 Live from Orlando, Florida, it's theCUBE, covering .conf18, brought to you by Splunk. Welcome back to Orlando, everybody, splunk.conf18. This is theCUBE, the leader in live tech coverage. I'm Dave Vellante with my co-host, Stu Miniman. Carnival Cruise Lines is back. We heard from them yesterday. We heard them on the main stage of .conf. CEO was up there with Doug Merritt. Sheldon White is here. He's the enterprise architect at Carnival Cruise Line. And Alex Tiberis, who's the director of threat intelligence at Carnival. Gents, welcome to theCUBE. Thank you. Doing a lot of talk on security today. They've lined us up, which is great. We love the conversation, so much to learn. Alex, I'll start with you. When you think about security and threat intelligence, what are the big changes that you've seen over the last, whatever, pick a time, half a decade, decade, couple of years even? So it's just the amount of threats that are coming in now and how fast they're coming in. We can't seem to be keeping up with everything that's happening in the environment, everything that's happening outside, trying to get into our environment and cause all that damage, right? So that's why Splunk is awesome. I get to see everything come in real time. I'm able to quickly pinpoint any action I need to take, send it to my team and have them remediate right away. So Sheldon, yesterday we had ship and shore from Carnival and it was talking about really different problems. The folks on the ship, you got 250,000 people on the ocean at any one point in time, collecting data, trying to make a better experience, trying to keep them connected, folks on the shore, obviously websites and things like that. Where do you fit into that mix of ship and shore? Right, so there's an entire value stream that we map out as enterprise architects. And so what we do there is we analyze all the customer touch points and then we aggregate all of that information into a pipeline that we then address our audiences with those critical KPIs, operational and infrastructure, the entire stack. You guys obviously have a very strong relationship with Splunk, we heard from your CEO, Arnold Donald, right? Correct. Interesting name, I haven't messed that up yet. And so where did that relationship start? Did it start in SecOps? Did it start in IT operations management? So it really started in DevOps, right? And they started, they purchased Splunk, I think back in like 2007, 2008, and they started looking at it, right? And I think I was talking to one of our other architects and it was one gig is what we started at, right? Now we're upwards of 600 gigs just for security. So it started there and it just kind of morphed into this huge relationship where we're partnering and touching all aspects of our business with Splunk and the cloud and everything else. So we heard, I don't know if you guys saw the keynote today, but we saw some announcements building on yesterday's Splunk Next announcement. We heard some business workflow and some industrial IoT. I would think both of those are relevant for you guys, not industrial IoT, but your IoT. Do you see Splunk permeating further into the organization? I guess the answer is yes, you've kind of already said that, but I'm interested in what role you guys play in facilitating that. Are you kind of champions, evangelists, experts, consultants, how does that work? How do you see that shaking? So we see ourselves as internal consultants. We have our internal customers that depend on our guidance and our end to end view of the business processes. So, and now as we enter our cloud journey into the second year of our cloud journey, just we're able to accelerate that time to value for our internal customers to gain even greater insights into what's happening ship and shore. I wonder how, if you could talk about how enterprise architecture has changed over the last decade even. You know, it used to be you were trying to harden a two-tier or three-tier architecture and harden top, don't touch it, it works. And then of course we all know it's created a lot of different stovepipes and a lot of data was locked into those stovepipes. That's changed obviously, cloud, now the edge. Maybe because you guys were always sort of a distributed data company, you approached it differently, but I wonder if you could give us a second. No, that's an interesting question because the evolution is not so much enterprise architect as it is ecosystem architect, right? So now you have these massively distributed systems. So you're really managing an ecosystem of internal and third party and then all the relevant touch points, right? Like Alex mentioned, all that perimeter is constantly shifting now. So yeah, our focus is always aligning with the end-to-end business process and our internal customers. Yeah, I wonder if we could dig into the cloud a little, Alex, if we start with you, how does cloud fit into your world of security? So for me, the cloud as far as Splunk goes, it allows me to expand and contract as needed, right? So before we used to have our on-premise hardware, very finite RAM memory, I mean, this space, everything. So now with the cloud, I'm able to expand my environment as I move across all my North American brands, European brands to be able to gather all that data, look at it and take action on it, right? And Sheldon, you're using AWS. We see there are, you know, every software provider really lives in AWS. It's often in the marketplace. We've been seeing a lot this week that there's, you know, a deeper partnership. There's actually a lot of integration. Maybe give us your viewpoint of what you've seen of how Splunk and AWS work together to meet your requirements. Yeah, so that's an interesting evolution as well of that partnership, right? So you're starting to see things like these S3 API integration so that you're removing storage from the critical path. And now that opens up a different scale of possibilities, right? And internal opportunities. But yes, as you can see, leveraging the machine learning toolkit, I saw that one coming. It's going to be interesting to see how that keeps evolving, right? And also, like I was speaking to Alex about the natural language capability. So that also as well broadens the dimension of how our senior leadership will interact with these operational platforms. Yeah, I got to think, you're going to have your customers natural language has to get into some of their rooms. It's going to be part of that value chain. Yeah, for sure. How does the S3 API integration affect you guys? Obviously, you got to get put syntax in an object store, which is going to scale. What does that mean for you guys? So using this Splunk developer cloud, we can develop all sorts of solutions to manage intelligently our storage, right? In near real time, right? So we can completely automate and that end-to-end just integration with Splunk, how it ingests, how long that data stays relevant, and how we offload it into things like Glacier. And the enablement there is the S3 API, so you're taking advantage of the AWS automation tooling? Is that right? Correct. Another example of that tight integration, not only with the S3 API, Lex for the natural language, and obviously TensorFlow and the machine learning toolkit. So I think you're going to see that type of capabilities expanding as Splunk evolves. Next year, I'm sure they're going to have a ton of more announcements around how this evolution continues, right? So I was interested in the TensorFlow and Spark integration, and Stu and I were talking in an earlier segment. It's great, developers love that. We saw a lot of demos today that looked so simple that anybody could do it. Even I might be able to do it. But as practitioners of Splunk, is it really going to be that easy? Are business users actually going to be able to pick this stuff up, and what are they going to have to do in order to take advantage of Splunk, of some training involved? What's the learning curve going to be like? No, that's a great question, because there's a dual focus to this, right? First is offloading from the developer, all that heavy lifting of creating this user interface and the dashboards per se. Now it's all API driven. So as you saw maybe in the keynote this morning, that within the demo, was an API driven dashboard came together in several minutes. But one is offloading that, and the second part is just enabling the business user with other capabilities like natural language processing. They don't necessarily need to be on that screen. They can get exception reporting through emails and voice commands. So training is also part of it, obviously, but so it's a multifaceted approach to leveraging these new capabilities. Are you guys responsible for the physical infrastructure of your ships? I mean, is that part of your purview? Okay, so really it is. There's an industrial IoT component, it's a big time for you guys. And there's a huge push now for maritime security, right? We saw what happened with MERSC and the Napatea virus, right? So how it took them out of operation for about three weeks. So this IoT is very, I think, awesome, right? I was speaking to some of the Splunk guys yesterday about it, how we can leverage that on our ships to gather that data from our SCADA systems and from our bridge and engine control systems to be able to view any kind of threat, any kind of vulnerability that we might be seeing in the environment, how we can control that and how we can predict anything from happening, right? So that's going to be very, very key to us. So Splunk is going to take that data right off the machines, which Stu and I were talking about. That to us is a huge advantage. So many IT companies are coming in and say, hey, we're going to put a box at the edge. That's nice, but what about the data? So Splunk's starting with the data, but the standards of that data, they're really driven by engineers and operations technology folks. Is Splunk sort of standard agnostic? Can they be able to ingest that data? What has to be done for you guys to take advantage of that? So we'll have to ingest that data and we'll have to look at it and see what we're seeing, right? This is all brand new to us as well, right? This whole maritime thing has risen up in the past year, year and a half. So we're going to have to look at the data and then kind of figure out what we want to see, normalize it and we'll probably get some PS services or something to assist us, some experts and then we just go from there, right? We build our dashboards and our reports. And predictive maintenance is a huge use case for you guys. I mean, to me, it's as important as airlines. Absolutely, yes. So I would think any time you, well, first of all, real time during a journey, but any time that journey is completed, you must bring in the inspectors and I'm sure very time consuming and precise. So I know that some of our senior leadership, especially in the maritime space, has now looking towards Splunk to do some of that predictive maintenance to make sure that we have the right nuts and bolts, right? Per se, on the ship to be able to fix any issue that might arise at sea while we're on there. I would suspect that the drive is going to be for human augmentation and if drive efficiency, correct. You're not just going to trust the machines right out of the box in no way, right? But it's empowering those engineers, right? As we see with some of the dashboards that they're coming up with at the keynote. Empowering some of those engineers that are in the engine room, that are in the bridge to be able to see those issues come up, right, and be able to track. Plus, I would imagine this is the kind of thing like an airline pilot, you're double checking, you're triple checking, so you might catch, you know, misses earlier on in the cycle. Yeah. I can see it having huge impacts. Yeah, Sheldon, I was just, you know, thinking through the other next announcements. I wonder if Splunk business flows, it sounds like something that might fit into your data pipeline, get insights, understand satisfaction, seems like it might be a fit. Is that of interest to you? Yeah, it sure is, because we definitely want to, since we've evolved with kind of fragmented different systems, we still have mainframe, we still have a whole call center environment that we need to ensure that it's part to the end-to-end guest experience. So for sure, we're getting into the early adopter program on the process flow. Yeah, Karna, can you give us a little insight? What kind of back and forth do you have with Splunk? What sort of things are you asking that would help make your jobs easier going forward? So going forward, I mean, I know they're addressing a lot of the ingestion and data standardization, and now with the decoupling of the storage, which is awesome, makes our lives a lot easier. But the evolution of the natural language and the integration with AWS natively is huge for us as well as our cloud program matures, and we start enabling serverless architectures, for example, so yeah, no, it's a very important part. Yeah, I mean, serverless is actually something we're pretty interested in. What are some of the early places that you're finding value there? Well, many people don't know this, but Karna was also one of the largest travel agencies in the United States, so we have a whole, well, it's a global air travel platform that we're currently migrating to a serverless architecture, integrates with Saber, and so we're looking at things like open trace for that, and I know that our folks, our friends at Splunk are enabling capabilities for that type of management. And what's the business impact of serverless there? You just better utilization of resources, faster time to value, maybe you could describe it. Yeah, near real time processing, scaling up and scaling down seasonally are key aspects of that, removing the constraints of CPU and storage. Alex, has it changed the security paradigm at all serverless? How does it change it? So it does, it lets me not have to worry so much about on-premise stuff, as I did before, so that helps a lot, right? And being able to scale up and down quickly as much data as we're ingesting is very key for us. You guys are heavy into cloud, it's obvious. I wonder if you can share with us how you decide kind of what goes, if you're not all in on cloud, right? It's not 100% cloud. No, we can never be all in on cloud. And we've put forth that notion for years. We call it true private cloud. That what you want to do is bring the cloud experience to your data wherever that data lives. There's certain data that in workloads you're just not going to put into the cloud. That's correct. So you would confirm that, that's the case. Like you just said it. Correct. You're never going to put some of these workloads. Well, we have floating data centers, so I mean we'll always be in a hybrid model, but there is a decision framework around how we create those application migration pipelines and the complexity and interdependencies between these platforms. Some are easier to move than others. So yeah, we're quite aware of it. And so my follow-up question is, are you trying to bring that cloud experience to those sort of floating data centers wherever possible? And how is the industry doing? If you had to grade them in terms of their success, I mean you certainly hear this from the big tech suppliers is, oh yes, we've got private cloud and it's just like the public cloud and we know it's not. And it doesn't have to be. But if it can substantially mimic that public cloud experience that's a win for you guys. So how is the industry doing in your view? So I think it's a crawl, walk, run type of thing. Obviously you have these floating cities and the satellite bandwidth is a precious resource that we have to use wisely, right? So we definitely, our edge computing strategy is evolving rapidly. What do we act upon at the edge? What do we send to the cloud? When do we send it? There are also some business drivers behind this, for example, one of our early cloud forays was in replicating a guest activity on board the ship so we know if somebody buys a Margarita off the coast of Australia, we know it in five seconds later and then we can act upon that data casino or whatever data it may be in near real time. So a lot of data stays at the floating data center, obviously, much of it comes back to the cloud. When it comes back to the cloud is a decision because of the expense of the bandwidth. What do you do? You park the ship at the data center and put a big fire hose in there. I wish it was that easy. Yeah, right, you got a bunch of disk drives that you just take and load up. That's got to be a big challenge. So there are business requirements, right? So we have to figure out what application is more important, right? So usually you're like our ship property management system, right? Where we have all our guest data, as far as their names, birth dates, all that stuff. That takes priority over a lot of other things, right? So we have to use, like Sheldon said, that bandwidth wisely because we don't really own a lot of the ports that we go into, so we can't just, like you say, plug in a cable and move on, right? We still rely heavily on our satellites. So bandwidth is our number one constraint and we have to, you know, we share it with our revenue generating guests as well. So obviously they take priority and a lot of factors go into that. Data's not shrinking. So I'll give you guys the last word if you could just sort of summarize in your view some of the big challenges that you're doing to try to apply Splunk towards solving in the next, you know, near to midterm. Well, I get, I'm more security focused. So for me, it's just making sure that I can get that data as fast as possible. I know that I saw yesterday the keynote, the mobile app. That for me is going to be like one of the things I'm going to go like research right away, right? Cause I, for me, it's getting that alert right away when something's going on so that I can mitigate quickly, move fast and stop those threats from hitting our environment. Sheldon? Yeah, so I think the challenges are, like you mentioned earlier about the stove pipes and how organizations evolve now with this massive influx of data. It's just making sense of it from a people technology and processes standpoint so that we can have managed the chaos, so to speak, and make sure that we have an orderly end to end view of all the activity on the ships. Well, thank you guys. Stu and I like kids in the candy shop because we talked to so many customers this week so we really appreciate your time and your insights and inspiration for your peers. So thank you for coming on theCUBE. Thank you for having us. You're welcome. All right, keep it right there. Everybody, Stu and I will be back right after this short break. You're watching theCUBE live from .conf18. Right back.