 Okay, we're back here live inside theCUBE. We're live in Las Vegas, this is the Splunk conference, dot-conference 2013, this is theCUBE, our flagship program, we go out to the events and track the ceiling from the noise. Day one of two days of live coverage, Splunk, where they're spinning data exhaust into gold, as we said earlier. I'm John Furrier, the founder, I'm joined by Dave Vellante, wikibon.org. Nathaniel Collinsworth here, technical manager, media operator, and news star. Talking big data, you're in an area where you have a lot of data, talking big data, you're in an area of news star, a very diverse company that does ultraviolet, which is the, I don't want to say digital rights, but basically you're managing assets, a lot of big data, a lot of IT. Welcome to theCUBE. Thank you. So, obviously, let's talk about the operation, explain to the folks out there what ultraviolet is and why you're here relative to the Splunk situation. So ultraviolet is a centralized library platform. The idea is that we can disconnect your assets, the movies that you've purchased, from the retailer. Historically, if you buy something from Apple, you're locked to Apple. And if you buy something from Amazon, you're locked to Amazon. The goal long term is to get all of the retailers into ultraviolet so that if you buy an asset, it stays in your ultraviolet locker and you can take that wherever you want. So I'll get a song on iTunes theory with ultraviolet. I can go on my Android device and use it there and vice versa. That'll never happen in the short term. But in theory, portability of media and assets requires some encryption, some security, all kinds of magic juju as Dave would say or voodoo right under the table. A lot of technology, compliance, tracking, security, to get that kind of right over simplifying the challenges. So that's the basic idea though, right? What John just described. That is the basic idea. And for the retailers that we have on board, that's exactly how it works. You can buy assets with voodoo. You can buy assets with Flixter. And then you can use whichever tool that you want. You can use voodoo's app. You can use Flixter's app. If you like the way one of the retailers looks and you like their experience, then you can watch all of your assets there regardless of where you've bought them. So talk about why Splunk. Because this must be an IT nightmare to track all this because you're retailers. They're buying things. They're clearing from studios who have protected the asset of the content, which everyone cares about. They want to open it up, but you know, the business model of iTunes has proven that goods online can be sold and make money. So what's the challenges on the IT side and why Splunk? Well, like you said, you've got these monolithic studios that are all trying to protect $100 million assets. And then on the other side, you've got the retailers who are all worried about PCI compliance, and then we're in the middle. And so we're brokering communication transactions, B2B, to both ends. And so we get requirements from both ends. And so we have wire level encryption on everything. You can't throw a TCP dump out there. You can't see what's going on. So it's incredibly important that we have something that can ingest logs and give us some operational visibility into what's going on. On top of which, you know, we protect the content with DRM, right? For years, we've been hearing about digital rights management, right? Well, because Ultraviolet was designed to be ubiquitous to support all the platforms and support all the retailers, we have four DRMs on the platform, which is something nobody's done before. So we support DRMs for a variety of different devices. We've got more DRMs rolling out in 2014. So it's a lot of data that has to come in. It's a lot of troubleshooting. And it's just a lot of work. And the tracking is, so Splunk basically surfaces and allows you to ingest all that metadata for what, compliance reasons, reporting, all the above? Actually, for everything. It's funny that Splunk sort of grew up in Newstar with Ultraviolet. About the time we started Dev on Ultraviolet, we were looking at this test bed three years ago. Somebody had set up a small Splunk instance and said, hey, why don't you use this? And so we started using it. We put everything into it. It's a heroin strategy. Get them all addicted. Exactly. And it was very successful because as the platform got bigger, as it got more complicated, and as we got more and more transactions, we got more and more use out of Splunk. Because we'd put everything into it from day one, we found that there wasn't a problem that we had that we couldn't go to Splunk to solve. We have everything that we need, sort of in the magic oracle. You just got to go spend 20 minutes, you know, bowing to the oracle so that it'll give you your answer. But in general, that was that easy. Just comes in, you plug it in, kind of grows on value. People were pretty happy with it. Oh, very, very happy. In fact, you know, Ultraviolet has gone through in the last three years, three major scaling efforts where as Splunk has only scaled once. It's been earlier this year, which is what I'm speaking about on Thursday, was our transition from going from a single instance Splunk to a distributed array of Splunk servers so that we can index all the volume of data that we have now. Oh, go ahead. Please finish up. No, I was just going to say that the fact that we had to put, you know, several hundreds of thousands of dollars into hardware and to Ultraviolet before we ever had to scale Splunk, I think it's very impressive. Splunk did a great job. Now, your role is to keep Ultraviolet up and running and make it perform, right? So that's, you were saying off camera that you're really focused on the IT operation side of things, right? Yes. Yet at the same time, the driver is the monetization of the analytics, right? So you hear a lot about that these days. We're going to monetize big data. It's the new source of competitive advantage. We're going to build data lakes. Data is the new oil. All these bromides that we throw out here in the cube. But I'm wondering from a standpoint of an IT practitioner, how much of that do you feel is changing your role versus, you know, it's another use case. It's another application, you know, technology people process. Bring it on and, you know, we'll adjust. Well, so I find as platforms are getting more and more complex, you know, you tie in mobile, right? So for Ultraviolet, we've got experiences on mobile devices. We've got experiences on desktops. And we've got all of the back-end security APIs, right? When you tie all of that together, it becomes incredibly complicated, right? And so when you have issues, before it was people process, keep it running, right? Well, now it's not always that simple. It's people process, okay, part of it's broken. We're not exactly sure. Or it's broken, but it's going to take, you know, two dev cycles to get it fixed, right? There can be idiosyncrasies. It's not just up or down. And so when you have idiosyncrasies, the question is how does that impact the bottom line, right? Okay, I have a problem. Is this affecting retail sales? If it's not, well, maybe it's okay for it to take three weeks to fix. If it is, then you better drop everything and fix it now. Okay, so it's not binary. You've got this, you know, this gradation. So how was the decision made? Do you guys make that call? Do you make that call with the business? Does the business make the call? Studios make that call. Yes, UltraViolet is actually funded by a consortium that was put together by the studios. And so anytime I have a call at two in the morning, the consortium's on the call with me. So yes, there's a large number of people that get to help make that call. And that's part of the point with Splunk, is that I can provide them the data that's necessary to make that call. So talk about, take us back to when you brought Splunk in. What was life like before that? Were you able to? Well, fortunately, like I said earlier, because Splunk was there when we started development on UltraViolet, there was no Splunk before UltraViolet. It's not like we made a decision to say, okay, let's port everything to Splunk because this is better. The better question for UltraViolet is, why are we still on Splunk? Yeah, so why Splunk? Yeah, well, exactly. You've got some alternatives. You've got this open source stuff coming in. Why Splunk now? First is scaling. We have an incredible amount of logs. Because of the security components, we have, when you consider the amount of log volume we have versus the traffic that we have, it's huge. We're ingesting 110 gig worth of logs a day, which isn't a lot compared to a lot of the people at this conference, but it's a lot for the volume of traffic that we have, right? It's an incredibly huge amount of data. Splunk can handle that with relatively small amount of overhead. On top of that, it's support, right? A lot of my peers at Newstar who work on other products, they're using graphite, they're using cacti, they're using Nagios. These are terms you guys have heard. You know, everybody in the business uses these tools. But they're open source tools. If there's something that it can't do, you have to build it yourself. If you get stuck with a road bump, you have to solve it yourself, right? I mean, I work with studios all the time, but half them, I can't tell you the contact's name, because there's just so many names that go by. But my sales guy at Splunk is named James, James Hill. I call him. I have his cell phone number in my cell phone. We talk all the time because Splunk is one of the most critical tools that I need, and if it's broken, I can get immediate support. It's that support experience. Yes. It's a solution. Yeah, it's keeping the velocity high on your team. On a DevOps team, it's all about velocity. I need to keep everything running, and to keep it running, I need the tools and the support necessary to make sure that people don't get held up. So talk a little bit about your DevOps team. Talk about that discipline. When you say DevOps, describe the characteristics of that team. Well, really, in my mind, DevOps is sort of the next generation of operations, right? Everybody talks about, okay, we're going to take Dev, we're going to take Ops, and we're going to put it together. Historically, engineers wrote code, and they sort of threw it over the wall, and it was the responsibility of the operations people to keep it running. In my mind, in the DevOps philosophy, you now have operations people with Dev experience, and you have developers with operations experience, and it's a collaborative effort. You now have engineers that sort of specialize in architecting systems and building them, and then you have engineers that specialize in how to keep this thing running, how to make sure it has analytics, how to respond to issues, those kind of things, right? So it's one team that is responsible for the 24 by 7. So you're describing one team with different skill sets. You've got an offensive lineman over here, and you've got a quarterback or running back over here. I guess it's merely two team, two classes of team members. There's not as many as a football team, but you're not describing what some people, and maybe this is a misconception, think of as DevOps says, okay, you've got somebody who's sort of omni-skilled. That's not the prescription that you guys have gone after, right? It's more... It depends on scale, right? So in a lot of startups, if you've got a five-man team, then you have to have the omni-skill, right? You need everybody to know everything. I've worked in those kind of environments, but when you get to a team like Ultraviolet, where you've got 75 people in the team, or you've got 25 people in the team, then you have to segregate. There's advantages to some degree of specialization, right? Yes, there is. But there's a lot more overlap. So let's talk about bringing this back into the IT world, because Dave and I talk about converging infrastructure. We always talk to IT service management folks, IT in general, going consumerization, they're going cloud. Big data is a big problem with M1. Their own data, machine data, personal data, and they don't really have the horsepower to kind of boot up a real strong IT, or as most IT organizations have been rebuilding quickly. What advice would you give IT professionals out there that are looking at Splunk that have an old rack-and-stack server farm, going to the cloud, a lot of transformation, new mobile apps are being funded, a whole new transformation environment, whether it's DevOps, or OpenStack, or Amazon, or Private Cloud. How would you advise them to handle the IT side of it on the OP side? What's going on? That is a big question, and it really depends on what you're going for. Honestly, my biggest piece of advice was to have patience. I have seen a lot of executive-level leadership in companies say, okay, we're going to move to DevOps, or we're going to move to the cloud, and we're going to do it in six months. And if your old rack-and-stack, that's not going to happen. You need to have some patience. You take your new things, you roll them to the cloud, your old things, maybe you roll them off. If you have a product that's going to be end-of-life in 15 months, maybe you just don't have to worry about that. But it does take time. So you're saying it depends on where you are on the grade level. What level if you're kind of, hey, I'm just taking my toe in the water, or hey, I got some POCs going on, I'm kind of moving the ball a little bit. It also depends on your operational maturity. If you have good process and you've got good change policies, then it's possible that you could move quicker. But if you're like a lot of shops where you're just, you're trying to keep up, you're trying to keep up, just adding a cloud migration to that is just going to make things worse. Yeah, yeah, yeah, because you're really not set up for cloud migration. It's going to break your existing broke processes, right, or non-existent processes. What's your take on this? I mean, you've been covering, we went to the Service Now conference, you mentioned earlier in one of your tweets, Tableau, Service Now, Splunk, all kind of in the same vein of hyper growth startups. The IT implications are pretty significant. I tell you, here's my take. I think that the traditional IT organization has been watching what's been happening in the hyperscale crowd for, you know, well over a decade now. And I think they're adopting some of those practices while they may not have the resources or maybe the engineering depth and bench strength. A lot of those things are now being programatized. They're documented. They're out there in papers, Google papers. They're watching what Facebook is doing and they're saying, hey, we can apply a lot of these techniques and we can make our organizations better and we can make our lives better, make IT heroes. And so you're seeing that I think across the board, the leading edge IT organizations are, you know, aggressively adopting those techniques. Do you buy that, Nathaniel? Oh yeah, I buy that. Yes. I mean, even Newstar in the last two years we've gone to Service Now. We've completely matured our deployment strategies. We've got a live CMDB, every asset, for the cloud and for our rack and stack. So I see a renaissance in IT. It's a bell curve like you'd expect. But like, you know, for instance, a lot of companies don't have a single CMDB, right? That's a big hurdle for a lot of legacy companies that everybody wants to hold on to their own data. But that's a huge advantage, you know, from a productivity standpoint, agility, quality of information. I mean, there's just, you know, across the board. So I think it's inevitable. I think that companies that don't follow that path are going to be left behind, frankly. And I think that those that do follow that path are going to be more competitive. Oh yeah. Well, again, it's keeping your velocity up, right? If you implement those new tools, if you go through the renaissance, you're going to find that you have the velocity to keep up. Things are starting to move faster and faster and faster. And the operational principles that we were using in the 90s just don't facilitate that. Now, what about cloud? Are you guys using, were you using Storm? No, we're not using Storm. I have a 2014 goal to get all of Ultraviolet into the cloud. We're actually working on strategies for that now. Interesting. Okay, because you're getting, right? So I got to ask about the Hadoop situation, because obviously we had, you know, the folks on here talking about mobile. Hortonworks, do you guys work with Hortonworks? Relationship with Hortonworks? I have no idea. Okay, so we had Cloudera on Hortonworks. How much of Hadoop do you have in terms of big data back in? Do you track that at all? Well, so Newstar has three different veins of work. They have Enterprise, which is what I do, along with our UltraDNS business. We've got Carrier Stuff, which is where we do number portability for the United States. And then we've got Big Data. And so our Big Data team actually has a huge Hadoop cluster where they're ingesting all of the enterprise data and all of the number portability data and finding ways to connect that data to provide value. I just got to know from someone online, you guys do have a deal with Hortonworks. No, we do. So clarified that note taken. Thank you so much for coming on theCUBE. Really appreciate it. Final comment. I'll give you the last word of the segment. Explain to the folks the vibe here at Splunk. Again, they just went public. So it's very, you know, only 10 years old company, but they've had really fast growth. Describe the scene here at the conference. What's it like? What's the vibe? It's exciting. Everybody you talk to is really excited about Splunk 6. The data modeling, the pivoting, and there's just sort of a fever in the air that I find pretty exciting. I've been to a lot of conferences, and this is definitely the most high-energy conference that I've ever been to. Okay, that's it for this segment. We'll be right back with the next guest and the short break. I'm John Furrier with Dave Vellante. This is theCUBE live Las Vegas for Splunk Conference. We'll be right back after this short break.