Copyright © 2014 Splunk Inc.
Mackenzie Kosut
Director of Technical OperaBons,
Oscar Health
Pete Sicilia
Director Technical Services,
Splunk
Planning Successful
AnalyBcs Projects
Disclaimer
2
During the course of this presentaBon, we may make forward-‐looking statements regarding future events or the expected performance of the company. We cauBon you that such statements reflect our current expectaBons and
esBmates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-‐looking statements, please review our filings with the SEC. The forward-‐looking statements made in the this presentaBon are being made as
of the Bme and date of its live presentaBon. If reviewed aUer its live presentaBon, this presentaBon may not contain current or accurate informaBon. We do not assume any obligaBon to update any forward-‐looking statements we may make. In addiBon, any informaBon about our roadmap outlines our general product direcBon and is subject to change
at any Bme without noBce. It is for informaBonal purposes only, and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligaBon either to develop the features or funcBonality described or to
Bios/This is us
! Mackenzie Kosut is the head of systems at Oscar Health Insurance in New York
City. His team is responsible for all servers, systems, and services to ensure they are available, secure, and properly architected. Prior to Oscar, Mackenzie was on the SRE team at Tumblr where he helped serve up over 18 billion page views a month. Mackenzie’s first exposure to Splunk was rolling out a 1.5TB/day
installaBon at MTV Network/Viacom back in 2011
! Pete Sicilia leads the Business AnalyBcs pracBce at Splunk. The Business AnalyBcs
team helps Splunk customers derive meaningful business value from their machine data and to get creaBve with AnalyBcs and VisualizaBon. Previously Pete led the Client Architect team that helps make Splunk's largest customers successful and assists with planning, staffing, educaBon and execuBon. He’s been a Splunker for four years.
What is Oscar?
! Oscar Health is a new kind of health insurance company that is using
technology to make insurance simple, intuiBve, and human. In other words, the kind of healthcare we want for ourselves
! We brought together leaders from top technology and healthcare companies
to create a talented team of engineers, designers, and healthcare experts
! We all work side by side in a collaboraBve, energeBc, and creaBve
environment. The result: becer people, becer ideas, and becer healthcare
! Healthcare is broken and confusing. We’re simplifying how health insurance
works and helping our members make becer choices by guiding them through the process. Having Oscar is like having a doctor in the family
AnalyBcs at Splunk
! You might hear Splunkers refer
to Business AnalyBcs as OI Level 4
! AnalyBcs can be anywhere –
it’s not a separate department
! Persona-‐based approach ! Data mash-‐ups
– Financial/KPI’s/Metrics
– Ops
– Sociall
! Enterprise-‐wide user adopBon ! High value use cases
Intro to Personas
!
Persona is a concept we use to define various user types in a Splunk
deployment
!
This is different than a Splunk role
!
Core IT personas (e.g. SysAdmins, Developers and Splunk Admins)
keep systems running, fix them when they break and plan for
capacity
!
As your Splunk deployment grows out of Core IT…
–
Each business unit has their own set of personas
–
They have unique problems to solve and their preferred ways to
Business/Non-Core IT Personas
Account ExecuBve App Developer Business Analyst CIO/CISO/CDO Customer Analyst Data ScienBst MarkeBng Analyst MarkeBng ExecuBve Product Manager QuanBtaBve Analyst Security Analyst Technology StrategistPersonas at Oscar
OperaBons
Finance
Customer Service
Medical
Management
Data
Sales
ExecuBve
Designers
Eligibility
Provider Network
Oscar’s Power Users
0 15 30 45 60 75 Data Customer Service Medical Management Insurance OperaBons Developers Sales Finance ExecuBves Design Eligibility Product Managers SRE 1 2 1 1 1 1 1AnalyBcs Team Building
!
Data people have different skill sets and it’s important to include
Personas Requirements
As you encounter personas make sure you spend Bme collecBng
their search and reporBng and data requirements, but also pay
acenBon to the bigger picture.
!
Gather Requirements (What is their Business Problem?)
!
Get Relevant Data (Is the data they need in Splunk? What
other data helps answer their quesBons?)
!
Build Searches/Datamodels
Developing for Business: Gather Requirements
!
What is the quesBon I’m trying to answer?
–
What is their Business Problem?
–
What department are we dealing with?
–
Where do they fit in the organizaBon?
–
Who is the end user primary contact?
–
Do they have a (trained) power user?
–
Engagement/support model
ê Self-‐service?
ê Full change control/Formal requests?
Developing for the Business: Get Relevant Data
!
Where is the data that will help me answer the quesBon?
!
What are the relevant fields and what is the best way to retrieve
them?
!
What data sources drive those constructs?
!
Is the primary data in Splunk?
!
Can I enrich Splunk data sources with external data feeds and
provide mash-‐ups?
!
Should I be replacing legacy SQL queries with DBConnect?
Developing for Business: Searches/Datamodels
!
What is the sequence of operaBons that convert my data into the
answer for my quesBon?
!
What searches can they use to solve those problems?
!
How do I constrain and audit user data access?
!
How do I construct my search, build my datamodel, port my SQL?
!
Do I know where to get help?
Developing for Business: Consuming results
! Persona-‐relevant landing dashboard! Limit access to what they need to get the job done
– Time picker default Bmerange and limited opBons
– Form search
– Open in search vs open in pivot?
! Who will build and maintain the dashboards/datamodels? ! How do I construct my search, build my dashboards?
! How do they prefer to consume the results? Splunk? PDF? Tableau?
– Are we using the ODBC driver the right way?
– Returning search results vs exporBng all data
Oscar’s ReporBng Process
1. Power user creates report or dashboard (DBConnect, Search,
JIRA etc):
-‐ Power users have restricted access to allowed data -‐ They are idenBfied over Bme
-‐ Power users help each other answer quesBons
2. Report is given to Data team for review and lock down:
-‐ Is query opBmized?
-‐ Is data limited to “need to know”?
-‐ Is the report readable and understandable?
3. Data team publishes dashboard to restricted search head -‐ Limited adhoc searching (use saved searches + pivots)
Unified Member View
Unified Member View (ConBnued!)
Medical Claims Overview
Medical Claims Overview
Developing for the Business: AcBon It
! Show me claims that are at
risk of being paid late
! How are we doing
compared to the previous month?
! What percentage of claims
are on Bme vs. late?
! How many claims month
over month have been paid and at what amount?
! How many claims are paid
Vendor NoBces Emails
Even business processes
can be replaced with
simple dashboards:
Are email noBficaBons
from vendors arriving
on-‐Bme?
Oscar’s Build Pipeline
!
DBConnect’s SQL
Query Analyzer
!
Only Data team and
Developers access SQL
through client tools.
Everyone else uses
Splunk
!
Syntax HighlighBng,
Saved Searches,
Audited AcBvity, Real
Time AlerBng on
Oscar’s Build Pipeline
! Add restricted search
methods (inputs, dropdowns, etc)
! Add more panels, pipe to
splunk commands (top, chart, Bmechart,
anomalies, transacBon!)
! Lock drill downs ! Scheduled searches? ! Use the submit bucon! ! Consider using Monit for
Handles it Like a Champ
3 PM on a weekday
RetroacBve: What Would We Do Differently?
!
Use Pivot Tables for dashboards
!
Force users onto Splunk’s QA sooner
!
Implement dedicated
splunk_{role}
Professional Services Offering
30
!
Introductory Professional Services packages for uncovering Business
Value from Business AnalyBcs use cases
!
Tune your Splunk environment and opBmize your deployment for
expansion into new use cases
!
Assistance with requirements gathering, data inputs, dashboards,
architecture recommendaBons and documentaBon
!
Compliment tradiBonal BI investments and reach Business users
with high value use cases
!
Pre-‐Scoped, short engagements with concrete deliverables and
Growing beyond IT: Call to AcBon!
!
Everyone wants to move to OI Level 4
!
CIO and CDO care about Business Insight
and OperaBonal Intelligence
!
Build some easy execuBve dashboards!
!
The business cares about Business AnalyBcs
but crossing departmental silos can be
tricky
!
OrganizaBon, communicaBon,