Building Business Service Intelligence with ITSI
1 like479 views
This document provides an overview of a presentation on Splunk IT Service Intelligence (ITSI). It discusses setting up the ITSI sandbox, the agenda which includes introductions, Splunk fundamentals, what ITSI is, and a hands-on session. It also covers service modeling best practices like starting with a problem, bringing together subject matter experts, and designing the service model before configuring. Additionally, it demonstrates how to configure a new KPI for database network utilization within the ITSI interface in about 5 minutes.
Ad
More Related Content
What's hot (20)
Similar to Building Business Service Intelligence with ITSI (20)
Ad
More from Splunk (20)
Ad
Recently uploaded (20)
Building Business Service Intelligence with ITSI
- 2. Setup Before You Can Play 1. Download this presenta9on slide deck: h;ps://splunk.box.com/v/ITSI-HandsOn-Calgary 2. If you have not done so already, Sign up for the FREE Splunk ITSI Online Sandbox: • hHp://splunk.com/itsi • Select "Free Online Sandbox" 3. Please test access to your sandbox; • Chrome, Firefox, Safari are recommended; • IE is NOT recommended 4. AYer logging in, select IT Service Intelligence from the list of apps at the leY 2
- 3. 3 Agenda • IntroducDons and Set Up • What is Service Intelligence? • Splundamentals -- Core Splunk in IT Ops • What is IT Service Intelligence (ITSI)? • Let's Play! • What's Next? • Happy Hour!
- 4. Safe Harbor Statement During the course of this presentaDon, we may make forward looking statements regarding future events or the expected performance of the company. We cauDon you that such statements reflect our current expectaDons and esDmates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forward-looking statements made in this presentaDon are being made as of the Dme and date of its live presentaDon. If reviewed aYer its live presentaDon, this presentaDon may not contain current or accurate informaDon. We do not assume any obligaDon to update any forward looking statements we may make. In addiDon, any informaDon about our roadmap outlines our general product direcDon and is subject to change at any Dme without noDce. It is for informaDonal purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligaDon either to develop the features or funcDonality described or to include any such feature or funcDonality in a future release. 4
- 7. Key Takeaways 1 TradiDonal Methods are outdated Service Mapping is CriDcal 3 Data-Driven Service Insights
- 8. Challenging Traditional Methods Network Infrastructure Layer HP NNMi, HP NA, Solar Winds, CA Spectrum, Storage HP Storage OperaDons, NetApp, EMC Server HP OV / Sitescope, SCOM, Nagios, Tivoli, BMC Patrol, CA UIM 74% -36% ApplicaDon Layer SyntheDc APM AppD, New Relic, Dynatrace, HP APM, CA, IBM, Appica Byte Code InstrumentaDon AppD, New Relic, Dynatrace, HP Diag, CA Wily AdapDve Thresholding HP SHA, BMC ProacDve Net, NetuiDve, Preelert HP Run-Time Service Model CA Service OperaDons Insight IBM NetCool/Omnibus Service Model definiDon & CorrelaDon Engine Business Layer Aggregation/Correlation/Visualization Service Layer Challenges • Too many disparate components • Difficult to define Service Model • Labor intensive • Most implementaDons fail • Very important source is missing! (machine data)
- 9. Data Approach With Splunk> Network Infrastructure Layer Packet, Payload, Traffic, UDlizaDon, Perf Storage UDlizaDon, Capacity, Performance Server Performance, Usage, Dependency 74% -36% ApplicaDon Layer SyntheDc APM Availability, Capacity, User Experience Byte Code InstrumentaDon Usage, Experience, Performance, Quality AdapDve Thresholding Apps, Services, Systems Splunk> is the missing link • Data Fidelity • Single Repository for ALL data • Easier to Manage Services • Reduced IntegraDons • Reduced Point SoluDons • CollaboraDve Approach • Quick Dme to value MACHINE DATA Data Fabric Platform Service Intelligence
- 11. Best PracDces for Service Modeling Start With a Problem Worth Solving • What are the top business services in your enterprise? • How do you measure the customer experience with these services? • What is the customer experience with these services? CriDcal Services
- 12. Best PracDces for Service Modeling Start With a Problem Worth Solving • How oYen do customers experience issues with the service? • When issues arise, who gets involved in resolving them? • How do teams work together to resolve issues? Issue Frequency
- 29. ITSI Tour 29
- 35. Let’s Play!
- 41. New Requirements! 41 ● Create a new KPI for the DB Service: ● Network UDlizaDon ● Modify the ExecuDve Glass Table in order to show off the services you slave over “WE only have about 15min TO DO WHAT ???!!???” Think about how long this would take you today?
- 43. Let’s Talk EnDDes 43 ● Select DB Service ● EnDDes are the relevant things which support this service (usually hosts) ● Select the right entries with filters, ANDs, ORs ● Original EnDty list can come from CMDB, spreadsheet, Splunk search, others
- 44. A KPI in 5 minutes? Absolutely! 44 Click New – Generic KPI Select Data Model ● Host Opera<ng System ● Network ● # bytes ● Next Call it “Network U>liza>on”, with your username up front
- 46. Almost There… 46 Select ● KPI Search Schedule: Every Minute ● En>ty Calcula>on: Average ● Service/Agg Calcula>on: Average ● Calcula>on Window: Last Minute ● Click Next ● Unit: Bps ● Click Next
- 47. Final Steps … 47 Set your thresholds: ● Aggregate (All) ● Per En>ty ● Click “Add Threshold” TWICE ● Make the Neapolitan ice cream colors Yellow, Green, Yellow ● Drag the sliders around in order to get the current data graph enDrely inside the Green (normal) band ● Click Finish ● Other opDons are also available, including adapDve thresholds and anomaly detecDon
- 50. 50 AdapDve Thresholds AdapDve Thresholding works beauDfully with cyclical (and other dynamic) data
- 51. Anomaly DetecDon 51 ● Machine Learning ● Works well for data with paHerns ● Requires some “training” (trial & error) to zero in on best sensiDvity ● More sophisDcated capabiliDes coming! (mulDvariate, more algorithms, etc)
- 53. Clone the Glass Table 53 Return to Saved Glass Tables page (click on Glass Tables in the upper menu bar) CLICK Edit for “BuHercup Games Business Process (IN PROGRESS)” • Select Clone • Title: Add your username to the front • Permissions: Shared in App • Click Clone Page • Click on your new Glass Table from the list, to view it
- 54. Edit & Have Fun! 54 Click on Edit in the upper right corner of your Glass Table Use the “Services” panel on the leY to select Individual KPIs, or Aggregate Service Health Scores • Choose 2 KPIs from Online Store that would be useful in the “Order Process” secDon • Drag the selected widgets onto the canvas, posiDoning in the gray oval • What’s the difference between the and tools at the top leY?
- 55. More Fun with the Glass Table Editor… 55 Use the Configura>ons panel on the right to edit a selected widget • Can change the visualizaDon type, drilldown behavior, and other se}ngs • You should hit Save frequently • Revert All Changes can be helpful, occasionally
- 56. Finishing up … 56 • Add a ServiceHealthScore widget for Online Store under BuHercup • Choose a Viz Type with a sparkline graph, then resize to make it look preHy • Modify the Custom Drilldown acDon to go to the saved glass table, BuVercup Games Online Store • Bonus Points: Make the label bigger, more readable • Click Save • View when done
- 57. A TroubleshooDng Exercise 57 Let’s use ITSI to troubleshoot an outage ● Start at your Glass Table, “<UserName> BuHercup Business Process” ● Customer Care reports that unhappy customers are complaining of failures and long delays when trying to purchase ● The calls began coming in at around the top of the last hour. ● In the upper right corner of the Glass Table, change the Dme picker from Now to XX:00:00.0, where XX is the previous hour. For example, if it is currently 14:05, set the Dme picker to 13:00:00.0, then Apply ● This is how we can “Dme travel” back to see condiDons at a parDcular outage– oh yeah!
- 59. A TroubleshooDng Exercise, cont’d. 59 ● The Online Store Glass Table shows a much more detailed view, including the impacted customer-facing KPIs at the far leY (Revenue, etc) ● Based on this view of all the relevant services, where do you think the root cause lies? ● Which service should we troubleshoot first? ● Click on Health widget for that service, to drill down to a Deep Dive
- 60. Deep Dive 60 ● Deep Dive shows mulDple KPIs and Health Scores in parallel “swim lanes”. ● The Health Score for this Service is the top swim lane. Can you see when it begins to degrade from 100%? ● Mousing over this point in Dme, can you spot the KPI with the leading fault indicaDon, i.e., what failed first? ● To improve readability, make sure the Primary Time Range (lower leY corner) is set to Presets > Last 60 minutes
- 61. MulD-KPI Alerts and Notable Events 61 ● Click on Notable Events Review ● MulDple KPIs and Healthscores can be combined in sophisDcated ways to create MulD-KPI alerts ● When a MulD-KPI alert fires, one of the outcomes is the creaDon of a Notable Event ● Notable Events allow NOC personnel and others to triage and coordinate event management efforts
- 62. Service Analyzer 62 ● Click on Service Analyzer > Default Service Analyzer ● Back where we started! ● This view shows a “no-frills” list of services (top) and hoHest KPIs (boHom) ● Provides access into Service Details ● It is useful for NOCs and others who need a high-level situaDonal view
- 64. Summary 64 ● High-value services can be decomposed and modeled in ITSI, using machine data from the relevant systems ● Services and KPIs can be created in minutes, with sophisDcated thresholding techniques to disDnguish “normal” from “not normal” ● Glass Tables allow service health and KPI metrics to be displayed in a way that makes sense to specific groups, such as ExecuDve Leadership, Business Service Owners, the NOC, DevOps & Others ● Deep Dives allow KPIs to be compared side-by-side across any Dme range, acceleraDng root cause analysis and significantly reducing MTTR ● Mul9-KPI Alerts and Notable Events reduce alert noise, producing acDonable events and a means to manage them ● … and it’s fun to build!
- 65. Possibili9es
- 66. Order Analysis – Core Splunk Record Systems Payment Processing Patient Queue Analysis Patient Processing Service Health Transactions Co-Pay Insurance MHR Check-In Procedures Pharmacy Assessment
- 67. Call Center Service Service Health Transactions ACD Analysis – Core Splunk Call Wait History Inbound Analysis Social Media Online Msg Social Media Mail Support VOIP Service Inbound Calls
- 68. Banking 68
- 70. 70 End User Experience for Streaming Video
- 73. Sign Up Now – We’re here to help! Harness the creativity and domain knowledge of your organization to unlock the value of data and solve an important Business Service problem through a joint service intelligence workshop with key stakeholders Define methods for: › Proactive service monitoring › Reduced risk and failures › Faster issue resolution › Increased business performance What is it? › 1 Day Onsite Workshop › Tightly linked with value › Collaborative approach › Build your own Glass Table