SplunkLive! Munich 2018: Predictive, Proactive, and Collaborative ML with IT Service Intelligence
Download as PPTX, PDF2 likes701 views
This document discusses how machine learning (ML) can be used with IT service intelligence (ITSI) to enable predictive, proactive, and collaborative IT operations. It describes how ML can be applied to analyze machine data using ITSI to predict failures and other notable events. This allows operations teams to be notified earlier of potential issues. The document provides an example of using ITSI's built-in ML and event analytics to cluster similar alerts from thousands of events into meaningful, actionable alerts to improve response time. It also discusses integrating ITSI with chat tools like Slack to immediately notify teams to further reduce resolution times.
![[GDSC-GNIOT] Google Cloud Study Jams Day 2- Cloud AI GenAI Overview.pptx](https://cdn.slidesharecdn.com/ss_thumbnails/gdsc-gniotgooglecloudstudyjamsday2-cloudaigenaioverview-230914161034-01a51925-thumbnail.jpg?width=560&fit=bounds)
Ad
More Related Content
What's hot (20)
Similar to SplunkLive! Munich 2018: Predictive, Proactive, and Collaborative ML with IT Service Intelligence (20)
Ad
More from Splunk (20)
Ad
Recently uploaded (20)
SplunkLive! Munich 2018: Predictive, Proactive, and Collaborative ML with IT Service Intelligence
- 1. Predictive, Proactive, and Collaborative ML with IT Service Intelligence Not a Science Project – Creating Actionable Events Through Analytics Philipp Drieger | Staff Sales Engineer 20 March 2018 | Munich
- 2. During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release. Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. ©2018 Splunk Inc. All rights reserved. Forward-Looking Statements
- 3. © 2018 SPLUNK INC. Problem Statement Operations Teams need more time between an alert and a failure that has availability impacting ramifications. The introduction of Machine Learning is a must have in order to predict these failures. These notable events must be able to be pushed and collaborated on by teams in various tools.
- 4. © 2018 SPLUNK INC. 1. What data do we need? 2. We Need Machine Learning 3. Real Use Case Example 4. Let’s Dive Into How it Works 5. Next Steps Agenda
- 6. ▶ Key Performance Indicators (KPIs) • Defined metrics that are used to evaluate the overall status of the service ▶ Leading Indicators • Drivers of a result ▶ Lagging Indicators • Outcome of a result Indicators They Matter! Example Scenario DB Run Out of Space KPI Storage Value = 100% KPI User Response Time Value = 2000+ secs
- 7. KPI’s So What? Understanding Leading vs Lagging KPIs From the Service Experts is Critical Use Case Data Needed Set Business Priorities Measure the Right KPIs Drive Decisions
- 8. Data: Where to Get it I need it STAT
- 9. Where Does Data Come From? Service Intelligence Machine Data Human Data Synthetic APM Application Code Code DeploymentNetwork Change Records Server Changes Byte Code Instrumentation ML Adaptive Thresholding Server Storage Service Intelligence ApplicationLayerInfrastructureLayer
- 10. Use Splunk ITSI Provide flexible dependency service mapping for interactions at scale Leverage a platform to build out KPIs that ensure repeatability for consistency and allows aggregation and per entity KPI values Ease the burden of cleaning data What Do I Do With It Now
- 11. Real Use Case Example Let’s get the data
- 12. We Need Machine Learning Do you want to watch it or let it go?
- 13. Custom Machine Learning Success Formula Domain Expertise (IT, Security) ▶ ID Use Cases ▶ Set Business & Operations Priorities ▶ What KPIs Matter ▶ Drive Decisions Data Science Expertise ▶ Math/Stats Background ▶ Algorithm Selection ▶ Model Building ▶ Splunk ML Toolkit Splunk Expertise ▶ SPL ▶ Data Prep ▶ Operational Success
- 14. Overview of ML at Splunk CORE PLATFORM SEARCH PACKAGED PREMIUM SOLUTIONS MACHINE LEARNING TOOLKIT Platform for Machine Data
- 15. Supervised Learning Unsupervised Learning Reinforcement Learning Three Types of Machine Learning
- 16. Deviation from past behavior Deviation from peers (aka Multivariate AD or Cohesive AD) Unusual change in features ITSI MAD Anomaly Detection Predict Service Health Score Predicting churn Predicting events Trend forecasting Detecting influencing entities Early warning of failure – predictive maintenance Identify peer groups Event correlation Reduce alert noise ITSI Event Analytics Anomaly Detection Predictive Analytics Clustering Splunk Customers Have ML Problems
- 17. Splunk Machine Learning Toolkit 25+ standard algorithms available prepackaged New commands to fit, test and operationalize models EXAMPLE Algorithms Guide model building, testing and deployment for common objectives Interactive examples for 25+ use cases MLib Integration Showcase EXAMPLE EXAMPLE 300+ open source algorithms Assistants
- 18. Real Use Case Example Lets Use ML to get Predictive
- 19. Event Analytics BUILT IN – IT Service Intelligence Machine Learning
- 20. ▶ Notable Events are key • We created a notable for Web Store Service – Called webstore_health_alert • Lets see how Splunk can cluster this with other events to show other Notable Events that are attributed ▶ Smart Mode is actually Smart • It use clustering to group events remember unsupervised ML at the beginning and spot the anomalies IT Service Intelligence Event Analytics
- 21. ▶ Take 1000s or 100s of 1000s of alerts and connect them ▶ Use ML prediction to improve correlation ▶ Boil the events down to reasonable count of Actionable Events The Diamonds in the Rough Clustering Events into Actionable Alerts
- 22. Real Use Case Example Predictive Analytics in Real-time
- 23. Let’s Get Others Involved ChatOps - Anyone Slack?
- 24. © 2018 SPLUNK INC. ▶ Slack • Instant Message • Easy Channel Setup • Fast time to create incident working groups • Other Products just as easy HipChat, Skype etc… Slack
- 25. © 2018 SPLUNK INC. ▶ Slack Setup • Install the Alert Action https://splunkbase.splunk.com/app/2878/ • For Core Searches – Configure as alert action in Alerts • For ITSI − Enable Slack in notable_event_actions.conf • Let’s add it to our to our Policy − Configure –> Notable Event Aggregation Policy –> Create New ChatOps Splunk + Slack
- 26. Real Use Case Example Predictive Analytics in Real Time
- 27. © 2018 SPLUNK INC. 1. Splunk ITSI allows for Rapid Service, KPI, Entity creation and alerting 2. Machine Learning through MLTK provides a repeatable ability to Predict Service Health 3. Splunk ITSI for Event Analytics enables teams to cluster Notable Events together to have one Actionable Alert 4. Splunk ITSI provides extendable capabilities to provide immediate notification to Chat Groups, Ticketing system and other communication platforms to improve the Mean Time to Remediate Availability Impacting Situations 5. Read the blog: ITSI and Sophisticated Machine Learning What to Remember and Where to Go if You Fell Asleep Key Takeaways