 Live from Las Vegas, it's theCUBE. Covering Splunk.conf 19 brought to you by Splunk. Okay, welcome back everyone. This is day three live CUBE coverage here in Las Vegas for Splunks.conf. It's 10 years anniversary of their big customer event. I'm John Furrier theCUBE. This is our seventh year covering riding the wave with Splunk from scrappy startup to going public company, massive growth. Now a market leader continuing to innovate. We're here to see you, Doug Merritt of Splunk. Thanks for joining me. Good to see you. Thank you for being here. Thanks for having me. How you feeling? Exhausted and energized simultaneously. It was a fun week. Every year when we have the event we discuss Splunk's success and the loyalty of the customer base, the innovation you guys are providing, the value, got a lot of happy customers and get a great ecosystem and partner network growing. You're now growing even further. Every year it just gets better. This year has been a lot of big highlights. New branding. So you got that next level thing going on. New platform, tweaks bringing this cohesive thing. What's your highlights this year? I mean, what's the big, there's so much going on. What's your highlights? So where you started is always my highlight of the show is being able to spend time with customers. I've never been at a company where I feel so fortunate to have the passion and the dedication and the enthusiasm and the gratitude of customers as we have here. And so that, I tell everyone at Splunk like this is similar to a holiday function for a kid for me where the energy keeps me going all year long. So that always is number one. And then around the customers, what we've been doing with the technology architecture, the platform and the depth and breadth of what we've been working on honestly for four plus years. It really I think has come together in a unique way at this show. Last year you had a lot of announcements that were intentional announcements like it's coming. They're coming now, they're here, they're shipping. What are some of the feedback you're hearing because a lot of it has a theme where, we kind of pointed this out a couple of years ago, it's like a security show now, but it's not a security show, but there's a lot of security in there. What are some of the key things that have come out of the oven that people should know about that we're long that are being delivered here? So the core of what we're trying to communicate with data to everything is that you need a very multifaceted data platform to be able to handle the huge variety of data that we're all dealing with. And Splunk has been known and been very successful at being able to index data, messy, non-structured data and make sense of it even though it's not structured in the index and that still is incredibly valuable. But we started almost four years ago on a journey of adding in stream processing before the data gets anywhere to our index or anywhere else. It's moving all around the world. How do you actually find that data and then begin to take advantage of it in flight? And we announced that the beta of data stream processor last week, last year, but went production this year, four years of development, a ton of patents, a 40 plus person, 50 plus person development team behind that, a lot of hard engineering and really elegant interface to get that there. And then on the other end to compliment the index, data is landing all over the place, not just in our index, and we are very aware that different structures exist for different needs. A data warehouse has different properties in relational database, which has different properties than a NoSQL column store and memory database and data is going to only continue to be more dispersed. So again, four plus years ago, we started on what now is data fabric search, which we pre-announced in beta format last year. That went production at this show, but the ability to address a distributed Splunk landscape, but more importantly, we demoed the integration with HDFS and S3 landscapes as the proof point of we've built a connector framework so that this really cannot just be a incredibly high speed, high cardinality search processing engine, but it really is a federated search engine as well. So now we can operate on data in the stream when it's in motion. We obviously still have all the great properties of the Splunk index, and I was really excited about Splunk 8.0 and all the features in that, and we can go get data wherever it lives across a distributed Splunk environment, but increasingly across the more and more distributed data environment. This is a data platform. This is absolutely a data platform, so that's very clear. So the success of platforms in the enterprise, at least not just small, immune-sized business, which you can have a tool and kind of look like a platform. There's some apps out there that I would point to and say, hey, that looks like a tool that's really not a platform. You guys are a platform. But the success of a platform are two things. Ecosystem and apps. Because if you're in a platform that's enabling value, you got to have those. Talk about how you see the ecosystem success and the app success. Is that happening in your view? It is happening. We have over 2,000 apps on our Splunk base framework, which is where any of our customers can go and download the application to help draw value of a Palo Alto firewall or ensure integration with a service and now a trouble-ticketing system and thousands of other examples that exist. And that has grown from less than 300 apps when I got here five and six years ago to over 2,000 today. But that is still the earliest inning, for earliest pitch and the earliest inning journey. Why aren't there 20,000, 200,000, 2 million apps out there? A piece of it is we have had to up the game on how you interface with the platform. And for us, that means through a stable set of services, well-mannered, well-articulated, consistently maintained services. And that's been a huge push with the core Splunk index, but it's also a big amount of work we've been doing on everything from the separation between phantom runbooks and playbooks with the underlying orchestration automation. It's a key component of our stream processor. What transformations are you doing? What enrichments are you doing? That has to live separate than the underlying technology, the Kafka transport mechanism or Kinesis or what happens in the future. So that investment to make sure we got an effective and stable set of services has been key, but then you compliment that with the amazing set of partners are out here and making sure they're educated and enabled on how to take advantage of the platform and then feather in things like the Splunk Ventures announcement, the Innovation Fund and the Social Impact Fund to further double down on, we are here to help in every way. We're going to help with enablement, we're going to help with sell through in marketing and we'll help with investment. Yeah, I think this is smart and I think one of the things I'll point out is that feedback we heard from customers and conferences we had here in theCUBE in the hallway is there's a lot of great feedback on the automation, the machine learning toolkit, which is a good tell sign of the engagement level or how they're dealing with data. And this kind of speaks to data as a value, the value creation from data seems to be the theme. It's not just data for data sake, I mean, managing data is all hard stuff, but value from the data. You mentioned the Ventures, you got a lot of tech for good stuff going on, you're investing in companies where they're standing up, data driven companies to solve world problems, you've got other things. So you guys are adjusting late in the middle endings of the data game, platform update, business model changes, talk about some of the consumption changes again, you got Splunk Cloud, what's going on, how you charge, how our customer is consuming, what moves did you guys make there and what's the result? Yeah, it's a great intro on data is awesome but we all have data to get to decisions first and action second, without an action there is no point in gathering data and so many companies have been working their tails off to digitize their landscapes. Why, well you want a more flexible landscape but why the flexibility because there's so much data being generated that if you can get effective decisions and then actions that landscape can adapt very, very rapidly, which goes back to machine learning and eventual AI type opportunities set. So that is absolutely squarely where we've been focused is translating that data into value and into actual outcomes, which is why our orchestration automation piece is so important. One of the gating factors that we felt has existed is for this Splunk index, and it's only for this Splunk index, the pricing mechanism has been data volume and that's a little bit contrary to the promise, which is you don't know where the values could be within data and whether it's a gigabyte or whether it's a petabyte, why shouldn't you be able to put whatever data you want in to experiment so we can have some updates in pricing a month and change ago that we were reiterating at the show and will continue to drive on a hopefully very aggressive and clear marketing and communications framework that for people that have adjusted to the data volume metric we're trying to make that much simpler. There's now a limited set of bands or tiers from 100 gigs to unlimited so that you really get visibility on, all right. I think that I want to play with five terabytes. I know what that band looks like and it's very liberal so that if you wind up with six and a half terabytes you won't be penalized and then there's a complementary metric which I think is ultimately going to be the more long-lived metric for our infrastructurally bound products which is virtual CPU or virtual core and when I think about our index, stream processing, federated search, the execution of automation, all those are basically a factor of how much infrastructure you're going to throw at the problem, whether it's CPU or whether it's storage or network so I can see a day when Splunk Enterprise, the index and everything else at that lower level or at that infrastructure layer are all just a series of virtual CPUs or virtual cores but I think both that we're offering choice. We really are customer centric and whether you want a more liberal data volume or whether you want to switch to an infrastructure, we're there and our job is to help you understand the value translation on both of those because all that matters is turning it into action and into doing. It's interesting in the news yesterday, Quantum Supremacy was announced, Google claims and IBM's debating it but Quantum computing just points to the trend that more compute's coming so this is going to be a good thing for data. You mentioned the pricing thing, this brings up a topic we've been hearing all week on theCUBE is diverse data is actually great for machine learning, great for AI so bringing in diverse data gives you more aperture into data and that actually helps. With the diversity comes confusion, this is where the pricing seems to hit. You're trying to create, if I get this right, pricing that matches the needs of the diverse use of data, is that kind of how you guys think about it? Meets a need to diverse data and also provides a lot of clarity for people on when you get to a certain threshold that we stop charging it all together. Once you get above tens of terabytes to 100 terabytes, just put as much data in as you want. The foundation of Splunk going back to diverse data is we're the only technology that still exists on the index side that takes raw, non-formatted data, doesn't force you to cleanse or scrub it in any way and then takes all that raw data and actually provides value through the way we interact with the data through our query language. And that design architecture, I've set it for five, six years now is completely unique in the industry. Everybody else thinks you've got to get to the data you want to operate on and then put it somewhere and the way that life works is much more organic and emergent. You've got chaos happening and then how do you find patterns and value of that chaos? Well, that chaos winds up being pretty voluminous. So how do we help organizations like some of the leading organizations that are at five to 10 petabytes of data per day going through the index, how do we help everybody get there? Because you don't know the nugget across that petabyte or 10 petabytes that is going to be the key to solving a critical issue. So let's make it easy for you to put that data into find those nuggets. But then once you know what the pattern is, now you're in a different world. Now you're in the structured data world of metrics or KPIs or events or multi-dimensional data that is much more curated and by nature that's going to be more fine grained. There's not as much volume there as there is in the raw data. Doug, I notice also at the event here is a focus on verticals. Can you comment on the strategy there? Is that by design? Is there a vertical focus? Definitely by design. Share some insight into that. We launched with an IT operations focus. We wound up progressing over the years to a security operations focus and then are doubling down with omniscience, signal effects, VictorOps, and now Streamlio is a new acquisition on the DevOps and Next Gen AppDev buying centers. As a company in how we go to market and what we are doing with our own solutions, we stay incredibly focused on those three very technical buying centers. But we've also seen that data is data. So the data you're bringing in to solve a security problem can be used to solve a manufacturing problem or a logistics and supply chain problem or a customer sentiment analysis problem. And so how do you make use of that data across those different buying centers? We've set up a verticals group to seed, continue to seed the opportunity within those different verticals. And that's compatible with the horizontally scalable Splunk app platforms. That's kind of why that exists, right? That the overall platform that was in every keynote started with mine is completely agnostic and horizontal. The solutions on top, the security operations ITOps and DevOps are very specific to those users, but they're using the horizontal platform. And then you wind up walking into Accenture booth and seeing how they've taken similar data that the SecOps teams gathered to actually provide insight on effective rail transport for DB cargo or effective cell tower triangulation and capacity for a major Australian cell company or effective manufacturing and logistics supply chain optimization for manufacturer and all their different retail distribution centers. You know, I know you've talked with Jeff Frick and Pat and Stu Miniman and Dave Vellante about user experience. I know that's something that's near and dear to your heart. You guys have been rumored that's going to be some user experience work done on the onboarding for your Splunk cloud and making it easier to get in. Yes. It's just this new Splunk platform. What can we expect on the user experience side? So for any of you out there that want to try, we've got Splunk Investigate. That's one of the first applications on top of the fully decomposed services layered stateless Splunk cloud. Mission Control actually is a complimentary other, those are the first two apps on top of that new framework. And the UI and experience that is in Splunk Investigate, I think is a good example of both the ease of coming to and using the product. There's a very liberal amount of data you get for free just to experiment with Splunk Investigate. But then the onboarding experience of data is I think very elegant. The UI is, I love the UI. It's a Jupyter style workbook type interface. But if you think about what do investigators need? Investigators need both some breadcrumbs on where to start and how to end, but then they also need the ability to bring in anybody that's necessary. So that you can actually swarm and attack a problem very efficiently. So when you go back and look at why do we buy Victrops? It wasn't because we think that the IT alerting space is a massive space we're going to own. It's because collaboration is incredibly important to swarm incidents of any type, whether they're security incidents or manufacturing incidents. So the facilities that Victrops gave on allowing distributed teams and virtual teams to very quickly get to resolution, you're going to find those baked into all products like Mission Control. Because it's one of the key facilities of, that Tim talked about in his keynote of indulgent design, mobility, high collaboration, because luckily people still matter. And while ML is helping all of us be more productive, it isn't taking away the need for us, but how do you get us to cooperate effectively? And so our cloud-based apps, I encourage any of you out there, go try Splunk Investigate. It's a beautiful product and I think you'll be blown away by it. Great success on the product side and a great success on the customer side. You got great loyal customers. But I got to ask you about the next level Splunk. As you look at this event, what jumps out at me is the cohesiveness of the story on the platform and the apps. Ecosystems great, but the new branding. Data to everything. It's not product-specific because you have product leadership. This is a whole next level Splunk. What is the next level Splunk vision? And I love the pink and orange and bold colors. So when I thought about what are the issues that are some of the blockers to Splunk eventually fulfilling the destiny that we could have. Number one is awareness. Who the heck is Splunk? People have a very high varied variance of their understanding of Splunk. Log, aggregation, security tool, IT tool. And what we've seen over and over is it is much more of this data platform. And certainly with the announcements, it's becoming more of this data fabric or platform that can be used for anything. So how do we bring awareness to Splunk? Well, let's come out and help create a category. And it's not up to us to create the category. Except all of you to create the category. But data everything in our minds represents the power of data. And while we will continue internally to focus on those technical buying centers, everything is solvable with data. So we're trying to really reinforce the importance of data and the capabilities that some of the Splunk brings. Cloud becomes a really important message to that because that makes it, executions to that. It makes it so much easier for people to immediately try something and get value. But on-prem will always be important as well because data has gravity, data has risk, data has cost to move. And there are so many use cases where you just never push data to the cloud. And it's not because we don't love cloud. If you have a factory that's producing 100 terabytes an hour in a area where you've got poor bandwidth, like there's no option for a cloud connect there of high scale. So you better be able to process, make sense of and act on that data locally. And you guys are great with the cloud too on-premise. But final word, I want to get your thoughts to end the segment. I know you got to run. Thanks for your time. Congratulations on all your success. Data for good. There's a lot of tech for bad kind of narratives going on. But there's a real resurgence of tech for good. A lot of people, entrepreneurs for profit or nonprofit are doing ventures for good. Data is a real theme. Data for good is something that you have. That's part of the data to everything. Talk about the data for good real quick. Yeah, we were really excited about what we've done with Splunk for good as our nonprofit focused entity. The Splunk pledge, which is a classic one-one-one approach to make sure that we're able to help organizations that need the help do something meaningful within their world. And then the Splunk social impact fund, which is trying to put our money where our mouth is to ensure that if funding and scarcity of funds is an issue of getting two effective outcomes that we can be there to support. At this show, we featured three awesome charities, Conservation International, Net Hope, and the Global Manipulation Network that are all trying to tackle really thorny problems with different dementia, different in different ways, different problems in different ways. But data winds up being at the heart of one of the ways to unlock what they're trying to get done. We're really excited and proud that we're able to actually make meaningful donations to all three of those. But it is a constant theme within Splunk. I think something that all of us from the tech community and non-tech community are going to have to help evangelize is with every invention and with everything that occurs in a world, there's the power to take it and make less noble execution of it. There's always potential harmful activities and then there's the power to actually drive good. And data is one of those. Data can be used as a weapon and can be used negatively, but it also needs to be liberated so that it can be used positively. While we're all concerned about our own privacy and really, really personal data, we're not going to get to the type of healthcare and genetic massive shifts and changes and benefits without having a way to begin to share some of this data. So putting controls around data is going to be important, putting people in the middle of the process to decide what happens their data and some consequences around misuse of data could be important, but continuing to keep a mindset of all good happens as we become more liberal, globalization is good, free flow of good. It's all values in the data. Free flow of people, free flow of data ultimately is very good. Doug, thank you so much for spending the time to come on theCUBE and again, congratulations on great culture. Also, it's worth noting, just to give you a plug here because it's, I think, very valuable. One of the best places to work for women in tech and you guys recently got some recognition on that. That is a huge accomplishment. Congratulations. Thank you, we had a great diversity track here. It's usually important as well. But we love partnering with you guys. Thank you for spending the entire week with us and for helping to continue to evangelize and help people understand what the power of technology and data can do for them. Hey, video is data and we're bringing that data to you here on theCUBE and of course, theCUBE Cloud coming soon. I'm John Furrier here live at Splunk.com with Doug Merritt, the CEO. We'll be back with more coverage after this short break.