Copyright  ©  2014  Splunk  Inc.  

Mackenzie  Kosut  Director  of  Technical  OperaBons,  Oscar  Health  Pete  Sicilia  Director  Technical  Services,  Splunk  

Planning  Successful  AnalyBcs  Projects  

Disclaimer  

2  

During  the  course  of  this  presentaBon,  we  may  make  forward-­‐looking  statements  regarding  future  events  or  the  expected  performance  of  the  company.  We  cauBon  you  that  such  statements  reflect  our  current  expectaBons  and  

esBmates  based  on  factors  currently  known  to  us  and  that  actual  events  or  results  could  differ  materially.  For  important  factors  that  may  cause  actual  results  to  differ  from  those  contained  in  our  forward-­‐looking  statements,  

please  review  our  filings  with  the  SEC.  The  forward-­‐looking  statements  made  in  the  this  presentaBon  are  being  made  as  of  the  Bme  and  date  of  its  live  presentaBon.  If  reviewed  aUer  its  live  presentaBon,  this  presentaBon  may  not  contain  current  or  accurate  informaBon.  We  do  not  assume  any  obligaBon  to  update  any  forward-­‐looking  statements  we  may  make.  In  addiBon,  any  informaBon  about  our  roadmap  outlines  our  general  product  direcBon  and  is  subject  to  change  at  any  Bme  without  noBce.  It  is  for  informaBonal  purposes  only,  and  shall  not  be  incorporated  into  any  contract  or  other  commitment.  Splunk  undertakes  no  obligaBon  either  to  develop  the  features  or  funcBonality  described  or  to  

include  any  such  feature  or  funcBonality  in  a  future  release.  

Bios/This  is  us  !   Mackenzie  Kosut  is  the  head  of  systems  at  Oscar  Health  Insurance  in  New  York  

City.  His  team  is  responsible  for  all  servers,  systems,  and  services  to  ensure  they  are  available,  secure,  and  properly  architected.  Prior  to  Oscar,  Mackenzie  was  on  the  SRE  team  at  Tumblr  where  he  helped  serve  up  over  18  billion  page  views  a  month.  Mackenzie’s  first  exposure  to  Splunk  was  rolling  out  a  1.5TB/day  installaBon  at  MTV  Network/Viacom  back  in  2011  

!   Pete  Sicilia  leads  the  Business  AnalyBcs  pracBce  at  Splunk.  The  Business  AnalyBcs  team  helps  Splunk  customers  derive  meaningful  business  value  from  their  machine  data  and  to  get  creaBve  with  AnalyBcs  and  VisualizaBon.  Previously  Pete  led  the  Client  Architect  team  that  helps  make  Splunk's  largest  customers  successful  and  assists  with  planning,  staffing,  educaBon  and  execuBon.  He’s  been  a  Splunker  for  four  years.  

What  is  Oscar?  !   Oscar  Health  is  a  new  kind  of  health  insurance  company  that  is  using  

technology  to  make  insurance  simple,  intuiBve,  and  human.  In  other  words,  the  kind  of  healthcare  we  want  for  ourselves  

!   We  brought  together  leaders  from  top  technology  and  healthcare  companies  to  create  a  talented  team  of  engineers,  designers,  and  healthcare  experts  

!   We  all  work  side  by  side  in  a  collaboraBve,  energeBc,  and  creaBve  environment.  The  result:  becer  people,  becer  ideas,  and  becer  healthcare    

!   Healthcare  is  broken  and  confusing.  We’re  simplifying  how  health  insurance  works  and  helping  our  members  make  becer  choices  by  guiding  them  through  the  process.  Having  Oscar  is  like  having  a  doctor  in  the  family  

AnalyBcs  at  Splunk  !   You  might  hear  Splunkers  refer  

to  Business  AnalyBcs  as  OI  Level  4  

!   AnalyBcs  can  be  anywhere  –  it’s  not  a  separate  department  

!   Persona-­‐based  approach  !   Data  mash-­‐ups  

–  Financial/KPI’s/Metrics  –  Ops  –  Sociall  

!   Enterprise-­‐wide  user  adopBon  !   High  value  use  cases  

Intro  to  Personas  !   Persona  is  a  concept  we  use  to  define  various  user  types  in  a  Splunk  deployment  

!   This  is  different  than  a  Splunk  role  !   Core  IT  personas  (e.g.  SysAdmins,  Developers  and  Splunk  Admins)  keep  systems  running,  fix  them  when  they  break  and  plan  for  capacity  

!   As  your  Splunk  deployment  grows  out  of  Core  IT…  –  Each  business  unit  has  their  own  set  of  personas  –  They  have  unique  problems  to  solve  and  their  preferred  ways  to  

interact  with  or  consume  data  

Business/Non-Core IT Personas

Account  ExecuBve    App  Developer  Business  Analyst  CIO/CISO/CDO  

Customer  Analyst  

Data  ScienBst  MarkeBng  Analyst  MarkeBng  ExecuBve  Product  Manager  

QuanBtaBve  Analyst  

Security  Analyst  Technology  Strategist  

   

You  might  encounter  personas  with  Btles  like:  

Personas  at  Oscar  

OperaBons  Finance  

Customer  Service  Medical  

Management  Data  Sales  

ExecuBve  

Designers  Eligibility  

Provider  Network  

Personas  at  Oscar  Mapped  in  Splunk  

Oscar’s  Power  Users  

0   15   30   45   60   75  

Data  

Customer  Service  

Medical  Management  

Insurance  OperaBons  

Developers  

Sales  

Finance  

ExecuBves  

Design  

Eligibility  

Product  Managers  

SRE  

1  

2  

1  

1  

1  

1  

1  

AnalyBcs  Team  Building  !  Data  people  have  different  skill  sets  and  it’s  important  to  include  complementary  skill  sets  when  building  a  team  

Personas  Requirements  

As  you  encounter  personas  make  sure  you  spend  Bme  collecBng  their  search  and  reporBng  and  data  requirements,  but  also  pay  acenBon  to  the  bigger  picture.  !   Gather  Requirements  (What  is  their  Business  Problem?)  !   Get  Relevant  Data  (Is  the  data  they  need  in  Splunk?  What  

other  data  helps  answer  their  quesBons?)  !   Build  Searches/Datamodels  !   Consume  Results  (Dashboards,  visualizaBon,  3rd  party  tools)  

Developing  for  Business:  Gather  Requirements  

!  What  is  the  quesBon  I’m  trying  to  answer?    – What  is  their  Business  Problem?    – What  department  are  we  dealing  with?    – Where  do  they  fit  in  the  organizaBon?  – Who  is  the  end  user  primary  contact?  – Do  they  have  a  (trained)  power  user?  –  Engagement/support  model  

ê  Self-­‐service?  ê  Full  change  control/Formal  requests?  ê  2  hour  power  session?  

Developing  for  the  Business:  Get  Relevant  Data  

!   Where  is  the  data  that  will  help  me  answer  the  quesBon?    !   What  are  the  relevant  fields  and  what  is  the  best  way  to  retrieve  them?    

!   What  data  sources  drive  those  constructs?    !   Is  the  primary  data  in  Splunk?  !   Can  I  enrich  Splunk  data  sources  with  external  data  feeds  and  provide  mash-­‐ups?  

!   Should  I  be  replacing  legacy  SQL  queries  with  DBConnect?  !   Should  I  index  DBConnect  data  or  just  use  it  as  a  lookup?  

Developing  for  Business:  Searches/Datamodels  

!   What  is  the  sequence  of  operaBons  that  convert  my  data  into  the  answer  for  my  quesBon?  

!   What  searches  can  they  use  to  solve  those  problems?  !   How  do  I  constrain  and  audit  user  data  access?  !   How  do  I  construct  my  search,  build  my  datamodel,  port  my  SQL?  !   Do  I  know  where  to  get  help?  

–  Splunk  has  Docs,  EducaBon,  Support,  IRC  and  Answers  

Developing  for  Business:  Consuming  results  !  Persona-­‐relevant  landing  dashboard  !  Limit  access  to  what  they  need  to  get  the  job  done  

– Time  picker  default  Bmerange  and  limited  opBons  – Form  search  – Open  in  search  vs  open  in  pivot?  

!  Who  will  build  and  maintain  the  dashboards/datamodels?  

!  How  do  I  construct  my  search,  build  my  dashboards?  

!  How  do  they  prefer  to  consume  the  results?  Splunk?  PDF?  Tableau?  – Are  we  using  the  ODBC  driver  the  right  way?  – Returning  search  results  vs  exporBng  all  data  

!  Who  else  would  like  access  to  these  results?  CIO?  E-­‐staff?  

AnalyBcs  Use  Case  Discovery  

Oscar’s  ReporBng  Process  1. Power  user  creates  report  or  dashboard  (DBConnect,  Search,  JIRA  etc):  

         -­‐  Power  users  have  restricted  access  to  allowed  data            -­‐  They  are  idenBfied  over  Bme            -­‐  Power  users  help  each  other  answer  quesBons  2. Report  is  given  to  Data  team  for  review  and  lock  down:            -­‐  Is  query  opBmized?            -­‐  Is  data  limited  to  “need  to  know”?            -­‐  Is  the  report  readable  and  understandable?  3.  Data  team  publishes  dashboard  to  restricted  search  head            -­‐  Limited  adhoc  searching  (use  saved  searches  +  pivots)  

Unified  Member  View  

Medical  Management  

Unified  Member  View  (ConBnued!)  

Medical  Management  

Medical  Claims  Overview  

Claims  OperaBons  

Medical  Claims  Overview  

Claims  OperaBons  

FACT:  People  Write  Bad  SQL  

Developing  for  the  Business:  AcBon  It  !   Show  me  claims  that  are  at  

risk  of  being  paid  late  !   How  are  we  doing  

compared  to  the  previous  month?  

!   What  percentage  of  claims  are  on  Bme  vs.  late?  

!   How  many  claims  month  over  month  have  been  paid  and  at  what  amount?  

!   How  many  claims  are  paid  within  5,  10,  15,  etc.  days?  

Vendor  NoBces  Emails  

Even  business  processes  can  be  replaced  with  simple  dashboards:    Are  email  noBficaBons  from  vendors  arriving    on-­‐Bme?  

Oscar’s  Build  Pipeline  ! DBConnect’s  SQL  Query  Analyzer  

!   Only  Data  team  and  Developers  access  SQL  through  client  tools.  Everyone  else  uses  Splunk  

!   Syntax  HighlighBng,  Saved  Searches,  Audited  AcBvity,  Real  Time  AlerBng  on  Searches  

Oscar’s  Build  Pipeline  !   Add  restricted  search  

methods  (inputs,  dropdowns,  etc)  

!   Add  more  panels,  pipe  to  splunk  commands  (top,  chart,  Bmechart,  anomalies,  transacBon!)  

!   Lock  drill  downs  !   Scheduled  searches?  !   Use  the  submit  bucon!  !   Consider  using  Monit  for  

SQL  query  management  

Handles  it  Like  a  Champ  

3  PM  on  a  weekday  Splunk  @  Load  of  0.49,  MySQL  @  Load  of  0.10  

RetroacBve:  What  Would  We  Do  Differently?  !   Use  Pivot  Tables  for  dashboards  !   Force  users  onto  Splunk’s  QA  sooner  !   Implement  dedicated  splunk_{role}  MySQL  roles  earlier  

Professional  Services  Offering  

30  

!   Introductory  Professional  Services  packages  for  uncovering  Business  Value  from  Business  AnalyBcs  use  cases  

!   Tune  your  Splunk  environment  and  opBmize  your  deployment  for  expansion  into  new  use  cases  

!   Assistance  with  requirements  gathering,  data  inputs,  dashboards,  architecture  recommendaBons  and  documentaBon  

!   Compliment  tradiBonal  BI  investments  and  reach  Business  users  with  high  value  use  cases  

!   Pre-­‐Scoped,  short  engagements  with  concrete  deliverables  and  quick  Bme  to  value  

Growing  beyond  IT:  Call  to  AcBon!  !   Everyone  wants  to  move  to  OI  Level  4  !   CIO  and  CDO  care  about  Business  Insight  and  OperaBonal  Intelligence  

!   Build  some  easy  execuBve  dashboards!  !   The  business  cares  about  Business  AnalyBcs  but  crossing  departmental  silos  can  be  tricky  

!   OrganizaBon,  communicaBon,  documentaBon  help  immensely!  

Q&A  

THANK  YOU