 Live from Washington D.C., it's theCUBE. Covering.conf 2017, brought to you by Splunk. Well, welcome back here on theCUBE as we continue our coverage at .conf 2017. Splunks get together here in the nation's capital, Washington D.C., we are live here on theCUBE, along with Dave Vellante. I'm John Walsh, glad to have you with us here for two days of coverage. We're joined now by a team Dell EMC, I guess you could say, Collin Gallagher who's a senior director of VxRow product marketing. Collin, good to see you, sir. Likewise. And Corey Minton, many time, Cuber. Collin, you're a CUBE alum as well. Thank you. Principal engineer, data analytical leader at Dell EMC and bigdatabeard.com, right? Yes, sir. All right, and just in case you have a special session going on, they're going to be handing these out a little bit later. Someone lets you know that I'm prepared. That's perfect, yeah. With you and your many legions of fans, you can allow me to join the club. That's awesome. We'll welcome. We're so glad to have you. Yes, sir. The big data beard, you don't have to have a beard to talk big data at Dell EMC, but it certainly is not frowned upon. All right, this would be the only way I'd ever grow one, though. I promise you that. Looks good on you. I like the color, though, too. Anyway, they'll be handing these out at the special session. They'll be a lot of fun. Fellows, big announcement last week where you've got a marriage of sorts with Splunk technology and what Dell EMC is offering on VxRow. Tell us a little bit about that. Ready Systems is how you're branding this new offer. So we announced our Ready Systems for Splunk. These are turnkey offerings of Dell EMC technology, pre-certified and pre-validated with Splunk and pre-sized. So we give you the option to buy from us, both your Splunk solution and the underlying infrastructure that's been certified and validated in a wide variety of flavors, based on top of VxRail, based on top of VxRack, based on top of some of our other storage products as well that gives you a full turnkey implementation for Splunk. So as Splunk is moving from the land of the hoodies and the experiment is to more mainstream running the business, these are the solutions that IT professionals can trust from both brands that IT professionals can trust. So you're both a Splunk reseller and a seller of infrastructure, is that right? Indeed. So we actually, we joined Splunk in a partnership as a strategic alliance partner. It's a little bit over a year ago. And that gave us the opportunity to act as a reseller for Splunk and we've recently gone through a rationalization of their catalogs. We actually have an expanded offering so customers have more choice with us in terms of the offers that we provide from Splunk. And then part of our alliance relationship is that not only are we a reseller, but because of our relationship, they now commit engineering and resources to us to help validate our solutions. So we actually work hand in hand with their partner engineering team to make sure that the solutions that we're designing from an infrastructure perspective, at least meter exceed the hardware requirements that Splunk wants to see their platform run on top of. Okay Corey, so you're a data guy. Indeed. You've been watching the evolution of things like Hadoop. When I look at the way in which customers deal with Hadoop, you know, ingest, you know, a clean or transform, analyze, et cetera, et cetera, operationalize, there seem to be a lot of parallels between what goes on in that big data world and then the Splunk world. Although Splunk is a package. It seems to be an integrated system. What are the similarities? What are the differences? And what are the requirements for infrastructure? You know, I think that the ecosystems, like you said, it's open source versus a commercial platform with a specific objective. And if you look at Splunk's deployment, our development over the years, it's, they've really started going from what was really a Google search for log, as Doug talked about today in the kickoff, to really being a robust analytics platform. So I think there's a lot of parallels in terms of technology. We're still, it's designed to do many of the same things, which is I need to ingest data into somewhere. I need to make sense of it, so we index it or do some sort of curation process to where then I can ask questions of it. And whether you choose to go the open source route, which is a very popular route, or you choose to go a commercial platform like Splunk, it really depends on kind of your underlying, call it ethos, right? It's that fundamental buy versus build, right? For somebody to achieve some of the business outcomes of like deploying a security event and information management tool like Splunk can do, to do that in the open source, may require some development, some integration of disparate open source platforms. I think Splunk is really good about focusing specifically on the business outcome that they're trying to drive and speeding their customer's time to value with that specific outcome in mind, whereas I think the open source community, like the Hadoop community, I think it offers maybe some ability to do some things that Splunk maybe wouldn't be interested in, things like rich media analytics, things that aren't good for Splunk indexing. Are there unique attributes of a data rich sort of workload that you've accommodated that may be different from a traditional enterprise workload and what are those? Yeah, so at the end of the day, any application is going to have specific bottlenecks, right? One of the basis of performance engineering is move the bottleneck, right? And enterprise applications, we had this evolution of, originally they were kind of deployed in a server and then we saw virtualization and shared storage really come in vogue for the number of years and that's true in these applications, these data rich applications as well. I think what we're starting to see is that regardless of what the workload is, whether it's a traditional business application like Oracle SAP or Microsoft or it's a data application like a Splunk, anytime it becomes critical to the operation of a business, organizations have to start to do things that we've done to every enterprise IT app in the past, which is we aligned it to our strategy, which is highly available. Is it redundant? Is it built on hardware that we can be confident in that's going to be up and running when we need it? So I think from a performance and an engineering perspective, we treat each workload special, right? So we look at what Splunk requirements are and we understand that their requirements may be slightly different than running SAP Oracle and that's why we build bespoke systems like our ready system for Splunk specifically, right? It's not a catch-all that, hey, it works for everything. It is a specifically designed platform to run Splunk exceptionally well. So Colin, a lot of the data practitioners that I talked to at this show and other data oriented shows, yeah, infrastructure, I don't care about infrastructure. Why should they care about infrastructure? Why does infrastructure matter and what are the things that they should know? Infrastructure does matter. I mean infrastructure, if your infrastructure isn't there, if your infrastructure isn't highly available, as Corey said, if it lets you down in the middle of something, your business is going to shut down, right? You know, any user can say, talk about what happened last time you had a data center event and how long were you offline and what did that really mean for your business? What's the cost of downtime for you? And everything we build at an application level and a software level really rests on an infrastructure foundation, right? Infrastructure is the foundation of your data center and the foundation of your IT and so infrastructure does matter in the sense that, as Corey said, as you build mission critical platforms on it, the infrastructure needs to be highly reliable, highly available, and trusted and that's what we really focus on bringing. And as applications like Splunk evolve more into that mainstream world, they need to be built on that mission critical, reliable, managed infrastructure, right? You know, it's one thing for infrastructure development. This kind of happens in the history of IT as well. You know, it happened in client server back in the day. You know, new applications, even in the web environment, I remember, you know, a company was running, one of my clients was running a web server under their secretary's desk, you know, and she was administering at halftime. You would never have a large company doing it. Hey, we're back up tonight. Yeah, okay. Right, yeah. Before you leave. But as it becomes more important, it becomes more central, but also becomes more important to centrally manage those, right? You know, I'm an almost 15 year storage veteran for good or for worse. And what we really sell in storage is selling centralized management of that storage. That's the value that we bring from centralized infrastructure versus, you know, a bunch of servers that are sitting distributed around the environment under someone's desk is that centralized management, the ability to share the resources across them, to be able to take one down while the others keep running, shift that workload over and shift it back. And that's what we can do with our ready systems. We can bring that level of shared management, shared performance management to the Splunk world. And I'll tell you, one of the things that we talked about and we talked about in a number of sessions this week is application owners, specifically the folks that are here at this conference need to understand that when they decide to make changes at the application level, whether they like infrastructure or they think it's valuable or not, what they need to understand is that there are impacts. And that if you look at the exciting things that were announced today around enterprise security updates, right? Enterprise security is an interesting app from Splunk. But if a customer goes from just having Splunk Enterprise to running enterprise security as a premium application, there's significant downstream impacts on infrastructure that if the application team doesn't account for, they can put themselves in a corner from a performance and a capacity perspective that can cause serious problems and slow down the business outcome that they're trying to achieve because they didn't think about the infrastructure impacts. Well, and what they want really is they want infrastructure that they can code, right? Okay, so, and we talked about this at VMworld, we were talking about off camera, that cloud model, bringing that cloud model to your data as opposed to trying to force your business into the cloud. So what about ready systems? Kind of mimics that cloud model. Is it a cloud like infrastructure? I wonder if you could talk about that. Yeah, I think it's that cloud like experience because we know we're in a multi-cloud world, right? Cloud is not a place, cloud is an operating model, right? And so I think that the ready system specifically provides a couple of things that are that cloud like experience, which is simple ordering and configuration and consumption that is aligned to the application, right? So we actually align the sizing of the system to the license size and the expected experience that the Splunk customer would have. So they get that very curated bespoke system that's designed specifically for them, but in a very easy to consume fashion that's also validated by the software vendor, in this case Splunk, that they say these are known good configurations that you will be successful with. So we give customers that comfort that hey, this is a proven way to deploy this application successfully and you don't have to go through a significant architecture design concept to get to that cloud like experience. Then you layer in the fact that what makes up the ready system, which is it is a platform powered by, in the VxRail case, powered by VMware, right? ESX and VSAN, which obviously, you know, if you look at any of the cloud providers, everything is virtualized at the end of the day for the most part, or at least most of the environments are. And so we give and VMware has been focused on that for years and years of giving that cloud like experience to the customers. You mentioned reseller, you got this partnership growing, you're a customer, so you have all these hats, right? And connections with Splunk. What does that do for you, you think, just in general? What kind of value do you put on that, having these multiple perspectives to how they operate and whether it's in your environment or what you're doing for your customers using their insights? Yeah, so I think at the end of the day, we're here to make it simpler for customers, right? So if we do the work and we invest the time and energy and resources in this partnership and we go do the validation, we do the joint engineering, we do the joint certification, that's work that customers don't have to do and that's value that we can deliver to them that whatever reason they buy Splunk for whatever workload or business outcome they're trying to achieve, we accelerate it. That's one of the biggest values, right? And then you look at it, who do they interact with in the field? Well, it's engineers from our awesome pre-sales team from around the world that we've actually trained in Splunk. So we have a now north of 25 folks that have Splunk SC certifications that are actually Dell EMC employees that are out working with Splunk customers to build platforms and achieve that value very, very quickly. And then them understanding that, oh by the way, Dell EMC is also a user of Splunk, a great customer of Splunk and a number of interesting use cases that we're actually replatforming now and drinking our own Kool-Aid, so to say, that I think it just lends credibility to it. And that's a lot of the reason why we've made investments in being part of this awesome show, right? But also in doing things like providing the application. So we actually have four apps in Splunk base that are available to monitor Dell EMC platforms using Splunk. So I think customers just get a holistic experience that they've got a technology partner that wants to see them be successful deploying Splunk. I wonder if we could talk about stacks. So I've heard Chad, Sackage, talk about stack wars. Tongue in cheek. But his point is that customers have to make bets. You've heard him talk about this and you've got the cloud stacks, whether it's Azure or AWS or Google, obviously VMware has a prominent stack, maybe the most prominent stack. And there's still the open source, whether it's Hadoop or open stack. Should we be thinking about the Splunk stack? I mean, is that emerging as a stack or is it a combination of Splunk and these other? You know, we actually had that conversation today with some of the partner engineering team and I don't know that I would today. I think Splunk continues to be, it's its own application in many cases and I actually think that a lot of what Splunk is about is actually making sure that those stacks all work. So there was even announcements made today about a new app, so they have a new app for Pivotal Cloud Foundry, right? So if you think about stacks for application development, if you're going to hit push on a new application, you're going to need to monitor it. Well you can't, you know, Splunk is one of those things that's persistent, right? The data's persistent, you want to keep long amount, you have large amounts of data for long periods of time so that you can build your models, understand what's really going on in the background, but then you need that real-time reporting of, hey, if I hit push on a Cloud Foundry app and all of a sudden I have an impact to the service that's underlying it because there's some micro-service that gets broken, if I don't have that monitoring platform that can tell me that and correlate that event and then give me the guidance to not only alert against it, but actually go investigate it and act against it, I'm in trouble, right? The stacks, I think many of them have their own monitoring capabilities, but I think Splunk's proven it, that they are invested in being the monitoring and the data fabric that I think is winning to help all the stacks be successful. So I don't necessarily put it in the stack and I kind of don't put Hadoop in its own stack either because I think at the end of the day, Hadoop needs a stack for deployment models, right? So you may see it go from a physical construct of it trying to be its own software that controls the underlying hardware, but I think you're seeing abstraction layers happen everywhere. They're containerizing Hadoop now, virtualization of Hadoop is legit. Most of the big Cloud providers talk about the decoupling of compute from storage in Hadoop for persistent and transient clusters. So I think the stacks will be interesting for application development and applications like Splunk will be one of two things. They'll either consume one of those stacks for deployment or there'll be a standalone monitoring tool that makes it successful. So you don't see, in the near term anyway, Splunk becoming an application development platform the way that a lot of the... They may have visions of it, that's not, yeah. They haven't laid that out there, that's something that we've been bouncing around here. Yeah, I think it's interesting. I think it goes back to, it makes it, because the flexibility in what you can do with Splunk, I mean we've developed some of our own applications to help monitor Dell AMC storage platforms and that's, it's interesting, but in terms of building what we, I guess we'd consider like traditional seven factor app development, I just don't know that it abides it. Yeah, well it's interesting because I'm noodling here. Doug Meredith said, hey, we think we're going to be the next five billion, 10 billion, 20 billion dollar ecosystem slash company. And so you start to wonder, okay, how does that TAM grow to that point? That's one avenue that we considered. I want to talk about the anatomy of a transaction and how that's evolved, Colin, you mentioned client server and you think about data rich applications going from sort of systems of record and the transactions associated with that and while there were many, going to client server and HTTP increased and then now mobile apps really escalated that and now with containers, with microservices, the amount of data and the complexity of transactions is greater and greater and greater. As a technologist, I wonder if you could sort of add some color to that. Yeah, I think as we kind of go down the path of application stacks are interesting, but at the end of the day, we're still delivering a service, right? At the end of the day, it's always about how do I deliver a service, whether it's a business service, it's a mobile application, which is a service where I can get closer to my customer, I can transact business with them, you know, at a different model. I think all of it, because everything has gone digital, everything we do is digital, you're seeing more and more machines get created, there's more and more IP addressed devices out there on the planet that are creating now data and this machine-generated data deluge that we're under right now, it ain't slowing down, right? And so as we create these additional devices, somebody's going to make sense of this stuff and if you listen to a lot of the analysts they talk about like, you know, machine data is the most target rich in terms of business value and it's the fastest growing and it's now at a scale, because we've now created so many devices that are creating their own logs, creating their own transactional data, right? There's just not that many tools that out of the box make it simple to collect the data, search the data and derive value from it in the way that Splunk does. You can get to a lot of the things that Splunk can deliver from an outcome, other ways with other platforms, but the simplicity and the ability to do it with a platform that out of the box does it and has a vibrant community of folks that will help you get there, it's a pretty big deal. So I think it's interesting, I don't know, like under the covers, microservices are certainly interesting, they're still services, they're just smaller in package slightly differently and shared in a different way. A lot more of them. Yeah, and scaled differently, right? And I totally get that, but at the end of the day, we're still from a Splunk perspective and from a data perspective, we still got to make sense of all of it. Right, well, I think the difference is just the amount of data. You talked about kind of new computing models, serverless sort of stateless IoT company, coming into play, it's just the data curve is reshaping. Well, it's not just the amount of data, it's the number of sources. The data is exploding, but also, as Cori mentioned, it's exploding because it's coming from so many places. Your refrigerator can generate data for you now, right? You know, everything that generates, anything, they're doing anything now really has a microprocessor in it. I don't know if you guys saw my escape room at VM Realm. There were 12 microprocessors running this escape room, so one of the things we played about doing was bring it here and trying to Splunk the escape room to actually see real time what the day was doing and we weren't able to ship it back from Barcelona in time, but it would have been interesting to see because you can see just the sensors that are in that room real time and being able to correlate all that and that's the value of Splunk is being able to pull that from those disparate sources all together and give you those analytics. Yeah, it's funny you talk about an IoT use case. So we've got these, so our partner Arrow, who's a joint partner of both Dell EMC and Splunk, we actually have these misfit devices that are activity trackers and we're actually- A misfit device? Yeah, it's the brand, it's fitting, I think. But we have these devices that we gave away to a number of the attendees here and we actually asked them if they're willing to participate, they can actually use the app on your phone to grab the data and by simply going to a website, they can allow us to pull the data from their device about their activity, about their sleep and so we actually have in our booth and in Arrow's booth, we're Splunking Conf and it's called How Happiest Conf and so you can actually see Splunk running and by the way, it's running in Arrow's lab that's running on top of Dell EMC infrastructure designed for Splunk. You can actually see a Splunking how happy Conf attendees are and we're measuring happiness by their sleep, how much quality- Sleep quality and- The exercise, the number of steps, right? So we have a little battle going between- More sleep or less than happy. Yeah, happy. And our consumption behaviors also tracked on that, I just want to know, I'm curious. I think that's voluntary, they'd have to provide that and I haven't seen it. We're measuring happiness. It certainly is. But it's just a great use case where we talk about IoT and the number of sources of data that Splunk is a platform. It's very, very simple to deploy that platform, have a web service that's able to pull that data from an API, from a platform that's not ours, right? But bring that data into our environment, use Splunk to ingest and index that data then actually create some interesting dashboards. It's a real-world use case, right? It's now how much people really want to just Splunk IoT or health devices will determine but in the IoT context, it's an absolute analog for what a lot of organizations are trying to do. Interesting, good stuff. Gentlemen, thanks for being with us. We appreciate that, Corey. It's probably not the real deal, but as close as I'm going to come. Good luck with your session. We appreciate the time. Thank you. To both of you. And you and your misfit. Back with more here on theCUBE, coming up just a bit here in Washington, DC.