 Live from the MGM Grand Convention Center in Las Vegas, Nevada, it's The Cube at Splunk.conf 2014. Brought to you by headline sponsor, Splunk. Here are your hosts, Jeff Kelly and Jeff Frick. Hi, welcome back. Jeff Frick here on The Cube. We're at the Splunk.conf 2014 user conference. The fifth year of the user conference, about 4,000 Splunkers, customers, partners, and people looking to learn a lot more about Splunk are here at the MGM Grand in Las Vegas. I'm here with my co-host, Jeff Kelly. Yeah, I'm Jeff Kelly with Wikibon. And we're joined by Stephen Sorkin, the Chief Strategy Officer at Splunk. Stephen, welcome to The Cube. Thank you for having me today. Absolutely. Thanks for having us here at the show. What's your impression of the show so far? You've been with Splunk quite a long time, so you've been to all these shows, I'm guessing. I have been to all the shows. I've been at Splunk now for almost nine years. And so I've been to every single user conference. And I think that Godfrey mentioned that our first user conference, which was, I believe six years ago, had a hundred and change. I think you said like 175, I think was the number. Something in that range, and it's grown and grown and grown. Last year and the year before, we were at the Cosmo, which is just down the street. And we outbrew the Cosmo, and we felt that last year. And here we have a lot more space, but we're filling it out nicely. It's really exciting to see all the customers and the partners and the partner pavilion and the whole ecosystem that's being built around Splunk and all the different problems that people are solving. So let's jump into that a little bit and talk about the ecosystem, because clearly that's all modern software companies today. You've got to have an ecosystem. You've got to really appeal to the developers. So talk a little bit about kind of where you are in that step and kind of some of the new things you're working on. Well, we've had the idea for quite a while of having contributed content to Splunk. First through Splunk base and more recently through AppStots Splunk, which allows our customers and our partners to contribute content for the benefit of the whole community. And one of my investment items over the next year and over the next few months is to really help jumpstart that and get far more high quality content. So right now we have about 600 apps up on AppStots Splunk.com and in the near future we're going to launch a certification program which is going to enable developers in the community to show that their app is high quality, that it's well supported, that it follows best practices and so that we can take those apps and really bring them to our customers and say these are the apps that will help you get your job done much faster. So how important is it to Splunk's future growth to develop that developer ecosystem versus, you know, Splunk creates their own applications and then you've got your customers creating applications. How important are the customer applications to your strategic growth? The crowdsourcing model appears to be critical to almost every software business now and so for us there are two factors that make it especially important that we have this ecosystem. One is the limited bandwidth we have. There's only so many hours in the day that Splunkers can be working on cool things in the platform and their second is the subject matter expertise. So we have a partner conducive consulting out of Austin and they know the healthcare space really, really well and they've built a HIPAA compliance solution that they're marketing on top of Splunk. That's not something that Splunk as a company would be able to build out the understanding either of the details of the technology, the specifics of the technology or how to take that type of solution to market. So we need partners to help us bring in more data into the system to make available through our premium apps like Splunk for Enterprise Security, Splunk for VMware, Splunk for PCI compliance, Splunk for Microsoft Exchange but also to extend into the long tail of interesting use cases that if you go to the sessions here at the event you see customers talking about but we need to make it reproducible. So who are some of those customers? Are they the big ISPs, the Accentures of the World, Deloitte's Boston Consulting Group? Smaller mom and pop consulting shops, what's the demographic like? I think that there is a mix. So the way that we often think of our technology partners are they're the pure technology partners that are building a device or service like the Amazons of the world or the Cisco's of the world that are contributing to our community to help their customers and our customers understand their technology better but then there's also the third parties who have expertise in a specific technology. As an example we have a partner out in Norway that has built a very popular app for Cisco IOS the operating system that runs their routers and they have detailed knowledge from the services that they deliver to their customers and they understand that by building on top of Splunk they can make their life easier in delivering services and they can establish a reputation for understanding the technology in great depth. So Steven, I wonder if you could talk a little bit about the journey from being really kind of an application-focused company to really supporting a platform and a community to build on that platform. It was funny, Godfrey on their earnings call talked, I think one of the guys asked him you used to never say platform, you were a zealot about never saying platform and you fessed up that it was part of my thing because nobody buys a platform out of the gate, right? You've got to be an application company that solves a specific problem and then over time hopefully you can morph. So talk about you've been here for a while and now you're the strategy guy. Talk about that kind of transformation. Before you're an application company you're most often a tool company so if you rewind eight or nine years Splunk was very much a tool for IT people and we still remain that for many of our customers. We help customers solve fairly generic problems in their complex IT environment. I know that you guys spoke with Eric and Rob a few years ago and I'm sure that they talked about that vision and that journey at first where they wanted to give software to IT people to solve their most urgent problems that the traditional technologies weren't solving. Over the years we realized you can do even more with this underlying technology so let's not call it a platform yet so that's back when we and we will call it a platform by the end of this journey. So as we morph from a tool to the app, when does that kind of take? To the solution so that's when we launch things like Splunk for Enterprise Security which was I believe first called the Enterprise Security Suite which was a collection of many techniques to solve the problems with a dedicated go-to-market strategy where we were able to say to customers specifically this is how you use Splunk for security and we're still doing that. Now it's becoming a platform and the important distinction for a platform is when people start building on top of it and building on top of it in areas that the original platform vendor or us would not have imagined. We wouldn't have imagined New York Air Brake building a solution on top of Splunk for the 18,000 locomotives that they have service contracts on to be able to say here for every given train route here's the driver who's done the best job either by time to destination forces exerted on the train, fuel cost, adherence to the safety regulations so that they're able to provide that guidance to the locomotive operators and save a billion dollars in fuel a year. That's not something that we would have imagined. It's not Rob's vision when he... But that's what a platform does is it gives you the ability to take data and make it useful in many different ways and hopefully there's a killer app in there. But the potential got you and I thought you were even going to go back another step before tools if you don't kind of architect it as a platform even though you're going to deliver a tool or an application it's hard to then move to the platform status because you haven't set the foundation. So did they just do a great job at the beginning? Did you do some major re-architecting along the road? How did that work out? I think it's best to think of technology as fluid. There is not one perfect architecture and over time you take what works and you change it to suit your needs. So back when I started we could bring in data at modem speed. And then over the years... It's a little box for all the young people out there. Exactly. That makes kind of screeching noises. They're like a fax machine. They don't know what that is either. Then over the years we were able to bring in data at maybe DSL speed and now our largest customers are bringing in hundreds and hundreds of terabytes of data a day and making that evolution does require changes to the underlying technology. And so I would argue the counterpoint which is it's important not to worry too much about the perfect architecture upfront. The most important thing is to get something in front of customers as quickly as possible and you see that time and time again in the modern enterprise. So in our keynotes both Coca-Cola and GE Capital discussed how they use Splunk to deliver applications significantly quicker. And that's partly an automation process but it's also a philosophy of getting the bits out and then learning from the bits that come out and then iterating later. So let's talk about kind of future roadmap. So we've talked to a number of your customers on the queue over the last couple days that have talked about all the value that Splunk's delivering and we've kind of asked them to kind of compare it to the old EW BI world. And Godfrey kind of put up that slide yesterday in the keynote showing the old architecture in the EW world versus kind of the new architecture with Splunk at the center. Splunk I've noticed you're careful not to position yourself as competitors to that BI space yet we're hearing from customers that they see it moving in that direction. How do you look at that and do you feel like you're crossing over into that more mainstream BI space? I mean clearly you have bigger ambitions than just log data analysis. I mean analytics everywhere was a term we heard Banshee about yesterday. How do you view your relationship to those more traditional tools? I think the important thing is to realize the essential difference in the type of data that those tools are ideally suited for. They work best with structured data that fits well in a relational database and I don't see us replacing those technologies for that type of data. On the other hand the world has changed in terms of where data comes from and the agility of the enterprise and of small companies. So when you look at the type of data that comes out of devices, that comes out of modern services, that comes out of mobile, that comes out of web scale offerings, that data does not fit well in the traditional model. The traditional model requires that you choose upfront what you're going to collect, how you're going to collect it, how you're going to store it, how you're going to structure it so that you can run some typically finite set of queries and families of queries. On the other hand our philosophy is collect all of this data that just doesn't fit in those other technologies and make it available to everyone in the enterprise. So absolutely we're going to take the data and make it relevant across the business whether it's in the IT organization to optimize their operations, whether it's to the security organization to make sure that systems are safe and secure and you see in the news how important this is again and again and again and I do not foresee this stopping anytime in the near future. And then what's really fun and what's really exciting for us is when you take the same underlying data that you used for the operational questions. It's operational, machine generated data, text with timestamps and apply it to a business problem like you saw with our customer Domino's Pizza where the initial use case for Splunk was to keep the IT lights on and the systems running because that's their biggest cash register. But their IT folks realized that they knew about the success of marketing campaigns before the marketing folks did, before the data landed in the enterprise data warehouse. They delivered the reporting to their marketing colleagues who realized this is a gold mine for understanding our business and optimizing our business in real time. Well what's interesting is maybe the way to frame it is not that Splunk is starting to cross over into the traditionally DWBI world but that those players are trying to cross over into this world. You're seeing companies like Teradata through partnerships with companies like Hortonworks and their acquisition of Think Big Analytics trying to get into this Hadoop space to be able to run analytics on all this unstructured data. Absolutely. I think they see where the future is and they're trying to get there and they've got the classic innovators dilemma around their cash cow is the traditional world and they know but they know they're on the wrong side of history. They don't want to compromise it. And what's important in Godfrey's slide and what we truly believe and I'm sure that Todd said it earlier today is search is the dominant paradigm for this type of data. When you look at a SQL statement and the expressiveness of SQL, sure you can do it but it's very difficult and with SQL it's natural to look at one table, maybe a handful of tables if you know how to join them. But in real life in the world people do not know how to combine these types of data up front and you need to use a much more flexible paradigm for retrieving the data and pulling the data from all the different sources that are relevant to making the decision and then putting it together. The search paradigm is one obviously that people understand. Google has made that ubiquitous. Absolutely. So we're running out of time but I did want to ask you about, again speaking of innovation, you know, Splunk being a public company now. So you've got pressure coming to you from shareholders of course. Absolutely. So you need to satisfy Wall Street but you've also got to reinvest in the company to continue to be innovative. How do you balance that as the Chief Strategy Officer? How do you look at that challenge? We're a technology company. It is not an option not to reinvest in innovation and we continue to grow our product development and other research and development groups within the company at a very healthy rate. It's certainly higher than most other companies that are public and so eventually we're going to have to leapfrog ourselves and there are going to be new paradigms that we're going to introduce for interacting with the type of data that our customers have in the system. It's going to be a very exciting few years ahead of us. So Stephen, we're getting the hook here. We're short on time. So I'm going to give you the last word. You've been coming to these things now for five or six years. What's the bumper sticker that people should drive away with Splunk.coff 2014? It's the best way to learn about how to accelerate your Splunk deployment. There you go. Learn everything. So thank you very much for coming on. It's my pleasure, Jeff and Jeff. Chief Strategy Officer for Splunk. He's been Chief Strategy Officer for a couple of years, but he's been at Splunk for nine years, which shows that he's excited. He gets up in the morning and these are great and exciting times to get after new challenges. So I'm Jeff Frick with Jeff Kelly. You're watching theCUBE. WordSplunk.com will be back with our next guest after this short break.