 Live from the MGM Grand Hotel in Las Vegas. Extracting the signal from the noise. It's theCUBE, covering Splunk.com 2015. Brought to you by Splunk. Now, here are your hosts, John Furrier and George Gilbert. Okay, welcome back everyone. We are live here at splunks.conference 2015. Hashtag SplunkConf, C-O-N-F, Splunk, C-O-N-F. Crouchat.net, Splunk.com, and join the conversation. I'm John Furrier with SiliconANGLES, the CUBE, our flagship program. We go out to the events and extract the signal from the noise. Our next guest is Alan Tucker, manager of helpnet central systems at Indiana University. Welcome to theCUBE. Appreciate it. Thank you. So besides having great sports and a rabid fan base, which we like to watch during the basketball season. Yeah. University, great use case. Harden infrastructure, IT, a lot of operations, certainly provisioning and having security. Yeah. First question everyone wants to know is, what's the bandwidth like in the students? How much fat pipe do they have? Well, it's gorgeous, as a matter of fact. There's actually 10 gig fiber in between campuses, and it's a beautiful thing. So they don't have to worry too much about- No rural broadband problems at the university. No, no, not at all. Gotta love the bandwidth. Yes, yes. So what's the challenge for IT ops? Policy security, anyone that knows? Yeah, so our main challenge, and actually really the reason why we went with Splunk was to solve a very niche issue, which was policy compliance for IUIT policies. So IU, because it's effectively so large, very, very distributed on the server side. So very departmental focus, lots of servers actually. There are about 5,200 servers in the IU infrastructure between eight campuses. In one data center or a disparate data center? Yeah, definitely in- Servers under the desk or road servers? Yes, those as well. Yeah, so it can range all over the map. Yeah, so there's actually a data center in Bloomington, there's a data center in Indianapolis. The majority of them are in those. You will see the occasional server under the desk, but I think you would probably see that in every higher education. Yeah, you got research going on, all kinds of stuff, and also hackers. How about the students, I always want to know, what's the latest and greatest on, you got all that gig, a bandwidth, servers putting up, servers in their room, you guys close that down. I don't think we really see all that much. I mean, the networking team does a pretty good job just trying to keep that down as much as possible. We know that gaming is an issue, so there are actually gaming networks and things like that that we've tried to isolate some of that data in there. But yeah, the Splunk side of the house is really trying to really get into the helpful compliance area related to these IT policies. Give an example of what challenges you have in where Splunk solves. Sure, so because it's so distributed and there are so many different server owners, and we're talking 112 different IT departments throughout the scope of IU, and because there's so many servers, the ownership of those is not consolidated into one central IT department. Because of that, IU puts out IT policies for best practices, basically things like deployment of firewall rules and just overall pretty standard generic practices, and of those best practices is log management and log review. And Splunk has actually been able to help us deploy a solution that is enterprise ready that these departmental IT professionals can use to be compliant and aligned with IU IT policies. So it's reducing the risk factor all across the board throughout the state. To boost it into the less technical part of our audience, the log management and review is that where you'll be looking at access control events or... Yeah, so the IT policy focuses on four very specific areas. So it's successful and failed user login accesses and successful and failed file accesses. So, and the review of that on a consistent basis has been an area that people have just struggled with, frankly. So file access was the other one? Yeah. That sounds actually pretty pragmatic, which is we want to hold on to these key capabilities and you guys can go take care of the rest. That's correct. Yeah, the main reason for deployment really is that there are costs associated with log review, right? So it's very timely, time consuming. If a department were to spin up a solution that would help them do it, it's going to be costly again on just a price structure. So what we heard consistently was central IT needs to put out a service that we can do this. And the flip side to that is that the departmental IT provider is then more focused on their department. And it's basically bringing the labor back. So I had to ask you a question. I asked everyone the same question for the next two days. So I'll play the first one I'm going to ask, if I can ask the banking guy earlier. What's the role machine learning is playing for your job? How does that affect you, if any? Do you see the big day of machine learning, some of those automations working for you? Yeah, some of the automation, that's sort of a hard question to ask because, or a question to answer. It's actually not an area that we are directly focused on right now because we're really trying to focus on the support layer and providing information that is directly beneficial to the departments and as well as the support division throughout IU. So that's the core volume of what you guys are dealing with on the help side is inbound. Hey, my Cisco routers aren't working or hey, Wi-Fi's not working in my room. I mean, whatever the use case could be. Yes, absolutely right. So all of those areas actually and being able to provide a solution that fixes a very specific need. And at this point, it's one can do so much. And frankly, we have been a Splunk user for over a year but our deployment out to these departments has only been in the last three months. So we're just now starting to see these great benefits as well as great potential for- Like what, give me some examples. Well, the IT12 policy alignment thing is an absolute win but in terms of IT operations, I mean, we're talking exchange and axe directory and firewalling and networking. And so it's all across the board but as well as just very specific to departments. So things like, we have this very specific application that was built within a single department. Can we pull logs off of it and give them direct dashboarding that helps them make qualified decisions on the information that's coming through it? So would it be fair to say that you're pulling off more and more of the management activities, the ITOPS activities that were done sort of out on the 112 departments. Now that you have the infrastructure and place that went in for security, it just becomes easy to take that, essentially the same log data and present that back. That's correct, yeah. And as it sits right now, we're actually only ingesting events that are specific to those IT policy requirements. And so it's very interesting that we have over 2000 servers in this environment but we're only actually on a license that is under 50 gig because we're parsing and dropping off so much information. But to more to your question is we basically will sit down with departments and talk to them about their needs and use cases and figure out what it's going to take and how much ingestion we need to really plan for. What's the big challenge in higher ed? Big picture, things that you see Splunk helping you guys out with that you're working on towards. I think one of the largest challenges for higher ed, especially in the security realm is how open the environments are. There's always a researcher that wants to pick up the research and give it to somebody else or just- Sharing economy, right? That's exactly right. What about gaming and talking about networks? Yeah, and sharing things in security don't necessarily mix all the time, right? So that is a really big challenge. And we're just focused on trying to give these departments the tool sets that help them continue to do their job. So I got to ask you, what's it like for college kids these days? A lot of Instagram, a lot of video, a lot of gaming. What's the number one utility with all that broadband? I mean, it's like having like a water spring in your backyard. It's like unbelievable, you know, thirst quencher for people who are broadband starved, you know, you guys have a ton of bandwidth. Yeah, I don't- So what's springing out of that? I don't think that there's necessarily like a killer app that we use, you know, it's, the central IT organization is very distributed as well. I mean, we have great industry leaders in the five divisions throughout our central IT organization. And we just hope that every single one of those departments really slams at home, you know? But people will take advantage of the band with stadiums throughout the universities, go to basketball game. I think they are- They're uploading Instagram photos, doing live streaming. You know, frankly, I'm not sure that the Instagram and the YouTubes and Netflix are really on the radar of really what, yeah, it's, I don't think that in the scheme of things, I don't think that that's the killer, the killer network band with this issue. I think that there are probably other areas in terms of sending large amounts of data across the university as well as throughout the state and the world, that is probably more- And that's coming from actually the academic side, do you think? Yeah, absolutely, and the research side, yeah. I was just going to ask on that, what sorts of things, I know, you know, it's sort of ARPANET, the precursor to the internet sort of took shape with research universities sharing huge amounts of data. What sorts of things are you guys, you know, saturating that 10 gigabit link with? You know, frankly, that isn't necessarily my area of expertise. Is Splunk helping to manage that? At this point, it's not, but that's definitely on the roadmap. You know, Indiana University helps administer the internet to network and the global knock that's associated with that. So we'll definitely be looking at trying to integrate some of Splunk into that over the next, you know, upcoming years. But at this point, we're just not, we're barely scratching the surface, you know. All right, so give us the audience the taste of the Splunk conference. You've experienced the product. What's the vibe here? What's your take of the growing Splunk ecosystem? We've got a lot of loyal customers. You're very loyal to the product you said. But what's the vibe here for the folks that aren't at the event? Oh, the vibe is great. I mean, everybody is, you know, talking to each other and very excited about the new products that are coming in. The keynote this morning was fantastic. I think everybody was very excited about, you know, the user analytics and things like that, the intelligence piece that they're coming out with. We have had some great social events, especially throughout the higher edit area, talking to some other universities. Good networking. Oh, absolutely great. Great networking. There are a lot of areas of overlap between universities. And I think that we can do, definitely do a lot more to share. Best practices. Well, it's best practices as well as application development. You know, for example, there are tons of universities that are using central authentication services with Shibboleth and there really is not an app. You're not going to find that on Splunkbase, right? So to come together and try to actually develop something like that, I think is a great thing. And inter, or within the higher-ed community, there's a lot of sharing on research as well. Collaboration, tapping into virtual space as well. Yeah, absolutely. You know, the way with Splunk it's, higher-ed is interesting with Splunk because there aren't turnkey solutions, frankly. And so spinning up the infrastructure and everything, that took some time for us, but really the majority of our focus right now is being in the app development area and trying to figure out what is meaningful and how we parse off this data and really use case scenarios and things like that. It gives you guys more agility now. Higher-ed used to be kind of slower because there's so much going on with the provisioning of the networks, right? I mean, now you're really full-blown application shop. Yeah, yeah. I didn't think we'd get there, but yeah. What is, you said something interesting where you're now focused all on application development. What's changed? What are some of those? You know, a lot of it is very proof of concept things like I mentioned about the Exchange app and Active Directory app and it's... Oh, it's not new things, it's putting them under management. Correct, yeah, that's correct. And as well as going forward into custom app development, we have done some of that on the departmental level, but not a ton, but that's definitely a direction that we are, you know, that's where I see the benefit being the greatest, frankly, in saving departments a lot of time throughout the state. All right, we got a break there, Alan, appreciate it, but give us a little insight and color on the final word and the segment about Indiana. Yeah, your environment, the school, the vibe, people generally happy with everything, what's going on. Give us some peek inside that culture. Well, the culture's great, always in Indiana. I mean, we have great sports teams. We have a wonderful campus. I mean, it's beautiful every season, so we're excited. Awesome. We are here live at Splunk Conference. We'll be back with more customer testimonials and more customer insight, sharing their perspectives and their data of what they're working on here inside theCUBE. We'll be right back after this short break.