Welcome to the swampUp interview with Tim Tully from Splunk. My name is Stephen Chin I run the Developer Relations team at JFrog. And, you know obviously we’re doing this virtually because of the current situation but very glad to have you here at swampUp Tim.
How you doing? Thanks for inviting me. You know I’m sheltering place just like everyone else. But being an engineer first and foremost and being an introverted engineer. I think being locked up at home is something I’ve been preparing for my whole life. Really cool. I would Somewhat agree with you there, although it’s somewhat taken a toll on the conference circuit. So I haven’t been physically going to many conferences recently. So why don’t you tell us a bit about Splunk and what your, what your role is at Splunk and what you’ve been doing there.
So Splunk is a, what has been called historically a data analytics company, going way back in, you know, to the 2000s has grown rapidly in the last decade or so, we were born really in log and analytics, especially in the sysadmin community collecting syslogs and other large sum from hosts. And what happened over time is that sort of use case has expanded into security and IT over the years.
I joined Splunk in 2017 to be CTO and have since inherited the product and engineering teams as well as the it and security orcs as well so and I mostly lead everything tech. With that, with that change of coming into Splunk part of my role is to start to Thinking about how to expand not only what Splunk does, Splunk part of my role is to start to think about how to expand not only what Splunk does, from the data platform perspective beyond, you know, just a time series index of unstructured data into other realms to fill out more of that data platform story. So a couple big things, there’s adding stream processing capabilities. In a product that we have called data stream processor is largely based upon open source. We’re using Apache Flink and Apache Pulsar predictions to be there. And then adding more features to the data platform to query non Splunk data sources. like federated search that allows you to use Splunk to query non Splunk data sources. So you can write like a Splunk query that queries S3 object stores in the cloud. As well, in addition to his platform capabilities, we’ve extended beyond into more of what we call observability. Or sometimes people call it DevOps. But really what that is, is metrics monitoring solutions, on top of cloud based applications, so if you built a microservices oriented cloud app that sits in a containerized environment on Kubernetes monitoring that application these days is much more challenging than it was, you know, a decade ago when you have a monolithic application that ran in a VM in a data center somewhere. So we’ve entered that, that space, and we’re seeing quite a bit of success there. That’s cool. And I know that you guys are expanding out in terms of like, like cloud and your observability. And, you know, DevOps, how much of that do you guys use internally? For your own teams inside of Splunk? Yeah, I mean, we’re obviously a DevOps shop. First and foremost, you know, we couldn’t build products that target Tech Community without being practitioners in our own right. Um, so we have a we have a lot of DevOps teams across the org, that are responsible for writing, testing, deploying, although their own individual services. At this point, we’re cloud first and everything we do so you know, people who write those services, they put them in production, they’re responsible for all the testing in the management and the complete software development lifecycle around from idea all the way through production. We live and breath CICD, just like most modern shops would. And I’d be remiss to not add that Artifactory obviously is at the center of everything we do in our CI CD pipeline, which ships our core product called Splunk Enterprise. The majority of our artifacts are required to have been tested, built in, monitored and facilitated, facilitated all the way through our build production pipelines and upload and download loaded. You know, those downloads and uploads are happening daily, if not hourly, on the order of something like eight terabytes of artifacts, and wow, that’s, that’s a huge artifact. Artifactory, is certainly been in the culture of our company. I actually came over to Splunk, from from Yahoo, and a lot of folks that the DevOps teams happened to join me from from Yahoo. And you know, we’ve been on an Artifactory journey for a number of years across multiple companies, and we love it. Cool. That’s awesome. So you guys, you guys are using DevOps processes within Splunk. So how about folks who are using Splunk solutions, how to how do those complement DevOps processes? Yeah, we use Splunk to observe and monitor all the components in our DevOps environments and build processes. We use it to gain a lot of insight on everything that’s happening from dev developer build time to service health to the agility and engineering teams. And really, it’s at the heart of everything we do within the teams. Cool. Now, that’s exciting. And what’s what’s the size of your development team? How many? How many folks? Do you have work at Splunk? Yeah, it’s it’s some, somewhere on the order of 1000, let’s call it and we divided obviously, in the scrum teams, just like most folks do, so that you can do the math that comes to around 100 Scrum teams or so. And really, they spend a lot of different functions. I talked about security it platform cloud, and they’re spread across the globe and across eight different product development offices, worldwide. So it’s it’s a pretty distributed shop. So like managing a distributed organization like that, has it become more or less challenging given the current situation? You know, I would say it’s about the same. Um, you know, in some ways, you know, we have more meetings during the day because you don’t have commute time. So you can you can replace your commute with the meeting. But you know, engineers, I think by nature are sort of like lone wolf sometimes, and you know, they enjoy being in front of the computer. And I think being at home actually is an opportunity, more than something that introduces drag. You know, being able to sort of sequester yourself and spend more time in the code is certainly something that I’m enjoying and I imagine Yeah, so you don’t you don’t need to hide with with headphones on at all sign which says do not disturb me, that’s my mentality. I’d rather be in the corner with headphones on staring at a terminal. But yeah, inevitably, my role requires me to be pulled into meetings, but a long you know, short answer to your question is I don’t see any drop in productivity and I think having access to tools from JFrog, definitely in This is not me plugging. But I think obviously helps with that productivity. Cool. And you mentioned artifactory. But what other sort of like integrations do you have with, with your artifact repository or with other things which are using? Yeah, Jenkins obviously is at the top of that stack. We use that pretty heavily. You know, some of the other tools that you would sort of see in the, in the tool chain are certainly things from HashiCorp. Right. So that’s a Terraform involved sort of running around. You know, we’re a pretty conventional shop, we use sort of all the most popular, most powerful tools that are out there. And, you know, JFrog is at the center of it. But, you know, we wouldn’t be a cloud company if we weren’t using some of the other tool chain solutions out there. So one of the things I was wondering is with the acquisitions of signal effects and mission, how you’re helping customers to improve their active and observability. So what kind of things are you looking forward to in your roadmap? Yeah, so the way we define the opportunity around observability is really as a couple of logs, metrics and traces. So, you know, Splunk has obviously been fantastic at logs over the years. And we bought signal effects in our mission to really knock out metrics and traces really, really well. With signal effects on metrics and on mission on traces, sort of, respectively. And so the roadmap that we’ve been on, and that sort of vector that we’ve been on is really bringing together metrics and traces under the same umbrella of signal effects. And so what we did after the acquisition there is combine those two, those two entities under the signal affects umbrella to build world class traces into what’s already there with metrics. And so what we’re doing over the remainder of the year is really trying to pull Splunk logs in the cloud together with signal facts in a way that it’s a it’s a total single pane of glass that’s absolutely seamless, so that you can go back and forth between any of the three as a best of breed solution. So we’re laser focused on that right now. Cool. Now that sounds exciting. And again, like, it sounds like you guys have a big focus on the cloud. How are you seeing adoption of the cloud in your customer base? Especially like, maybe pre post? What happened in March? Yeah, no, I think that’s a really interesting question. And I get it from all angles. And whether it’s, you know, people in the developer committee like yourself, or even investors this morning. You know, I’m not sure that COVID necessarily has changed it too much. What I would say, though, is I think I’ve seen an evolution just in my short time at Splunk. When I joined spunk in 2017, you know, had you asked me that question, I probably probably would have been more binary about it, where I would say, Hey, you know, there’s this camp of folks that are always going to be in the data center, and this camp that’s always going to be in the cloud, and they’ll never sort of touch or, you know, it’ll take years for these folks to migrate to the cloud. And what I’m really starting to see is a beginning of an acceleration towards the cloud. And again, I’m not sure that it’s COVID related, but with one small caveat, which is actually two I would add When is that folks that are in the cloud already are trying to go deeper in the cloud, want to be multi cloud. So, you know, they don’t want to be sort of fenced into any particular cloud vendor, they want to have some kind of, you know, arbitrage maybe, if you will, in a second public cloud. And, you know, I hear that a lot from customers, I think people are on different places on the journey with that some have sort of a toe in the water, and that second card and others have already made the transition, I think it’s more towards the toe in the water arena. Yeah, the sort of second aspect of that the one add is that I’m seeing, again, let’s have that binary sort of positioning in more folks in mind to be more hybrid. So as an example, we had a really big transaction at the end q4 last year, where a customer wanted to be hybrid in their own data center and also in GCP at the same time, and they’re using some of the Splunk services like our Stream Processing solution, to build sort of like a hyper converged pipeline that spans the data center in the cloud for them to be treated as essentially a single pane of glass. And so that’s sort of the the more nascent trend that I’m starting to see is a desire not to be pure cloud or pure data center, but sort of a combination of a sweet spot in between. Yeah, no, that’s, that’s really interesting. And I think that ties in well with the keynote, Shlomi just gave where he talked about how important multi cloud and hybrid are for the future of large companies and DevOps in general. So speaking of like DevOps and open source software, how are you guys leveraging more open software in your stack to take your platform forward? Yeah, we use open source extremely liberally. Right now it’d be almost impossible for me to enumerate all this all of the projects. You know, if you wanted me to sort of name drop some of the big ones we’re using heavily or contributing to its Apache Flink, Apache Pulsar, we actually bought a company that kind of the open core champion around around Pulsar called Streamlio a few months back And we’re using it inside of our stream processing engine that like I talked about earlier, but we’re also giving back to the community. So you know, we’re not just buying an open core company and then sort of sitting on it and not donating the code back. We’re all about the open source community supporting it. so heavily invested there. Obviously, we use sort of all the usual suspects, Docker, Kubernetes, um, you know, the _ envoys of the world. It’s, it’s all in there. And then through the observability work that we’re talking about earlier, we actually became fairly involved in the open telemetry project as part of CN CF. And so we actually have two out of the eight chairs are actually Splunk representatives from those acquisitions. And we’re actually really, really we donated a lot of code from signal FX to open telemetry, whereas we call it otel internally, and we’re really proud of that. Now, that’s awesome. And I think that’s something which both our companies are aligned in and giving, supporting open source, giving it back to the community and making sure that folks can take their own businesses. forward with the same great open source solutions, which we use internally. So I think one other thing, which is really cool, which we both share in common, too, is a focus on trying to help make the global situation better given the current pandemic, so we launched an initiative called Frog Care to support startups and companies, which are doing work relief work for COVID-19. And I think you guys also have launched some awesome efforts since the pandemic started. Yeah, we, we announced something called remote work insights, which you can you can actually pull off of GitHub, that was based on our own internal IT organization’s efforts to use Splunk to basically monitor ourselves. So with everybody working at home, we wanted to have insights into how’s the VPN concentrator performing, you know, zoom doing well, you know, we wanted to get a sort of read on how long employees you know, we’re sitting in front of zoom calls all day long. So if you’re interested in the frequency and duration of the meetings, but you know, not who’s in the meetings, obviously, that’d be nice. crossing a line, a lot of Microsoft integration in terms of the tool chain that we use there. We just announced the Cisco WebEx integration. So we’re basically integrating all those sort of usual suspect tools from the tool chain into this dashboard so that other teams that are in our position like yourselves, or like us, can have their IT teams make sure that the folks that are working from home are productive, and everything is healthy and alive. And so we open sourced that that product and put it again, like I said, put it on GitHub. And it’s the same exact dashboard that we’re using in our own teams to make sure that you know, the VPN concentrator is not under duress, right. So, you know, that’s just one use case. But we’re out there just like you guys are trying to do our part the best we can. Yeah, that’s cool. And it sounds like you’re you’re using the tools internally to to help your own processes, improve productivity. And I think probably, despite the pandemic, these are just a lot of things that which are general useful in general for companies which are so widely geographically distributed. Yeah, I mean, I think that tool probably has a lot of legs. Even after we all get back to the office. It’s turned out to be a boon. In some ways. They’re sort of like a silver lining to all this in, in various forums, despite, you know, all the sort of bad parts of it. You know, there’s this, there’s opportunity in the darkness. Right. And I think for you guys, you’ve done an awesome job on your end, sort of with the more benevolent aspects of what we can do is as as large companies, and we’ll continue to continue to do the same on on our end. Yeah, no, that’s awesome. Okay, and then just at a higher level, what would you look at as some big things that we should look forward to in the coming year from from Splunk? Yeah, I keep talking about our stream processing engine. We’re really excited about that. You know, customers are definitely finding a lot of value in that and asking a lot of questions and customer briefing meetings. So we’re going to continue to invest in that product. Customers are finding a lot of use cases that they can move from more of a batch orientation into the stream cutting down latency. And the way that we’re we’re sharing it with customers is they use it as a real time Stream Processing ETL engine to prepare data in detail that before goes into Splunk or any other subsequent downstream system. And there’s obviously data bus and routing use cases that you can sort of pile on in there. But the reason I mentioned that first is we’re also laser focused on adding a lot of machine learning use cases into the stream. So we introduced this notion of what we call unbounded learning. What that does is we sort of reconceptualize how how machine learning works all together to take it out of more of a batch sort of orientation, where you do some feature extraction, you train a model, and then you deploy it to something that’s more online or sort of sentiment, where if I’m looking for anomalies in a log stream, for example, we have machine learning available that would run in the stream that can learn continuously, rather than having to be trained. So it’s basically trained Although the trade off of customer data, and it’s actually learning on the fly, yeah, it’s learning online. So a lot of the machine learning that we’re working on is essentially online at this point. And clearly, you know, you can’t just take something from the offline world and just, you know, drop it into the stream, you have to sort of rewrite it from scratch. And we’re seeing a lot of success in this in our customer base. And based on that success, we’re going to continue to invest. And then the last is that you know, aligned with the questions that you asked, really, really investing into the DevOps sort of observability community and building out that product suite to support the folks that are watching your conference home. Okay, so to close this out, Tim, do you have any advice for members of our audience who may be are growing their career in DevOps or technology about the the best things which they can do to to improve their career? Yeah, I am. I love when I get that question. I think I think the response that I would usually have is just keep coding and stay thirsty and say stay hungry. Right? I think too often than not, what I see is folks want to rise up too quickly. And somehow, you know, they think the solution to being more successful is becoming a manager and rising up that way, I would actually go the opposite direction. And I think that’s actually the path that I took, which is, you know, I stayed as an IC as long as I as long as I possibly could, you know, I always thought I actually never thought I would wind up running large teams, I just wanted to write the code and build huge, you know, scalable systems. And I think that actually helped me a ton because it gave me a lot of experience to understand sort of a variety of how things are built. And let me be in a number of different teams and got exposed to a lot of different working styles and cultures. And just always having a passion for it, right. I never really got into computer science or coding or any of that, you know, for money or fame or any of that is more because I was sort of like that nerdy kid in the chess club. That you know, just Just like computers, and I was just really into it. And, you know, I was doing it for the right reasons. So, you know, make sure to aligns with with your passions, you know, don’t try to, you know, jump the shark and become a manager too soon, that’s sort of unnecessary because you’re going to be sacrificing years of experience developing code. And, you know, the last point I would add is, is understand that, from microseconds perspective, the hardest thing about software development, honestly, is the people not the code or solving the tech, I mean, there’s solutions to all those problems because they’re deterministic, but people are non deterministic, and, and the people tend to be tend to be the hardest part of all these problems. And I think, you know, staying in teams for a longer time helped a ton and, you know, trying to, to manage some semblance of emotional intelligence has has helped as well. And, you know, I think, you know, reading those emotions, intelligence books and having kids help to build that up a bit. Cool. No, that’s, that’s awesome. And I think I can echo that from from my career. Because I’ve always looked at understanding the technology and applying the technology as perhaps the more important aspect, whether I was doing the day job or just doing it for my own interests and hobbies, and fun. So I think that’s a great sideway back into the the conference here. So thanks so much for the interview. Tim, I think there’s a lot of things which you brought out which our audience can learn from about Splunk observability monitor ability, what you guys are doing with your entire DevOps platform that also leverages a lot of the technologies we’re going to talk about, such as some of the the JFrog products, and a lot of the sessions we have lined up for the rest of swampUP are exactly for that purpose to educate folks to bring outside opinions and experts who can help you learn about the latest practices, and just in general to help everyone kind of uplevel your own skill set, and also what you’re doing at your company. So I hope you enjoyed this short interview with Tim. And please look forward to lots of other great sessions today at SwampUP Online!
