Alan Williams, Principal Engineer at Autodesk, and Praveen Rangnath, Director of Cloud Product Marketing at Splunk, presented at a conference in Las Vegas on November 13, 2014. They discussed how Autodesk has reduced costs by 35-50% by migrating infrastructure to AWS and how Splunk provides log aggregation and analytics across all of Autodesk's AWS accounts. They also provided examples of Splunk applications for AWS CloudTrail, business intelligence dashboards, and security incident response.

1. November 13, 2014 | Las Vegas, NV
Alan Williams, Principal Engineer at Autodesk
Praveen Rangnath, Director of Cloud Product Marketing at Splunk

2. Engineer @ Autodesk
General technologist
AWS for ~4 years
Splunkfor ~1 year
Motorcyclist
Soft spot for pit bulls
Who am I?

3. Leader in 3D design, engineering, and entertainment software
Introduced AutoCAD in 1982
Empowering the Maker movement
Help our customers imagine, design, and create a better world
Who is Autodesk?
http://autode.sk/1iwthdz

4. iOS apps

5. Android apps

6. students.autodesk.com
Get free access to the software used to make the games, movies, buildings, and products that inspire you.

7. © 2014 Autodesk
Why AWS?

8. Take inventory of existing hardware
Use the AWS calculator
http://calculator.s3.amazonaws.com/index.html
Cost/compute analysis
Let’s begin with cost analysis…

9. Cost analysis —account for everything
Hardware and maintenance
Power and cooling
Rack space
Storage
(FC + SATA)
Servers
Load balancers

10. What we noticed…
Total cost of server hardware
vs
Total cost of AWS instances
=
35% lower for AWS
Total cost of all on- premise infra
vs
Total cost of all AWS infra
=
50% lower for AWS

11. We can’t compete on price
Economies of scale
We can’t compete on speed
Time to provision
Time to innovate —deliver new features
Outcome

12. Production workloads
Customer facing
Business critical
Big data analytics
Dev/test environments
Net new systems
Proof of concepts
Many AWS use cases

13. © 2014 Autodesk
Why Splunk?

14. Leverages existing investments
Standard log aggregation platform
SplunkApp for AWS
Familiar technology
Logging = Splunk
Single view across all accounts
Why Splunk?

15. Operations insights and troubleshooting
Analyzing data from thousands of endpoints globally
Centralized visibility across all AWS accounts
SplunkApp for AWS CloudTrail
Security incidents response
Event auditing
SplunkApp for Enterprise Security
Business intelligence
Product metrics dashboards —executive visibility using Splunk
Product analytics
Assurance for AWS adoption

16. AWS CloudTraildashboard

17. Business intelligence

18. Incident response

19. Has this compromised host made any API calls?

20. Where were these IAM keys used?

21. Where are sign-ins originating?

22. © 2014 Autodesk
Splunkon AWS

23. Splunkarchitecture on AWS

24. AWS CloudTrail + Splunk
Amazon
SNS topic
Amazon
SQS queue
AWS CloudTrail
Amazon S3
Amazon
SNS topic
AWS CloudTrail
1 1
2 2
3 3
4 4
5
Account A Account B
Core services account
 Simple to configure
 Scalable to many accounts
 Central logging view across
all accounts

25. Tenets to running Splunkon AWS
Automation
AWS CloudFormation template —http://goo.gl/Hn309p
Ansibleplaybook —http://goo.gl/fulJPc
Scalability
Easy and quick to add/remove nodes
Autoscaleeverything
Splunksearch head pooling*
Performance
Search heads (CPU bound) —C3 instances
Indexers (IO bound) —C3+EBS, I2, HS1 instances
Maximize IOPS with RAID O

26. AWS + Splunk = happy marriage
Scalable to 100s of accounts
Platform for operations, security, and business
Summary

27. AWS CloudFormation Splunkcluster template
https://github.com/alanwill/cfn-splunk
AnsibleSplunkplaybook
https://github.com/alanwill/ansible-splunk
Try it yourself…
Pull requests encouraged

28. Autodesk is a registered trademark of Autodesk, Inc., and/or its subsidiaries and/or affiliates in the USA and/or other countries. All other brand names, product names, or trademarks belong to their respective holders. Autodesk reserves the right to alter product and services offerings, and specifications and pricingatany time without notice, and is not responsible for typographical or graphical errors that may appear in this document.
© 2014 Autodesk. All rights reserved.
@alanwillalanwill

29. 29
Splunkcompany overview
Company (NASDAQ: SPLK)
Founded 2004, first software release in 2006
HQ: San Francisco / Regional HQ: London, Hong Kong
Over 1,200 employees, based in 12 countries
Annual revenue: $302.6M (YoY+52%)
Business model / products
Free download to massive scale
On-premises, in the cloud and SaaS
7,900+ customers
Customers in 100 countries
Over 2/3 of the Fortune 100
Largest license: 100 terabytes per day
Fast Company 2013: Named Splunk #4 Most Innovative Company in the World and #1 Big Data Innovator
Leader: Gartner SIEM Magic Quadrant, 2014

30. What is machine data?
Volume | Velocity| Variety | Variability
GPS,
RFID,
hypervisor,
web servers,
email, messaging,
clickstreams, mobile,
telephony, IVR, databases,
sensors, telematics, storage,
servers, security devices, AWS CloudTrail
Machinedatais the fastest growing, most complex, most valuable area of big data
30

31. 31
What does machine data look like?
Sources
Twitter
Care IVR
Middleware error
Order processing

32. 32
Machine data contains critical insights
Customer ID
Order ID
Customer’s tweet
Time waiting on hold
Twitter ID
Product ID
Company’s Twitter ID
Sources
Twitter
Care IVR
Middleware error
Order processing
Customer ID
Order ID
Customer ID

33. 33
Machine data contains critical insights
Order ID
Customer’s tweet
Time waiting on hold
Product ID
Company’s Twitter ID
Sources
Twitter
Care IVR
Middleware error
Order processing
Order ID
Customer ID
Twitter ID
Customer ID
Customer ID

34. IT
operations
Security and compliance
Digital intelligence
App devand
app mgmt.
Developer platform (REST API, SDKs)
Business analytics
Industrial data and Internet of things
Small data. Big data. Huge data.
Use cases for machine data analytics
34
Core use cases
Emerging use cases

35. Industry-leading platform for machine data
Machine data: Any location, type, volume
Online Services
Web Services
Servers
Security
GPS Location
Storage
Desktops
Networks
Packaged Applications
Custom
Applications
Messaging
Telecoms
Online Shopping Cart
Web Clickstreams
Databases
Energy Meters
Call Detail Records
Smartphones and Devices
RFID
On-
premises
Hosted
Cloud
Platform support (apps / API / SDKs)
Enterprise scalability
Universal indexing
Answer any question
Developerplatform
Report and analyze
Custom dashboards
Monitor and alert
Ad hoc search
35

36. Comprehensive solutions for AWS
Software-as-a-service Self-managed software
App for AWS Integrations
Amazon machine images
Hunk — Amazon EMR
integration
AWS
CloudTrail
Amazon
CloudWatch
Billing Starling Amazon S3
Amazon
ELB
36

37. Full
featured
Enterpriseready
Easy
37

38. Splunk Cloud —Full-featuredSaaS platform
Full power of Splunk Enterprise
Access to 600+ apps
Hybrid deployment architecture
38

39. Hybrid search
Search Head(s)
Indexer(s)
Search Head(s)
Indexer(s)
On premises
Hosted
Cloud
On premises
Hosted
Cloud
Single pane of glass visibility
39

40. Splunk Cloud —Enterprise-ready service
Industry-leading scalability and flexibility
Architectedfor uptime and performance
100% uptime SLA
Robust enterprise security
5 GB/day—5 TB/day plans
No data comingling;
security attestations
40

41. High availabilityacross indexersand search heads
Multiple AWS Availability Zones
Dedicated environments
Splunk Cloud fully monitored using Splunk Enterprise
Built for 100% uptime
41

42. Splunk Cloud —Easy
ACCELERATED TIME TO VALUE &
FASTER ROI
Starts at $675 per month / 33% price reduction
Splunk Online Sandbox
Immediate deployment
42

43. Forward data
Search
Monitor
Get value fast
What you do
Hardware setup
Storage
Scaling
Monitoring
What we do
43

44. http://bit.ly/awsevals