First, we see
Unicenter+
Splunk pitched as a two complimentary products. That certainly makes sense. As we outlined in
our briefing notes on Splunk, they're specifically not about "higher level" systems management, like service tracking or even complex event handling. Splunk is squarely focused on log searching and the implied event indexing, while CA is more concerned with those higher level functions. So, you have the sysadmin tool (Splunk) and the management tool (CA):
Mell Estrada (CA): Well, from the CA perspective, we are very excited about the opportunity to work with Splunk because, like Michael [Baum, CEO of Splink] was saying, we have two very good technology sets. Splunk brings interesting indexing and search capabilities and CA brings up the large breadth of monitoring and management capabilities and bringing them together and integrating them in a -- at least, at this point in a -- what we call a partnership perspective, we are saying and letting the world know that we are taking the heavy investing out of the customerâs hands; we, as proactive vendors in this space with world class technologies, are coming together in a proactive manner to help them manage their data and their data centers in a much more efficient manner.
There're two interesting points here:
the emphasis on addresses the issue of complexity in tool way rather than the usual systems management pixie dust
I suppose the "at least, at this point in a" is a tease about a possible acquisition?
And then to the Splunk perspective:
Michael Baum (Splunk): IT organizations [have] become a lot more sophisticated about dealing with that complexity and the problems they deal with as things get more complex and most IT organizations, large IT organizations today have done a really good job with help of products like Unicenter, at building a work flow, building a set of infrastructure around dealing with finding problems and alerting on those problems in the infrastructure. What Iâve seen in my past, and what weâre trying to attack together with CA is, okay, now that weâre really good at that, what about the problems that donât get solved quickly because itâs not an obvious -- thereâs a single component failure, or thereâs a piece of hardware down somewhere; now you have to go investigate.
The last part is the key: neither Unicenter nor Splunk will be a "complete" enterprise systems management solution. You need both the "dad/management" platform that does all the "boring" stuff like workflow, dashboards, etc., and the tool platform that's used for trouble shooting the internals and "low-level" issues. What's refreshing is seeing a member of The Big 4 accept that duality and doing something about it instead of focusing on the higher level issues and pixie-dusting away the low-level problems.
On Splunk's end, this is also a kinder, more
enterprisey way of Splunk positioning itself with The Big 4, rather than saying
"those folks make things more complex than they need to be." I can also imagine that Splunk devs (or, my dev-gut tells me, all of Splunk as everyone there seems "dev") are happy about this deal because it means they don't need to worry about writing and supporting dashboards, reports, ITIL driven workflows, and all that other stuff that can pushed off to CA now, and future partners I hope. Good move in that regard ;>
Contextual Launch & Back-end Integration
Michael Baum: The first piece is a integration at the user level with the NSM product, where you can launch a Splunk search on any of the components that you see in the NSM console. The second part is, we have tied into the Event API underneath Unicenter. And we are streaming events from the Event Database inside of Unicenter into the Splunk world so that they can be indexed and searched and navigated along with all of the other data that you might want to index with Splunk.
This is interesting as it shows a sort of "non-log" use of Splunk. It also gives Splunk equal footing with Unicenter as far as raw and, perhaps, even synthesized data: if Splunk is sucking data out of Unicenter, then Splunk theoretically has access to all the data that Unicenter does...meaning sysadmins could spend more time in Splunk than in Unicenter if they prefer Splunks's UI. That's just wild speculation. I'll have to check out a demo of the integration to know for sure.
Collaborative Systems Management
Michael Baum: [F]or Unicenter itself, which is a product that needs to be managed, certainly its useful to apply the notion of
Splunk Base and intelligence about managing the Unicenter product itself but Unicenter -- the particular product we are talking about here, the NSM product collects all kinds of data, right, there is all sorts of things that they are able to drive into their event database. So, you could imagine very deep connection with Splunk Base where you are looking at some data thatâs coming across an SNMP port; maybe itâs a type of MIB information from a device -- you have never seen it before, you donât really understand what it is. Well, there are probably a couple of thousand people around the world that know what it is and if they have taken the opportunity document that in the Wiki on Splunk Base, its something you can have direct access to.
Since I'm big time on
Collaborative Systems Management, this is the most interesting aspect about the partnership to me. Indeed,
we advised CA to build up more community involvement and help facilitate more user-driven content generation. I'd like to see CA take full advantage of this Splunk partnership and more directly integrate with Splunk Base. Part of that integration is getting involved in the growing Splunk Base community: for example, CA's internal IT could start uploading newly found events in Splunk Base
and getting involved in describing those events. From the on- and off-line discussions I've had with CA folks, I know they're interested in doing more community building, and Splunk Base is a great place to start learning the ins and outs of working with and within a community.
Of course, it might be wise for Splunk to keep Splunk Base to itself, least CA "take over" that great idea. Unless that wouldn't be a problem down the line... ;> Also, pulling in other Big 4 vendors would hedge against one vendor/user base dominating Splunk Base.
What About Everyone Else?
While this is just an announcement -- meaning we've yet to see how much customers and end-users benefit from the underlying technology -- the other 3 in The Big 4 might want to start hedging and consider who they could partner with, even with Splunk themselves. The partnership isn't exclusive (thanks for the confirmation
Chris!), so
BMC,
HP, and
IBM could work with Splunk as well. Getting at least one other of the Big 4 -- or wild-card it with
Microsoft? -- involved would give Splunk Base a great chance at becoming the
de facto systems management knowledge store. And, hell, it might be the best bet for finally getting RSS into enterprise systems management.
In Summary
As is unfortunately the case all to often of late, I have to disclaim all of this by saying that I haven't talked to any actual customers or end-users. All of this is based on past talks with Splunk, CA, and my own research on the topic.
That said, I'm looking forward to seeing how this pans out. This kind of partnership is the sort of thing, among others, that will keep the Big 4 up-to-date and relevant. That is, it'll generate more revenue. As
in databases, there's
a window opening at the moment for disruption in systems management. That window could be closed, of course, but it
feels like it won't. I'm always interested in making sure the industry grows instead of implodes when disruption comes along, and this seems like a good White-Knuckle Avoidance Maneuver.
Previous Topic
