sap-successfactors customer presentation

Copyright©2016SplunkInc.

SAPSuccessFactorsAlfredWanDirector,ServiceDeliveryOperationsHCMSuiteServiceOwner

2

Agenda• Splunk@SAPSuccessFactors• ITSIProofofConcept• CreativeProjectsw/Splunk

Splunk @SAPSuccessFactors

4

AboutSAPSuccessFactors• Marketleaderincloud-basedhumanresourcesapplicationindustry• Supports5000customersand50millionregisteredendusers• 10globaldatacentersacrossUS,Europe,APJ• 10,000+VMs/BMsinproduction

5

AboutMe/OurTeam• HCMSuiteServiceOwner(PerformanceEngineeringBackground)• Teamof90people:SanFrancisco,Reston,Budapest,Bangalore,Shanghai• Charter:applicationmanagementforourHCMsuite• Focus:applicationtroubleshooting,performancetuning,capacitymanagement,rootcauseanalysis,long-termproactivemeasure

• Dealwitheverythingthatimpactsapplications(byinvolvingresponsibleteams)

6

BeforeSplunk:Manual,Inefficient• Hadtoanalyzelogsmanually• Usedvariousscripts(shell,perl,etc.)• Couldonlyviewoneserveratatime• Noaggregatedview• Lackofvisibility/analytics• Heavilyrelyonexperiencedindividual

7

ChoosingSplunk• InitiallypurchasedSplunkforlogmanagement• Saved100+logrequestticketsperweek

• AttendingSplunkLive!expandedmyperceptionofSplunk• DashboardsandReporting• VariousVisualization• Correlation

• Startedusingitmoreextensively&gainedmultipleadditionaladvantages• ReduceMTTR• BusinessAnalysis• EnvironmentCertification

“Westillhaven’tunleashedthefullpowerofSplunk,butwe’regettingbetteratit.Wenowseeitas

muchmorethanalogcatching&indexingtool.”

8

Splunk Benefits• Increasedefficiency

– Automatedpreviouslymanualprocesses– Consolidatedworthwhiletools,retiredunnecessarytools

• Higheravailabilityandperformance– Achieving99.9%availability– Bettercustomerperformanceexperience

• Gainoffunctionaltime– Freedupengineeringresources– Eliminatingredundanciesintroubleshooting

• Informationdiscovery,visibility– Centralized,morepreciselogmanagement– Aggregatedviewshelpusunderstandnavigationusage,outages,etc.

“Sharingcluesandourfindingsaboutmajoractivities

thatwediscoverinSplunk with

executives&peershelpsourbusiness.”

9

Splunk atSAPSuccessFactors• Splunk Enterprise• 5 TBlicense• 10datacentersglobally,multipleenvironments• USAshburndatacenterexample:

– 8indexers– 2syslogs,1jobserver,1searchhead– 1500+forwarders

10

LogsindexedatSAPSuccessFactors• Syslogs• F5 loadbalancerlogs

• Switchlogs

• Firewalllogs• Bladelogs

• OSlevelauditinglogs• Webserverlogs

• Applicationserverlogs

• Databaselogs• InternalAPMmetrics

• …

11

DaytoDayOperations• Centralize90+logsfromvariousoftiers,

applicationsintoSplunk

• Real-timetroubleshootingcapability

• Transparentviewinonestopshop

• Connectthedots,revealcomprehensivestatusoftheapplicationsuite

• Monitoringthekeycomponentsfromdashboard

• SplunkAlertsviaemailorAPI

11

ITSIProofofConcept

13

NewSiteAvailabilityGoals• ReduceMTTRby90%• Optimizethetroubleshooting/investigationprocess• Leverageexistingtoolsasmuchaspossible• Allwithin3months!

14

Challengeswithexistingsolution

14

CHALLENGES

MultiplepointsolutionsPingdom,Zabbix,Optier,

Solarwinds

Minimalindicationofrootcause

RepeatedescalationsandWarRooms

Rapidgrowthacross10datacenters

PAINPOINTSCONCERNED

Complexity,teamsoperatinginsilos,massiveinfrastructure

ESCALATEDLongresolutiontimes

STRESSEDResourcedrainand

missedprojectdeadlines

SplunkITServiceIntelligenceMachineLearning-Powered,Analytics-DrivenITOperations

Simplifyserviceoperations

Prioritizeincidentswithcontext RedefinetheroleofIT

Combineevents&metricsacrosssiloswithease,flexibility&scaleindays

Unifysiloed monitoringLeveragemachinelearningtodetectanomalies&highlight

eventsthatmatter

Deliverbusiness&servicecontexttoprioritizeincidentinvestigation&action

Supportdecisions&communicateresultswithpowerfulservice-levelinsights

16

PersonalizedvisualizationsofourHCMservice• Visualizecontextualinter-relationshipsacross

eachlayerofthestackfromWeb,ApplicationthroughDatabaseandNetwork

• Illustratebusinessandserviceactivityusingindicatorsalignedwithstrategicgoals

• OnceallthedatawasinSplunkwewereabletobuildtheKPI’sandcreateglasstableswithinafewdays

• GoalistocreatesyntheticservicehealthscoreswithweightedKPItofacilitateearlyalertingandfastresolution

16

17

OrganizedViewofPerformanceIndicators

17

OurOperationsteamwillbeableto:

• BuildoutDeepDivestocorrelatecriticalKPI’sforeachlayerofthestack

• Example:wecannowtrackhighloadonserversandtieitbacktoJavaExceptions,longrunningSQLqueries

• Compareperformanceovertimeandinrealtimetounderstandtrendsandidentifysystemicissues

18

Real-TimeViewofServiceandKPIHealthScoresSiteOperationsteamwillbeableto:• GetearlywarningofemergingincidentswithaheatmapofservicehealthandKPIscores,metrics,sparklinesandalerts

• Drilldownintoserviceandentitydetailsforin-depthtriage

18

19

TweakKPIWeightforHealthScore

19

Slidingbarapproachmakestheprocessveryintuitive

SimulatedSeverityhelpsuserunderstandhowtheweightimpactshealthscore

20

LearnWhat’sNormalandAbnormal

20

Baselinenormaloperationsandalertonanomalousconditions

IdentifyabnormaltrendsandpatternsinKPIdata

21

BaselineTrendstoAdaptThresholds

21

UsestatisticstodynamicallyadaptKPIthresholdsbytime

MaintainandpreservelearnedthresholdstomonitorKPIandservicebehavior

CreativeProjectsw/Splunk

23

Long-termAPMDataRetentionIntegratedSplunkwithourinhouseAPMsolutionforlongerdataretentionusingtheODATAAPI’s.• Identifyusagepatterns

• Capacityplanningfor“surge”periods

• Insightstoimproveoverallbusiness

• Proactivelydetectanomaliesandremediate

• Businessanalysiswithhistoricdata

• Machinelearningwithhistoricdatatoprojectusagegrowthscientifically

23

24

LogVerbosityAnalysis&LogFingerprinting• Analyzewherethemostredundantlogsarecomingfrom

• Reducetheverbosityoftopcontributors

• Developlogfingerprintforhighlyredundantandheavy,butnecessarylogentries

• Replaceheavyrawlogentrieswiththelightfingerprintentry

• BuildSplunklookuptabletomatchthefingerprintwithrawlogentry

• GoalistoimprovetheloggingefficiencysothatwecandomorewithSplunk

24

ThankYouy.wan@sap.com