Splunk Webinar: Neuigkeiten in Splunk Enterprise 6.4
1 like344 views
The document discusses new features in Splunk Enterprise 6.4, including: - 15 new interactive visualizations for visualizing machine data in IT, security, IoT, and business analytics applications. - Enhancements to predictive analytics capabilities like time series forecasting and predicting missing values. - New storage optimization options in Splunk Enterprise that reduce historical data storage costs by 40-80%. - Additional cloud services monitoring apps for AWS, Akamai, and ServiceNow, along with platform security and management improvements.
Splunk Webinar: Neuigkeiten in Splunk Enterprise 6.4
- 13. Event Sampling • Powerful search option provides unbiased sample results • Useful to quickly determine dataset characteristics • Speeds large-scale data investigation and discovery 13 Optimizes query performance for big data analysis
- 14. Predict Command Enhancements • Time-series forecasting • New algorithms: • Support bivariate time series with covariance • Predict multiple series independently • Predict missing values within series • 80-100X performance improvement 14 Forecast Trends and Predict Missing Values
- 16. Splunk Enterprise: Storage TCO Reduction 16 Lean Storage for Historical Data • Removes certain search performance optimizations (TSIDX) to reduce data footprint 40-80% • Optimizes the cost vs performance of historical data analysis • Retains large datasets cost-effectively for regulatory compliance, security investigations and business ops 40 - 80% TCO reduction for historical data storage New storage option with granular controls
- 17. Historical Data Storage ColdColdCold Cold Cold Cold Cold Cold Cold Historical data retained online, possibly using lower-cost storage Hot Warm Warm Warm Real-time and recent data, typically using high-speed storage 17
- 18. ColdColdCold Storage Optimization Hot Warm Driving down data retention costs Warm Cold Cold Cold Cold Cold Cold Warm New Data Storage Controls • 40-80% reduction in data footprint • No functionality loss • Limited performance tradeoff for typical use cases How does it work? Certain Splunk performance optimization data (TSIDX) is removed – yielding a smaller footprint. 18
- 19. ColdColdCold Savings Example Hot Warm Driving down data retention costs Warm Cold Cold Cold Cold Cold Cold Warm Savings Over 1 Year $1.6 M* Savings over 5 Years $4.3 M* Raw Ingest: 10TB / Day Hot/Warm Retention: 2 Months Cold Retention: 10 Months * Assumes $1.25/GB Cold Storage Purchase Cost, 10% Maintenance Cost, 10% Annual Data Growth, 3 Year HW Refresh, No clustering 19
- 21. Management & Platform Enhancements Management – Distributed Management Console ê New monitoring views for scheduler, Event Collector, system I/O performance – Delegated Admin Roles HTTP Event Collector – Unrestricted data for payloads – Data indexing acknowledgement SAML Identity Provider Support – Okta, Azure AD, ADFS SAML Support ü OKTA ü Azure AD ü ADFS ü PingFederate HTTP Event Collector 21
- 23. Cloud Services Monitoring 23 New and enhanced apps to monitor critical cloud services • URL response times • Caching layer analysis • Network performance • Error log tracking • User profiling • Request/response perf. Analyze the operations and security of your AWS services • AWS ELB • AWS CloudFront • New security features • CloudTrail, Config • CloudWatch, S3 • VPC Flow Logs, Billing AWS Monitor the performance, availability, and security of your Akamai service Monitor ServiceNow incident, change, and event processes • Support for latest “Geneva” release Akamai ServiceNow
- 24. Splunk Enterprise & Splunk Cloud 6.4 New Cloud Services Monitoring New Visualizations & Enhanced Analytics 24 Platform Security and Management Unlimited new ways to visualize your data New mission-critical features Expanded cloud operations intelligence Storage TCO Reduction Reduces historical data storage TCO by 40%+ • New/enhanced monitoring capabilities for AWS, Akamai and ServiceNow • New pre-built visualizations • Open community library • Data sampling & prediction • Expanded management capabilities • New user security options • Splunk Enterprise reduces HW storage cost up to 80% for online historical data Get more from big data and pay less in storage costs
- 25. Copyright © 2016 Splunk Inc. .conf2016: The 7th Annual Splunk Worldwide Users’ Conference • September 26-29, 2016 • The Disney Swan and Dolphin, Orlando • 5000+ IT & Business Professionals • 3 days of technical content • 165+ sessions • 3 days of Splunk University • Sept 24-26, 2016 • Get Splunk Certified for FREE! • Get CPE credits for CISSP, CAP, SSCP • Save thousands on Splunk education! • 80+ Customer Speakers • 35+ Apps in Splunk Apps Showcase • 75+ Technology Partners • 1:1 networking: Ask The Experts and Security Experts, Birds of a Feather and Chalk Talks • NEW hands-on labs! • Expanded show floor, Dashboards Control Room & Clinic, and MORE! Visit conf.splunk.com for more information
- 26. Appendix
- 27. Additional 6.4 Features 27 Feature Short Description Ultra-drilldown and Highlighting When performing ultra-drilldown field=value or tag filtering, the UI highlights the appropriate tags or field=value pairs within event expansions and event details where applicable. New ultra-drilldown actions also added for tags. UI control for Global Default Time Range Administrators can now define a default time range value for all search pages by using a UI control in Splunk Web. Instant Feedback All formatting options in visualizations are reflected automatically in the visualizations. This gives users much more confidence that their choices are matching their intentions. Dashboard XML Editor Enhanced XML edit experience that includes better screen optimization, inline validation, as well as live preview before saving. Indexer Cluster Enhancements Option to force roll specific hot buckets. Ability to quarantine a bad search peer. Search Head Cluster Enhancements User/Role/Password Replication. Alert Logging Ability to create a custom log event that is sent back to the Splunk platform for indexing, searching, and reporting. Forwarder support for Linux For Power Forwarder supported on Linux for Power on the Little Endian architecture.
- 28. Splunk Enterprise & Splunk Cloud 6.3 Advanced Analysis & Visualization Breakthrough Performance & Scale High Volume Event Collection 28 Enterprise-Scale Platform Supports DevOps and IoT data analysis at scale Simplifies analysis of large datasets Delivers Enterprise platform requirements Doubles performance and lowers TCO • 2X Search & Indexing Speed • 20-50% Increased Capacity • 20%+ Reduced TCO • Anomaly Detection • Geospatial Mapping • Single-Value Display • HTTP Event Collector • Developer API & SDKs • 3rd Party Integrations • Expanded Management • Custom Alert Actions • Data Integrity Control Meeting the needs of the most demanding organizations