Copyright © 2015 Splunk Inc.

Aaron BlytheKnowledge Architect, Cerner Corporation

Guerrilla marketingHow to sell Splunk internally to your Enterprise

2

DisclaimerDuring the course of this presentation, we may make forward looking statements regarding future events

or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results

could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forward-looking

statements made in the this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information.

We do not assume any obligation to update any forward looking statements we may make.

In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not, be incorporated

into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release.

Aaron Blythe

Writing CodeAnswering questions

Running Meetups

http://aaronblythe.org/

@ablythe

Health care is too importantto stay the same.TM

The solution that started it all

Cerner today

Population health management

Fitness Center

RetailPharmacy

Hospital

Member

School Long-TermCare

HomeClinic

Employer

Connect

Empower

Facilitate

Move from reactive careto proactive health

Member engagement across the spectrum

Cerner’s success

#4Top 100 Healthiest Workplaces in America

5-year results• Lowered premium increases

• 1.6% vs. 7-10% national average

• Decreased risk factors

• Improved biometric screening results

10

Agenda

Know who you are Make things surprisingly easy Gather endorsements Be helpful in many mediums Promote your community Create champions When all else fails, hold a contest

11

“I’m referring to the soul and essence of guerrilla marketing which remain as always —

achieving conventional goals, such as profits and joy, with unconventional methods, such as investing energy instead of money.”

Know Who you Are

13

2015 We Believe

• Enable self services• Transparency leads to better service

• Everything in source control- Cerner OpsInfra Team

14

2014 We Believe…

• A minimal number of associates need to directly touch nodes (approaching zero)

• These tools matter – improve the lives of our users• Tools should be hardened - so that we can find the

root cause and drive corrective action

15

16

SurveysUse Google Docs FTW!!!

17

Be Transparent

Make things surprisingly easy

19

Chef Cookbook

20

What we need1 hour meetingPerson in the room with:– troubleshooting knowledge of application (which logs are valuable)– root access to the node (so we can bootstrap Chef)– knowledge of Splunk and Chef (someone from my team)

21

StepsBootstrap nodes to Chef with Cerner_Splunk role on run listRun chef-client on nodes

22

Hide everything but the detailsChef Role Chef Environment

23

Jira Usage

24

Not Top Down

• Is this the right thing to do?• Will it take very much index?

Gather Endorsements

26

Creating AlliesSplunk has played a vital role in stabilizing our Jira environments. In what would have taken weeks of manual correlation and analysis can be summarized in Splunk in matter of minutes.For example we were able to identify a server was excessively calling our server, then moving straight from that to the URI’s that the server was accessing. We were able to contact the team that was abusing our service and they were able to scale back their web calls correcting our slowness issue. Without Splunk I feel that this process would have taken weeks to discover, if at all. This is saving my team time in investigation, not to mention the time of all other associates by resolving this slowness issue quicker.Joe HostlerSystem Engineer, CWx Emerging Technology Services

27

Document the nice things

Be Helpful in Many Mediums

29

Go to where the users are asking questions

Internal logs in Splunk Internal logs not in Splunk External

30

Provide a Place to Discuss

31

Provide Education

Promote your Community

33

Encourage

34

Seize the Opportunity

• Meetups• Conferences

35

Internal ConferencesDevCon 2012 – 1 talkDevCon 2013 – 0 talks on Splunk

Started Opsinfra team

DevCon 2014 - 1 talk from Opsinfra teamDataCon 2014 – 1 talk from Opsinfra teamDevCon 2015 – 3 talks (1 from Opsinfra team)DataCon 2015 - 3 talks (1 from Opsinfra team)

Create Champions

37

Garry Polley

• Canadarm – Open Source Project• Configurable JavaScript collection• Send information back to Splunk

http://engineering.cerner.com/blog/javascript-logging-we-can-do-better/

38

Rima Poddar

• Defined and explained eventtype usage• Prototyped first working alerting sub-

system

http://engineering.cerner.com/blog/managing-30000-logging-events-per-day-with-splunk/

39

Mike Hemesath

http://engineering.cerner.com/blog/managing-30000-logging-events-per-day-with-splunk/

• Defined and explained eventtype usage• First major use of pivot tables • Many internal presentations to other

teams and leadership• Push for standardization

Hold a Contest

41

42

43

44

Extend the DeadlineWe did this 3 times, got more submissions each time.

Review

46

Summary

Know who you are Make things surprisingly easy Gather endorsements Be helpful in many mediums Promote your community Create champions When all else fails, hold a contest

THANK YOU