 Live from the Walt Disney World Swan and Dolphin Resort in Orlando, Florida, it's theCUBE. Covering Splunk.com 2016, brought to you by Splunk. Now, here are your hosts, John Furrier and John Walsh. And welcome back here on theCUBE, the flagship broadcast of SiliconANGLE TV where we extract the signal from the noise just for you at home. Live streaming here from Splunk.com 2016, live in Orlando, along with John Furrier. I'm John Walsh and we're joined by, if not the most popular guy at the show, certainly one of the busiest, no doubt about that Stan Alantani, who is the CTO at Splunk. Thanks for joining us, we appreciate the time. My ego is big enough, you're not helping. No, certainly not. I know, he didn't say you were handsome too, you were handsome. Very handsome. And charismatic and charming and all those things. First off, congratulations, great show. It's an amazing event. A lot of positive buzz. John and I have been talking about it quite a bit over the last couple of days. What's your take on what you see here and the vibe that you're getting from your partners and your customers and all the people here? Yeah, you know, Conf was all, I visited Conf as a customer and now I'm here as an employee. And Conf was always about bringing our engineers closer to the customers, our customers closer to the engineers. This is a technical group. This is about lessons learned, sharing ideas. And it's amazing because whenever I went to, when I was a CIO, other vendor events, most of the sessions were kind of marketing-y, very high level. You'd blow them off, you know. People would get really offended if they missed a session at Conf. It's just amazing because every session it's by the customer, for the customer, and level of just depth and knowledge sharing. And people don't want to miss sessions. I've never seen that in an event before. And the keynotes are packed too. Keynotes are absolutely packed. Even on a Wednesday morning or a Thursday morning, last day of the conference, it'll be absolutely packed tomorrow because it's all about content and it's all about, you said, customers teaching and telling things to other customers. And you've got a keynote tomorrow, so get a quick plug and tease us what's going to happen tomorrow on stage for your keynote. Yeah, well, so what's amazing is, Doug's opening keynote really talked about a few things. First was the evolution of going from a tool to becoming a platform to becoming a data fabric and the investments and things we've made in the product to help make that easier, both technically and from a user adoption standpoint. We then heard from the product. A little while for a second, let's just stop, there was a, that's not the way it's supposed to work. It's supposed to be a platform, then a tool, then a fabric. Yeah. But the world's upside down and you're winning. And we're winning. And I think that's what's amazing is we've always been very use case driven. And so the thing with Splunk is it's all about what problem are you trying to solve so we can land and fix that one problem. But then you realize that the data needed by IT to keep the systems up and running. Web, app, network, endpoint, identity, infrastructure, logs. That's the same data needed by security to hunt to breach. Is the same data that you can use to run the business in real time or you can use to catch fraud or do all these other use cases and scenarios. So we have this amazing ability to land in any one of these use cases and then systematically grow and expand the account across the entire enterprise. Okay, so I interrupted you. Doug said one, two, platform fabric. And then we learned about IT operations and security this morning and how we're disrupting those spaces. So tomorrow it's the art of the possible. It's all of the amazing use cases and the power of Splunk outside of IT and security. So I've got Robert Herjavec coming on stage from Shark Tank and he's going to talk about the lessons learned building a data-driven business. Because it really does come down to becoming a data-driven organization using data to make better decisions faster. And then I'm going to talk about how we take in retail analytics, want to sales data, digital marketing data, digital payments data to actually help drive better revenue for a donut shop, in this case for one of our customers. Stuff we're doing for the military, stuff we're doing in transportation analytics. So it's everything in business analytics and IOT. I want to get to your predictions later but I want to get and just drill on what you said and just kind of love coming to keep cause things just pop in my head and things I just connect the dots. Splunk has always had a nice way of kind of crafting the keynotes because it is a technical conference. Keynotes can be salesy. So you guys actually do a good job of theming it out. Doug the CEO, then the nuts and bolts of IT operations and then boom, the future. So I've got to ask you, one of the themes that I see over the years is covering Splunk is the creativity aspect of the community and the customer base because what Splunk has become today wasn't what it was supposed to do. It's kind of taking a new different trajectory granted higher. So the role of creativity of using Splunk in new use cases has come from the customers. Yeah. So that's a big part of this whole art of the possible. What are some of the new creative things that Splunk is obviously security is front and center but I mean, any new use cases, any creative things that you'd like to share? Yeah, there's a couple of pretty amazing ones. So what, let me tell you a personal story. Last year I told you a couple of personal stories. Let me tell you a personal story which I'll tell on stage tomorrow again and that is a starting point for some of the really cool use cases we're looking at thinking about today. So I was in London a couple of months ago at the Bond Street Tube Station. Getting out of the tube, going up the escalator, suddenly 200 people started stampeding behind me. Kicking, scratching, climb, climbing, panicking, working way up, there was a stampede and people thought there was an active shooter in the tube station. This is the day after Orlando, pretty, pretty, you know, everyone's already a bit edgy or on edge. So one, what happened? What's going on? Am I in danger? But I didn't know what was happening. But number two, my wife and my son who's only 18 months old and a stroller, they were behind me. They were supposed to be behind me, but turns out they ditched me. But if they were in a stroller behind me, that stroller would have been knocked over and I would have been in a very different situation today. So once I ascertained that they were safe, I got really angry and I got angry because the Wi-Fi access points knew 200 people were running in one direction. The micro location services could detect that there was a stampede in place. The sensors within the tube station could detect that there were shots fired or no shots fired or that there was bombs or no bombs. The machine data was there and we failed to connect the dots, draw a conclusion that there's no danger, broadcast out an alert saying, keep calm or more importantly, think of ways for people at risk that there's danger runs out. And so when I think about kind of the art of the possible and the really amazing use cases, it's the ability to connect the dots in all of those types of environmental sensors and data and then actually doing something about it. So we can transform first responders. We're doing some amazing stuff with the military. We're going to show off tomorrow around soldier health and optimized medical evacuation. It comes down to synthesizing the machine data through sensors with the digital data, with the Twitter feeds and so on to provide better situation. And the military, is that with uniforms and wood detection and that kind of thing? Yeah, absolutely. Well, that's a real scary story and wow, I'm like taken back by that. Great story. Thanks for sharing that. But that brings, let's get down and under the hood and kind of analyze that. What you're really talking about is different systems talking to each other in real time and getting the data in real time, extracting what it means in real time and prescribing solutions. I mean, that's just not possible. Or is it? It's, that's the art of the possible. It's the art of the possible. It's the art of the possible. But let's just pretend we were solving that problem. We had unlimited resource. Yeah, yeah. What would we do? So, we had to get the database. Well, I think step one is so let's structure the problem. So one of the issues I've always had is the distinction of structured versus unstructured data. I was always annoyed by this because the format of the data has very little to do with the insights and outcomes that are possible. Moreover, a mainframe log is actually really well structured, but we somehow declared it like unstructured. So the first thing I did was I rethought the data landscape from when I was a customer and even now. So I've got transactional data. So think Joe bought shoes or Joe deposited $10 in his account. It's relational. It's highly normalized. It's acid transactional semantics. It's a schema on right design. So you understand the columns or attributes. You've defined a schema for it. It's create, read, update, destroy type access patterns. That's what relational database technologies, data warehouses, BI systems are designed to go solid. And they're solid. And they're solid. They're really awesome at doing that job. Then you have all of the digital exhaust that's generated from processing that transaction. So if Joe bought shoes, the machine data says he stood in line for 20 minutes waiting to pay for those shoes. That comes from the Wi-Fi access points, the RFIDs, the point of sales data, the digital web logs and so on and so forth. Potentially even in this phone. From his phone. And that data is time series in nature. It's bucketized, which means you've got hot, warm, cool, cold buckets of data based on the age. It's eventually consistent because it's not a banking transaction. You ingest the data once, you read from it over and over again. It's schema on read, which means you don't know what question you're asking the data. So you keep the data in its original format for ad hoc analysis in real time. And maybe structure it later based on context. Exactly, structure it later based on context. And then the third class of data was all the enrichment data. Which was, so if Joe bought shoes, he stood in line for 20 minutes to pay for those shoes. Reference data says he's a high roller with 20,000 Twitter followers. I think like third party data feeds, it's document oriented, key value pair, so on and so forth. So step one is like, if you get out of the marketing hype of, you know, and actually look at the physics of each type of data that's out there, I'm kind of convinced that those are the three major types. I mean, computer science, I love this, it gets me geeking out, but there's data about data. What you're getting to is, let's get metadata about the metadata. So that's really kind of a new way to think about it. And you basically can get algorithms that kind of make decisions and prioritize and triage. Hey, this is a time series data, no longer in the time window, throw it away. So is that the thinking that's happening? Well, what step one is, understand what data you have. Transactional versus machine versus reference data. And Splunk, our focus is machine data, right? And that's what we're really good at. Step two is, thoughtfully connect the dots across your transactional data, your machine data, reference data to derive really interesting and actionable insights. And that's where we've evolved to as a company over the last year, with connectors to be able to get reference data, connectors to get transactional data, connect the dots and actually synthesize through machine learning. Step three though is, the ability to tell stories of that data to influence a decision. You do that through visualization, you do that through natural language. So we've done some pretty amazing stuff in the last years. Let me ask you, of course, as a CIO and a CTO now, a former CIO and now CTO, this comes down to the conversation of composite applications being built on the fly. So some patterns might emerge like a retail scenario that come out of this. Yeah. And then you productize it. Yep. You operationalize it. And you commercialize it. You find a way to use those insights, use your data as an asset to actually drive revenue. So this is cutting edge, right? This to me, this is a cutting edge use case. Okay. Let's kind of talk about another dynamic I want to give you a thought on because this is something that we've observed and we kind of said it for the first time publicly yesterday on theCUBE with the security SVP. Is that Splunk is kind of turning into, and I'll use the word, quote, social network. The employees in that place, the customers of Splunk are starting to form on their own these ad hoc networks amongst themselves and sharing data organically with each other for a better meant of the group. Yep. Which is very unusual in data worlds, but an interesting dynamic. Is that happening? Do you see that happening? Am I misreading that? And if it is happening, what's the impact of that? I mean, that's going to change the paradigm on, I mean, you're the Cisco router of data, if you will. I mean, you are nested in a fabric of innovation. Am I off base? Correct me, what's going on? So let's back up and let's understand what's happening in security today. The cost of a cyber attack is one-tenth to one-one-hundredth the cost of cyber defense because tools are highly automated and freely distributed. Compute is cheap because it's stolen and the attackers tend to come from countries whose labor rates are quite low. And we're on this unsustainable trajectory because we need to change the economics of cyber defense and reduce the cost of cyber defense by a thousand X. So how do you do that? Well, one is tremendous collaboration between public sector, academia, and private sector. We have to collaborate across those domains. In many ways, cutting the cost of cyber defense is the space race of my generation. We have to fundamentally change the economics and change that trajectory because this is becoming a pretty major nationally- It is the Kennedy moonshot, I mean, but that's a good point. So are they sharing? Yeah. They're doing more sharing. In security, the ability to act not as individual vendors in individual communities, but wisdom of crowds is absolutely the trend that we're seeing. How are they doing that with Splunk? I know we're running out of time and I want to get this on the table because this is a major, major story. It's a major story. One of the things we've done over last year is work very hard to make Splunk from a tool to a much more open and extensible platform with very thoughtful ways to use plugins, use APIs, use models that we've built as a starting point and you can start to build your own models, building a content distribution channel that allows our partners to create models and threat fees themselves and push it into the collection of customers that we have. Being able to build apps that we can build once, codify wisdom and then distribute. For example, the National Security Agency, the Information Assurance Directorate built an app called SAMI, which takes the top 10 network security recommendations, codifies it and they distribute it freely as an app in our app store for our Splunk customers to consume and see how they stack against the NSA's recommendations. So it is this tremendous collaboration that we are very intentionally trying to foster and collaborate. High-end calls us the Nerve Center. We're becoming not only the nerve center or the glue that binds all these sources of data together, but the command center as well as we see everything wing to wing. We're going to wrap up. I want to give you three predictions for this year. What are we going to see this year? So I told you two already, data storytelling is the last mile of analytics and our ability to tell stories of data, to make those insights actionable to help people make better decisions faster is number one. Number two is fundamentally change in the economics of cyber and there's a bunch of key programs in there. One is security analytics to help hunters hunt better, this idea of natural language to accelerate ramp to productivity. We saw Grant Wernick from Insights Engine show some of those capabilities down to moving target defense and deception and shape-shifting networks. Those really change the economics of cyber. And number three is IoT becomes a data source for business analytics. IoT starts to blur the lines between digital and physical with a revenue outcome in mind. And a security risk. And a security risk. And a security risk. That's exactly it. And at Splunk where we're so versatile in our core technology that we can start in any one of those scenarios and fundamentally disrupt across the board. Well, I'm really excited. I love the cyber line about the space race of your generation. But you dropped another one on us before we began that Splunk is the Harley Davidson of IT. And real quick, I mean, what you say because... So Harley Davidson is the only company in the world whose brand is so powerful, people tattoo their logo on their body. So you go around Conf and I'm sure there are people here with Splunk tattoos. All right, I'm not going to ask to see yours. He's got a hidden, you won't go there. Say hello, thank you. Thank you. Appreciate it. Congratulations on a great conference. Thanks for the support. I really appreciate it. You guys have been here since the beginning. So I'm very excited. I'm proud of it. I love the relationship. Thank you. We continue here live from Orlando here on theCUBE back before just a bit.