Splunk’s Tom Casey on Advancing IT with AI and Observability

This is Techron tv. Hey guys, thanks. The throw, we're here with Tom Casey, who's seat new vice president for products and technology over at Splunk, which is becoming part of Cisco.

And we're gonna be talking about one should IT professionals expect outta all this because there's a lot of parts here and well hopefully two plus two equals four greater and we'll see what happens here. But Tom, welcome to the show. Great.

Nice to be with you Mike. And, uh, appreciate the opportunity to talk to everybody. Historically, if I look at Splunk, it was always about IT, operations, analytics, and then extend it out from there into security and some other spaces.

And then I look over at Cisco and I see things like AppDynamics and observability platforms and network intelligence and security stuff in some primordial super stuff. So how does all this come together in a way that you think will be compelling and what should people expect? Yeah, it can probably feel that way.

I think in the security domain and observability domains in particular, there's tool sprawl broadly, uh, from many vendors that are out there. And one of the biggest things is tools consolidation. I think our story in bringing together the best of Cisco's networking, security observability with Splunk, security observability, infrastructure monitoring, and all of that history that we have of strong data management and analytics, we think that really helps accelerate that consolidation, play, deliver, uh, a stronger end-to-end story.

Really full stack story around coverage for the entire digital footprint for companies in security and observability. I feel also that there's a lot of silos in it historically and as all this comes together, I mean, I'll have a tool like AppDynamics and I can see well into the DevOps workflow and the software engineering, but I don't really see all that well into what's happening maybe in the IT operations environment or the 'cause the IT service management stack is slightly d Or your cloud native apps, Right? Or and your networking thing is the way we manage it gonna change as all this evolves.

'cause a lot of these silos seems like they need to break down, but how? Yeah. Well, you know, data's the key.

Unifying the data is really the key around, uh, delivering that experience and then making sure that people are working in a common enough framework so that as they navigate through different tools that are, that they're required to use to do their job and they meet in the middle for collaboration around incident management, that they're working from a similar context, similar business logic, conflicts context in the workflow of those applications in a shared data context. Now I think Mike, you, you've mentioned AppDynamics a couple of times here, and I think that's a really great example about how the story of Splunk and Cisco gets better together. Our vision, you know, at Splunk doesn't change in terms of making it creating a safer and more resilient digital world.

We think you do that with great visibility and action through security and through observability. And we've always differentiated by saying we're a vendor that supplies both to you and that also covers your traditional on-premise and hybrid applications as well as you cloud native in the observability space. The combination of the Splunk platform and AppDynamics connected together strengthens our on-premise and hybrid commitment in the observability space, the strength and combination of AppDynamics and its, its, uh, relative advantages around traditional application performance monitoring and digital experience monitoring coupled with Splunk observability cloud strength and infrastructure monitoring and cloud native application monitoring.

Those things are highly complimentary. And so as we stitch those things together, the customers get more coverage across that entire digital footprint. We think that helps at, you know, greater value overall for the customer, improves the overall TCO for them as well, and gives them better depth of coverage.

True full stack coverage. So you don't think, per se, that the entire IT structure is gonna flatten as a result of all this? As much as it is we're just gonna be able to, uh, for lack of a better phrase, cozy up close to each other.

'cause we're all gonna see the same thing at the same time. Yeah. Or play our diff play the different roles that we have to play.

I mean, you know, really in, in both security and in it scarcity of talent is one of the biggest challenges that people are facing, right? The AI revolution that's taking place is, is very much about augmentation of the capability of the human to get the work done, um, and trying to make that scale to the demands that are increasing in the digital landscape at a rate that's just much higher than what we can keep up with with trained people. So I think that what we're gonna see is better leverage from, uh, consolidation in tools, from consolidation in data, and from stronger assistance from platforms like the Splunk platform that provide AI assistance kind of natively embedded in the workflow every day for the user that's gonna make folks more productive, um, and help them to navigate across those boundaries, not only where they need to hand off to someone else, but enable them to get more done on their own.

What impact is AI gonna have on all of this, do you think? Because it seems like we are pulling all the data together that at least gives a central place to apply some algorithms, I should think, but how does that kind of factor into your thinking? Well, there's, there was independent thinking going on that fortunately is also very complimentary, uh, from Cisco and Splunk.

Lemme tell you a little bit about how Splunk approaches AI differently maybe than some others and then we'll, we'll kind of riff from there. Um, you know, first we believe three things are fundamental. We believe that the efficacy of the, the models that you use need to be grounded in domain specific data.

And Splunk has strong domain specific data and security and observability that we own, that our partners and our customers own. That gives us the ability to build better models. The second thing is you have to keep the human in the loop, especially at a point of dealing with an incident that you've never seen before.

Human judgment really matters. And so at Splunk we're not only doing chat type interfaces for natural language assistance to make people more productive, but we're also embedding AI assistance directly into the everyday workflows in the applications. Things like helping you set up anomaly detection, things like helping intuitive alerts and things like helping you, um, generate incident summaries, uh, in context with the right enrich data.

Those things all elevate the productivity of the human being and allow the human being to make better decisions. And then finally, um, AI's gonna continue to evolve rapidly, so you have to remain open and extensible Mike. And, um, we do, we've been, it's not new, you know, this, we know this AI's been around a long time and Splunk's been a player for a long time.

We introduced our machine learning toolkit back in 2015. It's been downloaded more than 200,000 times. Customers used it and continue to use it to bring their own models to Splunk, build their own custom models, and we're gonna continue to remain open and, uh, extensible even as we bake AI up to the daily workflow.

So that's sort of the Splunk approach has, it's been to ai and we've really been emphasizing for the last year or so, if you'd like to, we could talk a little bit about Cisco's approach and how the two fit together. Yeah, if you don't mind, and maybe a little more context in the sense of, you know, the irony of life is we use it all the time to automate all these other tasks, but boy, there're sure are a lot of manual tasks and a lot of toil involved in the management of it these days. So, um, you know, how do you envision the day-to-day existence of the IT professional changing?

So, um, a great example of this is really couched in the, um, uh, Cisco AI assistant announcements that were made. Uh, late last year, Cisco introduced a new AI assistant that effectively offers that chat type experience to the IT professional and to others. And so that you can do acts like configuration and troubleshooting through assistance where those scripts, the right scripts are found and executed for you, or the code is generated for you, or it's a direct conversation with the, uh, you know, the node and the configuration management endpoint, um, that helps users be more productive in creating uniform and consistent configurations.

It helps them with troubleshooting. And one of the things that we will do is we stitch together Cisco's AI assistant capability and kind of that topline chat approach that many companies are taking with Splunk's embedded AI assistance directly in the everyday applications will be that you can start an investigation from that kind of generalized chat experience. Hey, what's, what's happening with this service?

The configs a drift. Can you normalize the config for me? Okay, what are the knockoff effects of that?

Can you show me how the impact of that has been, uh, affecting my network traffic or my infrastructure? At that point, when you take that specific step, you want to drop right in the context of the dashboard and the applications that you're used to seeing in the observability cloud or in the soc in your, your stream information management console. And you'll be able to do that through stitching these things together as we take the best of those chat like experiences that help aid people in basic investigation and productivity activity towards dropping them into context for more detailed investigation and and resolution.

So I think there's a lot to be gained both in the productivity of the individual and in the um, uh, speed with which we get people narrowed down to the thing where, again, human judgment really matters. And that is that decision about how you're gonna resolve something that you've never seen before. So to that extent, how smart can smart get, 'cause I'm kind of open someday.

I'll just walk into the office and they'll be in a message telling me, you know, these are the three things most likely to get you fired and here's our recommendations for fixing them, and then I'll just decide that. Yeah, I like that one. I don't like that one and I love the third one, Mike.

That's exactly the idea. I think smart will get, get that smart. Now the idea is a couple of things come out of that, right?

Um, you know, that saves you some time and some stress gets you focused on, um, it kind of de-noise your day and gets you focused on the things that are either more, uh, creative value add or strategic to the organization and your role, um, or gets you all on time for dinner. I would say all of those things are pretty valuable. Um, and, and really the promise of AI isn't just an aiding automation.

Um, ultimately by aiding in the automation and bringing our focus to the things where we really need to bring the human acumen to bear every day we think we get, um, you know, higher value, uh, more productive, more satisfying experiences for individuals as well. Dev would rather, I'll give you a great example of that, Mike. Um, every dev I talk to would rather be, uh, write a new piece of code than troubleshooting something that's running in production.

Uh, and every SOC analyst would, uh, rather be out doing some advanced threat research or something than, uh, dealing with just denoising a bunch of alerts. And AI already provides assistance with that. That's valuable for focusing at work.

I think you're just gonna see that trend continue. Of course, anytime there's a merger of this size, the competition always shows up and kind of starts throwing slings and arrows. But I get what's in your F Cisco customers who aren't already Splunk customers, but why should the existing Splunk customers kind of stay the course and what are you telling those folks?

Yeah, so, um, telling 'em the same thing I'm telling you, we're really excited about bringing this together. If you think about that completeness in our story around hybrid and on premise, uh, with the addition of AppDynamics into the portfolio paired with SPL observability, cloud, Splunk platform, and our enterprise security capabilities, that's great strength. If you want coverage across your entire network, you can't protect what you can't see.

And if you want coverage across that entire set, look at the security space, the combination of Splunk's leading enterprise security SOAR capabilities or attack analyzer capabilities and more with Cisco's breach protection, cloud protection, and user protection suites with the addition of things like thousand eyes for greater end-to-end visibility about what's happening out in the wild and the internet and the route your traffic is taking. Um, and things like the integration of Talos, which provides better threat intelligence management, uh, and monitoring insights. All of those things enrich the products and are tremendously complimentary.

So I think our customers, when we have this conversation, they look at it and those that are both Splunk customers and Cisco customers light up those that are not sometimes will ask me the question, okay, what happens is, is stuff only gonna be great if I use Cisco products with Splunk? And the answer to that is no. We recognize, we recognized at Splunk, we recognize that Cisco, the world's a pretty heterogeneous place and will continue to be.

And one of the strengths of Splunk will continue to be that we are open, uh, we help you connect to everything with a rich ecosystem of, uh, you know, more than 2,800, um, applications that are out there to help you connect into your environment. And we're gonna continue to be the ones that help you provide visibility of monitoring end to end across what you do. So I'm really excited about the richness of insight that people can get through monitoring the depth and breadth of the network traffic through the infrastructure, through the applications with the strength and combination of our companies.

I'm excited about the AI things you and I talked about and the way we can kind of raise the boat across that entire digital landscape, if you will, for productivity for people. Um, and I remain committed to our, our customers at our, our roadmap, even as we provide, you know, greater net new value better together. All right, cool.

You heard it here folks. I sometimes wonder how amazing it is, the new thing works at all given how complex things are, but hey, sounds like things are gonna get better sooner than later. Hey Tom, these Our job's fund for sure, Mike.

Hey, deal. Look, the complexity, our job is to simplify it. I know we don't always do a great job.

We're pretty committed to working through this in a really deliberate, thoughtful way, and we're gonna show some value regularly to customers. So the combination better together. Awesome, Tom, thanks for being on the channel.

Appreciate it. Bye. All right, come back to you guys in the studio.