Splunk is the data-to-everything platform. But are you making use of all your data? Could you be getting more from the data that you already have in your Splunk platform?
Splunk is a great big data platform with tons of integrations available out of the box and many options to bring in custom data sources. Splunk can appear very expensive as you begin to bring in more data under the Splunk Enterprise License Model; however, if you leverage the platform to its full potential, the return on your investment will be significant.
Potential Use Cases for your Splunk platform
To make the most of your Splunk investment and extract maximum value, you need to use the data you’ve on boarded to Splunk for as many use cases across your business as possible.
To get you started, here are a few ideas:
IT Operations
The big win here is a reduction in Mean Time To Resolution (MTTR) for your incidents. This means making sure you are monitoring your critical infrastructure. Note, this does not mean monitoring everything. In fact, monitoring every single endpoint with all logs and metrics turned on will generate a lot of useless data. Be judicious but at the same time try to anticipate which systems, if lost, would cause a high-priority incident. A lot of this data can also be used across many different use cases, for example, capacity planning.
Application Support
Make sure you are monitoring your important applications in production sufficiently. Dev and other environments are important too, but production systems are essential. When you have a production issue, you will need all the information you can get, so make sure you are monitoring end to end – from the user to the database and through to external services.
If you are doing this right, it may be possible to retire some of your individual tools and replace them with end-to-end transaction-level monitoring.
Application Development
Splunk is super beneficial to Dev teams as a testing tool. You can reuse the dashboards and alerts for production Application Support to test if a new code drop will break anything. Again, end to end is the name of the game here. Yes, bringing in data from more sources will use more licenses, but if you then use the same dashboards and alerts to support the Application in production, you automatically get much better value. You can even get Splunk to feed failures back into your pipeline as defects.
Security and Compliance
Security is definitely one of the biggest use cases of Splunk that we see. It is also the area that can add the most value. Consider the value that can be provided by preventing a major security breach. The way to get full value here is to ensure that the IT Operations monitoring data sources are reused for infrastructure security.
Firewall data is a big-ticket item in security and provides a lot of value for threat detection, but don’t overlook DNS logs and DHCP logs as there is a lot to be gained from correlating these three to identify threat vectors.
Your Splunk Platform
The Splunk platform unlocks a wealth of data across the business but are you getting maximum value from your investment? We speak to many organisations that have invested money into the platform but have not optimised it for their needs. If not utilised correctly, it is an expensive tool, but when leveraged to its full potential, it is very cost-effective. At Avocado, we have a dedicated Splunk practice with one of the most qualified and experienced teams across the complete Splunk product set including premium apps. This allows us to work with organisations to realise the full capability of their current Splunk platform. We have an online Splunk ROI Calculator that indicates how well you are utilising your platform and tips on gaining more value from your current investment. Check it out to see if you could be better leveraging your platform.
If you would like to speak to a member of our Splunk practice directly, please feel free to reach out to us via our contact page!
