Specific Objectives for using Splunk in Datacenter environment

[pgadhari]

Hello Experts,

We are a Corporate Data center in our Internal IT department of the company. We host intranet services (HRMS, Knowledge management, ERP, project management, helpdesk, apache, jboss, weblogic, oracle, postgresql, AD etc.) for all our company employees. Our environment contains Unix/Linux/Windows servers, vmware, storage, backups, network, firewalls, dominos messaging and VOIP services. I approached Splunk and they are asking me what are our business objectives for Data Analytics and Operational Intelligence in Datacenter. Actually I am expecting that Splunk team can help us in finding our objectives/use case, but somehow I have jotted down some lists. But I still need more inputs/suggestions on this. Can you provide any inputs on this ? what can be more specific objectives ? I am asking this, as there are lot of people here who are using Splunk in real life scenarios, I want to hear from them.

1. Log/Event co-relation from Web stack to Infrastructure stack, for faster issue tracking and resolving.
2. Identify bottlenecks and other disruptions to service
3. Operational Visibility
4. Capacity analysis and management - identifying under-utilized or over-utilized resources
5. Business Insights on the Performances of the Applications
6. Predictive analysis
7. Data Center Compute Efficiency
8. Service Availability

Thanks
Pankaj

[Splunker]

Here's some more..

• Security (user trends, user locations, tracking authentications, dealing with multiple identities of the same person, unauthorized scans, malware/C&C activity, unauthorized change, proxy monitoring, A/V, etc etc)

• Compliance (virtually all IS standards have centralized logging as a fundamental tenant)

• Traffic trending/analysis (wether from firewall logs, flow-data, etc..)

• Customer research/Business Analytics

And what Splunk like to call "Operational Intelligence" 🙂

Cheers.

[pgadhari]

Agreed Splunker, but apart from this what all reports I can generate from OS, Server, apache, weblogic and database point of view. Can you put down some points for that please ?

Thanks