what people want. What do you think about all that? No, I think it's great. I actually just, can I, I'll quote from Steve Schmidt in sort of the keynote. He said, look, like security at the end of the day is a human problem, but it kind of manifests itself through data. And so being able to understand what's happening in the data will tell you, like, is there a bad actor, like wreak and havoc inside of my systems? And like, you can use that, the data trail, if you will, of the bad actor to chase them down and sort of isolate them. The digital footprints, if you want to look at a trail. Yeah. All right, what's the coolest thing that you like right now? When you look at the treasure trove of value, as you look at, there's a range of value. Splunk has had customers come in with these early products, but they keep the customers. And they always do new things and they operationalize. And another new thing comes, they operationalize it. What's the next new thing that's coming? That's the next big thing. So that is like asking me, which one of my daughters do I love the most? Like, that is so unfair. I'm not going to answer that one. Next question, please. All right, okay. What's your goals for the next year or two? Yeah, so I just kind of finished roughly my first 100 days and it's been great to, you know, I had a whole plan, 30, 60, 90, and I had a whole bunch of stuff I wanted to do. Like, I'm really hoping sort of we get past this current kind of COVID scare and we get to back to normal because I'm really looking forward to getting back on the road and sort of meeting with customers. You know, you can meet over Zoom and that's great, but what I've learned over time, you know, I used to go, I'd fly to Wichita, Kansas and actually go sit down with the operators like at their desk and watch how they use my tools. And that actually teaches you like, you come up with things when you see, you know, your product in the hands of your customer that you don't get from like a cab meeting or from a Zoom call, you know. And so being able to visit customers, where they live, where they work and kind of like understand what we can do to make their lives better. Like that's going to, I'm actually really excited to get back to travel. If you could give advice to CTO, CISO or CIO or practitioner out there who's sitting at their virtual desk or their physical desk thinking, okay, the pandemic, we're coming through the pandemic. I want to come out with a growth strategy with a plan that's going to be expansive, not restrictive. The pandemic has shown what works, what doesn't work. So it's going to be some projects that might not get renewed, but there's doubling down certainly with cloud scale. What advice would you give that person when they start to think about, okay, I got to get my architecture right. I got to get my playbooks in place. I got to get my people aligned. What do you see as a best practice for kind of the mindset to actual implementation of data, managing the data? Yeah, and again, this is not an original guard thought. It actually came from one of our customers. You know, I think we all, like you think back to March and April of 2020 as this thing was really getting real, everybody moved as fast as they could to either scale up or scale down operations. If you were in travel and hospitality, you know, that was a, you know, you had to figure out how to scale down quickly and like what you could shut down safely. If you were like in the food delivery business, you had to figure out how you could scale up. Like Chipotle hit two, what is it? Two billion dollar run rate on delivery last year. And so people scrambled as fast as they could to sort of adapt to this new world. And I think we're all coming to the realization that as we sort of exit and get back to some sense of new normal, there's a lot of what we're doing today that's going to persist. Like I think we're going to have like flexible rules. I don't think everybody's going to want to come back into the office. And so I think the thing to do is you think about returning to whatever this new normal looks like is like, what did we learn that was good? And like the pandemic had a silver lining for folks in many ways and it sucked for a lot. Like I'm not saying it was a good thing, but you know, there were things that we did to adapt that I think actually made like the workplace like stronger and better and sort of- It showed that data's important, internet's important, didn't break, internet didn't break. Zoom was amazing and teleconferencing with other tools. But that's kind of just to sort of like, what did you learn over the last 18 months that you're going to take forward into the next 18 years? You know what I mean? Because there was a lot of good and I think people were creative and they figured out like how to adapt super quickly and take the best of the pandemic and turn it into like a better place to work. Hybrid events, hybrid workforce, hybrid workflows. What's your vision on Splunk as a tier one enterprise? Because a lot of the news that I'm seeing that's the tell sign to me in terms of this next growth wave is big S ideals, Accenture and others are yours working with. And you still got the other partner verse going, you know, the ecosystems emerging. That's a good, that means your products enabling people to make money, right? So that's a good thing. Yeah, Blue Voyant was a great example in the keynote yesterday and they've really, they've kind of figured out how most of their customers, they serve customers in heavily regulated industries kind of and those customers actually want their data in a Splunk tenant that they own and control and they want to have that secure boundary around that but Blue Voyant's figured out how they can come in and say, hey, I'm going to take care of the heavy lifting of the day to day operations, the monitoring of that environment with the security. So Blue Voyant has done a great job sort of pivoting and figuring out how they can add value to customers and do, you know, because they're managing not just one Splunk instance but they're managing hundreds of Splunk cloud instances. And so they've got best practices and automation that they can apply across their entire client base. And I think you're going to see a lot more of that. And Teresa's just, Teresa is just, she loves partners. Absolutely loves partners and that was just obvious. You could hear it in her voice, you could see it in her body language, you know, when she talked about partners. So I think you'll see us start to really get a lot more serious because as big as Splunk is, like our pro-servant support teams are not going to scale for the next 10,000, 100,000 Splunk customers and we really need to like really think about how we use partners. There's a real growth wave and I love the multiple ways and parallel because I think that's what everyone's consensus on. So I have to ask you as a final question, what's your takeaway? Obviously there's been a virtual studio here where all the Splunk executives and customers and partners are here, the cubes here, doing all the presentations live by the way, it was awesome. What would you say the takeaway is for this.com, for the people watching and consuming all the content online, a lot of asynchronous consumption going to be happening. Sure. What's your takeaway from this year's Splunk.com? You know, it's hard because you get so close to it and we've rehearsed this thing so many times. The feedback that I got, and if you look at Twitter and you look at my Slack and everything else, this felt like a comp that was like kind of like a really genuine, almost like a Splunk 2.0, but it's sort of true to the roots of what Splunk was, true to the product reality. I mean, I was really careful with my team to avoid any whiff of vaporware. Like what we wanted to show was like, look, this is Splunk, we're acquiring companies, 43 major releases, hundreds of small ones, like we're continuing to innovate on your behalf as fast as we can. And hopefully this is the last virtual comp, but even when we go back, like there was so much good about the way we did this this week, that when we broke yesterday on the keynote and we were sitting around with the crew and kind of looking at that stage and everything, we were like, wow, there is a lot of this that we want to bring to an in-person event as well. Because so for those that want to travel and come sit in the room with us, we're super excited to do that as soon as we can. But then, you know, there may be 25, 50, 100,000 that don't want to travel, but can access us via this in-person virtual. It's a moment in time that becomes a timeless moment. That could be an- Did you link that up right now? That could be an NFT. We could make a little crypto currency. Garth, great to see you. Of course, I made it up right then. So great to see you. Airbump, airbump? Okay, good. Okay, Garth Ford, senior vice president, chief product officer in theCUBE here. We're live on site at Splunk Studio for the .com virtual event. I'm John Furrier. Thanks for watching. All right, thank you guys.