getting started with it service intelligence
TRANSCRIPT
Agenda
2
ITSICoreConcepts
3
WhatisaService?
Service RequestsResponses
InITSI,aService isalogicalgroupoftechnologycomponentsthatauserdeemsneedtobemonitoredtogether.
Itcanoftenbegeneralizedasa“blackbox”whichwesendrequests,andexpectresponses
4
WhatisaService?
DNS RequestsResponses
TechnicalServices
Auth RequestsResponses
Web RequestsResponses
Servicescanbelowerlevel(technical)…
5
WhatisaService?
DNS RequestsResponses
TechnicalServices
CustomerTransactions
RequestsResponses
BusinessServices
Auth RequestsResponses
Web RequestsResponses
SupportDesk RequestsResponses
Servicescanalsobehigherlevel(business)…
6
WhatisaService?
PacketNetwork
HypervisorandHosts
RBMDBs
StorageTier
APIServices
WebServices
CustomerTransactions
Mobile
API/Middlew
are
PartnerPortal
DNS
ServicescanencompassmultipletiersoftheITdomain.Servicesmayalsodependuponotherservices
7
WhatisaKPI?
DNS RequestsResponses
KPI:NumberofrequestsKPI:ErrorrateKPI:AverageresponsetimeKPI:ServerCPUloadKPI:ServernetworkI/Ferrors
CustomerTransactions
RequestsResponses
KPI:NumberoftransactionsKPI:ErrorrateKPI:AverageresponsetimeKPI:CountofIncidentTicketsKPI:SyntheticTransxHealth
KPIsandHealthscoresconstitutethemeansbywhichServicesaremonitored.
8
KeyPerformanceIndicators(KPIs)
9
AKeyPerformanceIndicator(KPI)isaSplunksavedsearchcreatedwithintheITSIUIthathelpsmonitoraspecificfieldlikeCPU,Memory,NumberofErrors
andsoon.KPIsarecontainedwithinServices.
ServiceHealthScores
10
AHealthscoreisascoreform0-100(0beingcriticaland100beingnormal)thathelpsdeterminethehealthofaService.ItiscalculatedbasedonallKPIs
importanceanditsstatus(e.g.green,orange,red),onceeveryminute.
Let’sTalkEntities
11
● Entitiesaretherelevantcomponentsthatsupportaservice(oftenbutnotalwayshosts)
● Selectthecorrectentitieswithfilters,ANDs,ORs
● EntitylistcancomefromaCMDB,aspreadsheet,aSplunksearch…
ServiceDecomposition
12
ServiceDecompositioninITSI
13
Identifyahigh-valuebusinessservice
ServiceDecompositioninITSI
14
Identifytheprocessflowandunderlyingsub-services(Web->Middleware->DB->Middleware->Web)
ServiceDecompositioninITSI
15
Foreachsub-service,identifyKPIsthatwillshowhealthandstatus(Requests,responsetime,errors,OShealth…)
ServiceDecompositioninITSI
16
ForeachKPI,defineaSplunksearch
ServiceDecompositioninITSI
17
ITSIDemo
18
AdaptiveThresholds
19
WhatifyourKPIdatalookslikethis?
20
AdaptiveThresholdsStaticthresholdswillnotwork…
21
AdaptiveThresholdsAdaptiveThresholdingworksbeautifullywithcyclical(andotherdynamic)data
AnomalyDetection
22
● MachineLearning
● Workswellfordatawithpatterns
● Requiressome“training”
● Candetectentitiesthataren’tbehavingthesameastheothers,notjustasingleKPIhavingissues
ITSIDemo–Troubleshooting
23
WrapUp- Review
24
● High-valueservicescanbedecomposedandmodeledinITSI,usingmachinedatafromtherelevantsystems
● Services andKPIs canbecreatedinminutes,withsophisticatedthresholdingtechniquestodistinguish“normal”from“notnormal”
● GlassTablesallowservicehealthandKPImetricstobedisplayedinawaythatmakessensetospecificgroups,suchasExecutiveLeadership,BusinessServiceOwners,theNOC,DevOps&Others
● DeepDivesallowKPIstobecomparedside-by-sideacrossanytimerange,acceleratingrootcauseanalysisandsignificantlyreducingMTTR
● Multi-KPIAlertsandNotableEventsreducealertnoise,producingactionableeventsandameanstomanagethem
● …andit’sfuntobuild!
Wanttoexploreonyourown?
25
Signupforyourveryownseven-dayfreesandbox!http://splunk.com/ITSI
Thenclick:
You’llfindaSandboxGuideintheDashboards!IntheITSIappofyoursandbox,gotoSearch->Dashboards->SplunkITSISandboxGuide
Copyright©2015SplunkInc.
• 5,000+ITandBusinessProfessionals• 175+Sessions• 80+CustomerSpeakers
PLUSSplunk University• Threedays:Sept23-25,2017• GetSplunk CertifiedforFREE!• GetCPEcreditsforCISSP,CAP,SSCP
SEPT25-28,2017WalterE.WashingtonConventionCenterWashington,D.C.CONF.SPLUNK.COM
The8th AnnualSplunkWorldwideUsers’Conference
27
ThankYou