You are currently browsing the tag archive for the ‘IT Performance Management’ tag.

Splunk may be one of the biggest software companies you’ve never heard of. I’ve been following the seven-year-old company for over six months now and recently attended its second annual user conference. Splunk focuses on analyzing large volumes of machine-generated data in underlying applications and systems, which includes application and system logs, network traffic, sensor data, click streams and other loosely structured information sources. Many of these “big data” sources are the same sources analyzed with Hadoop, according to our recently published benchmark research. However, Splunk takes a different approach that focuses on performing simple analyses on this data in real time rather than the batch-based advanced analytics we see as the most common use for Hadoop.

Although privately held, Splunk operates much like a public company and appears to be grooming itself for an initial public offering. In its fiscal year ended January 31, 2011, Splunk reported $66 million in revenue and has announced that its goals for FY 2012 include generating $100 million in revenue. With 68% and 70% growth in its first two quarters this year, Splunk appears to be on track to meet this goal. CEO Godfrey Sullivan, formerly CEO of Hyperion, has a successful track record in the business intelligence software space. All these indications suggest a promising future for the company. Data originates from a variety of sources in ever increasing volumes, and organizations are trying to figure out how they can maximize the value of this data. Splunk has rapidly grown based on the simplicity of the tool for IT professionals to adopt and utilize against machine or IT specific data from an individual or department that according to our IT Analytics benchmark finds plenty of demand in IT.

As stated above, Splunk focuses on a specific segment of the big-data market: machine-generated data. This type of data originates constantly from many sources throughout an organization and in large quantities. The other common characteristic of machine-generated data is that generally it is less structured than data in typical relational databases. Often the information is captured as logs consisting of text files containing various record lengths and record structures. To effectively utilize this loosely structured information in real time, two challenges must be overcome: loading the data quickly and easily navigating through and analyzing the information once it is loaded. 

Splunk tackles the first challenge by loading the information in its raw form. No preprocessing is necessary, therefore no delay is introduced and no data is “lost.” Retaining all the raw data has business value as well. If you later decide that you want to investigate some new piece of information that previously you didn’t think was important, it will be available for analysis.

A search-based mechanism provides the solution to the second challenge. Our information applications research shows the importance of search, which ranked third on the list of very important analysis capabilities overall, and for end users specifically it topped the list of very important capabilities (46%), ahead of navigating to and retrieving information. Search based access to analytics has been a large driver in growth and was highlighted by my colleague in 2009. Search overcomes the issues created by the lack of “structure” in the machine-generated data. In reality the data has plenty of structure – users search for strings representing occurrences of certain types of events. Splunk supplements the query mechanism with analytical functions that can be used to create aggregates, time-period comparisons and other common analyses. In addition, queries can be saved for reuse and as the basis of reports, dashboards and alerts. I heard anecdotal proof of the value of search at the Splunk user conference from two undergraduate students who, as part of their summer internship, had learned the Splunk query techniques quickly and implemented reports and analyses for monitoring the systems of a major financial services software company.

Architecturally, Splunk employs massively parallel processing to spread the data and processing across a number of individual servers. At query time, a proprietary MapReduce mechanism – one not based on Hadoop – gathers the data from the individual nodes to satisfy the user’s request. Users do not need to know about the MapReduce mechanism. The translation of the query to the appropriate execution strategy is done automatically. However, as with any distributed data system, some knowledge of how the data gets distributed across the nodes can be helpful in identifying performance bottlenecks and tuning certain slowly running queries.

The currently released version, Splunk 4.2 was introduced earlier in 2011 and includes real-time alerting on streams of data. It also includes a new agent-based data collection mechanism, called a universal forwarder, that makes the task easier and provides more reliability when collecting data from multiple endpoints or devices. Splunk separates the workload between indexers that perform the data loading and search heads that execute the queries. Version 4.2 introduced search-head pooling for load balancing so searches can be directed to anyone of the search heads; it also provides high availability among the search processes.

At the conference, Splunk introduced version 4.3 and made the beta version available to registered users. One of the more popular demonstrations was Splunk 4.3 running as a non-Flash application on the iPad. The company also made a number of announcements of specific applications and extensions of the product. Splunk Storm provides visibility and operational analytics of cloud-based applications. Splunk App for Citrix XenDesktop and Splunk App for VMWare provide visibility into virtualized and private cloud environments. The company also introduced a software development kit (SDK) for the Python programming language, which is open source and available at github.

The Splunk product is not perfect, of course. Continued investment in the user interface is needed to make it easier to use. Currently users have to learn the Splunk syntax – I was introduced to those internals to show that this is easy – and a graphical query interface also would make the product more widely usable. When I probed about high availability, it became clear that you can use the Splunk tools to load dual systems to have a standby system in case of failure, but that’s not done automatically. But the company representatives were open about its shortcomings with both me and its customers, which was refreshing.

Nearly every organization has some form of machine data. Splunk says that more than 2,900 enterprises have found a reason to purchase its products. The company’s mission is now to raise its visibility and broaden its applicability. Splunk provides a free, limited-capability version of its product so you can try it for yourself and see if it applies to your needs.


David Menninger – VP & Research Director

As part of our largest-ever research study on business analytics, which surveyed more than 2,600 organizations covering the maturity and competency of business, IT and vertical industries, we looked at how IT is applying analytics to support their own business activities. One of the things we found is that, charged with enabling business units to use information systems as effectively as possible, the IT department, like the shoemaker’s barefoot children in the old tale, typically stands last in line for resources to manage its own performance. In trying to understand and tune the collection of networking and operating systems, middleware and applications an enterprise needs to operate, IT professionals usually have to make do with small sets of historical data stored in spreadsheets and data warehouses and marts that are not as well managed as the systems they maintain to support the business. In most cases IT cannot apply the same level of analytics to its own operations that it provides to business units. This also has effects beyond IT itself: To the extent that the result is subpar performance of its core information systems, the business will suffer.

To break out of this frustrating cycle, IT needs to make the rest of the organization aware of the role it actually performs, of course, and it needs metrics and measurements, which require analytics to standardize and routinely generate them. IT needs to be able to analyze both historical and real-time events involving data and processes so managers can determine the right level of automation and efficiency to demand from the technology. And IT needs the capability delivered by predictive analytics  to anticipate situations and outcomes so it can prepare properly for them. In short, the CIO and IT staff need to manage their portfolio as a business asset, not merely a collection of technologies.

Metrics about its own operations and systems also enable IT to determine priorities for improvement. To fully understand the state of their existing investments and processes, IT organizations should not just measure them but analyze them to develop insights on future outcomes of their systems. This more sophisticated approach to analytics can help IT determine where to focus resources and what to do with legacy systems. Knowing this, it is possible to prioritize precious budget dollars and justify IT investments more convincingly.

Our research found that IT’s concerns currently center on cost and operational efficiency. The most important financial metrics are return on investment, cost per project, budget utilization and adherence to budget. The most important process metrics address timeliness in IT’s core function of service to the business: delivery of projects on time, speed of technology implementation and help desk response time.

In our research, which we presented in this webinar on IT analytics, of the participants’ perceptions of which metrics are most important for executives and managers, two loomed large: business user satisfaction and compliance with service level agreements (SLAs). The executives themselves rated the two metrics nearly equal in importance, but their management reports (vice presidents) by a slight margin most often named adherence to governance and risk management requirements rather than either of those. These responses suggest that people may work somewhat at cross-purposes in pursuing IT analytics.

The research also finds strong suggestions that organizations ought to involve more people in the process of establishing requirements for defining analytics. Research participants asserted overwhelmingly that they and the head of their business unit are involved in establishing requirements important to their jobs, but percentages drop for heads of other business units and business analysts in other business units. This disparity takes on more weight when we recall that business user satisfaction and SLA compliance are important metrics for leaders.

For analytics to deliver value, they must be available to those who need them; the research shows that this is an issue for many organizations. No more than half have analytics generally available to address any of seven major IT management tasks, and only for budget analysis are analytics completely available in even one-fourth of organizations. In a related finding, more than half said it is very important to make it simpler to provide analytics and metrics; less than 10 percent said that is only somewhat important or not important. As well, over a third said they can significantly improve their use of analytics and performance indicators, and over a third are not satisfied with the process currently used to create analytics.

The process of applying analytics also impacts IT’s effectiveness. The IT Analytics benchmark research found that users in nearly two-thirds of all organizations spend most of their time in unproductive chores that precede analyzing their data: preparing it for analysis, reviewing it for quality and consistency and waiting for it. And before that, issues in collecting the data raise another roadblock. In more than half of organizations, doing that is very difficult or a challenge that impedes creating metrics and performance indicators.

These functional barriers also can get in the way of analysts performing important tasks. Among capabilities they need in order to work effectively with analytics and metrics, 42 percent said access to source data is the most important, and at least one-third identified as most important the abilities to search for existing data and analytics, to take action based on analytics and to design and maintain both business models and metrics for analytics. Applying predictive analytics to project future outcomes, a hallmark of advanced maturity in the use of IT analytics, was cited by 31 percent.

IT professionals need appropriate tools to facilitate these and other analytics-related activities. In more than half of these organizations, business intelligence technologies for query, reporting, analysis are the most important of these tools. Yet even in this technologically astute environment, desktop spreadsheets are often used to generate analytics and are an important information source for building IT. But spreadsheets require manual effort to populate the data and are prone to error, and thus are not appropriate for collaborative and enterprise-wide activities. We think their widespread use is a factor in half of organizations being only somewhat satisfied or not satisfied with their organization’s current technology for creating and applying analytics.

As part of our benchmark research methodology, Ventana Research has developed a model for assessing maturity that classifies organizations at four maturity levels (from bottom to top, Tactical, Advanced, Strategic and Innovative) in each of four categories: People, Process, Information and Technology. With respect to their use of and plans for IT analytics, our Maturity Index analysis found only 15 percent whose responses place them at the highest Innovative level of maturity. One important finding reflecting on organizations’ maturity is that two-thirds said the data used in preparing metrics and performance indicators is only somewhat accurate or somewhat inaccurate. As well, it takes 35 percent of organizations more than one week to provide updated metrics and performance indicators to people and nearly as many up to a week to provide them.

It is a positive sign that improvements, if made, will be done most often to improve business processes or decision-making rather than for operational efficiency and cost savings. The first two motivations are more likely to produce better business results. Similarly, maximizing IT effectiveness and improving the value of IT to business managers are more important than issues involving resources, costs and budget.

However, these opinions come from organizations that plan to change the way they generate and apply analytics in the next 12 to 18 months, and they comprise only 28 percent of the total; another 36 percent said changes are needed but are not currently a priority. The primary barriers to such an initiative are both fiscal (lack of resources and budget) and perceptual (lack of awareness and a sense that the business case is not strong enough). Recognizing a problem but not being willing or able to remedy it is another sign of immaturity.

To maximize its value, IT should use analytics and metrics to help set its own goals and objectives and to ensure they serve the business strategies of the organization. This innovative path is embracing IT performance management. Few organizations have taken the necessary steps to actually manage performance and align, optimize and understand the range of their IT processes and resources. We believe, and this benchmark research confirms, that it is time for them to take those steps, supported by executive management in providing resources.


David Menninger – VP & Research Director

Follow on

Enter your email address to follow this blog and receive notifications of new posts by email.

Join 22 other followers

RSS David Menninger’s Analyst Perspective’s at Ventana Research

  • An error has occurred; the feed is probably down. Try again later.

David Menninger – Twitter

Top Rated

Blog Stats

  • 46,527 hits
%d bloggers like this: