I'll be the moderator of the session. My name is part of the Splunk AppDynamics team. I've been with Cisco for close to five years, more than five years now.00:01Working with the enterprise customers in the APAC region.00:20With me I have my colleague Paul Matthiers who will be delivering the session. Paul is our go to expert for all things observability. He has an extensive background in complex implementations and he's currently working with customer experience team and he brings a unique perspective to the team.00:24So if.00:44And beyond his impressive certifications and technical knowledge. He's a fantastic teammate to work with. So we'll be delivering the session today together today. If you have any questions, feel free to raise your hand or put the questions in the Q and A We'll be taking them at the end of the session or during the session.00:45And yeah, let's kick off. Let's dive into right into it. Right, fantastic. Thanks very much to partly. Hi everybody. Hope you're having a great day. Thank you for joining us. Really, a great pressure pleasure to have everybody.01:06For this session. It's just a very short session today. Although having said that, I I believe it's it's one of the most valuable ones we have. So this is the agenda for today. We're looking at what's the unified observability, what is LOC or log.01:22Observer Connect, and why LOC, so why the use cases for actually using log observer connect and we'll be going through a very, very short demo and then hopefully some questions and answers at the end of the session.01:42So I think everyone's seen this type of image before where on the surface monitoring is quite is quite small, but in actual fact these days, the expectation and value we wanna get out of monitoring is quite large. So a lot of those things such as correlation between systems, having.01:59Very, very fast MTTR, mttns and being able to find root cause as quickly as possible is quite important to organizations these days.02:19Yeah Components of Splunk observability.02:31As many of you should be aware by now, we've joined forces with, with Splunk. A massive massive contributor and now plays a critical part in our observability strategy and our observability portfolio. You can see there AppDynamics sits in the middle alongside of.02:47Cloud. Tool is a favorite of our customers to look after their three tier app applications and NTI applications, self managed environments.03:07And as you can see also observability cloud looking after cloud native environments and very, very optimized for customers that are needing strict requirements for open telemetry. Splunk platform sits in the bottom, looks after all our data and that'll.03:20Analytics for the platform for users who of Splunk platform, you know how powerful it is when when.03:40We 1st joined and as the party said, you know, doing my certifications to get my head around Splunk, I was so amazed how powerful this Splunk platform is. So contributing that with our other applications and other solutions.03:49And then ITSI bringing it all together so that SRE and engineering team can view all that analytic information powered with AI and machine learning capabilities. It makes it such a truly powerful.04:09Portfolio. So what is log observer connect? Actually, from a UI perspective, it's just this little blue button here. View logs in Splunk. Now in the old world, I remember working with AppDynamics and Splunk was our.04:25Competitor, you know, in the same for buying for the same business. We would present our tooling, you know, very, very fast and quick to to highlight.04:45Issues in in application and infrastructure, but then we had Splunk on the other side and they were so good at being able to deep dive at all these, at all these issues with the amount of data that they were able to collect in their platform.04:58And what's happened today, we've been able to join the two, and now our customers have now got the power of both worlds. You've got we've got the ability to have that quick rapid identification of issues, a correlation of of all your systems in the one screen. And as I said, this cute little blue.05:16The Button here.05:36Being able to then deep dive and using the the that powerful analytic ability of Splunk looking to those issues in in a far more deep analysis. Why log observer connection.05:37Well, you know, during those times, as I said, customer th the challenge for customers was being able to look for the information when those critical issues had occurred. So, you know, in my experience, they would use appdynamic, appdynamics. Appdynamics would show them where the problem was but then they still.05:57Had to spend all this time looking through the all the different logs that were in and around in in all the corners of their, their workspaces. So that was a massive massive challenge. Now bringing all the, that capability together, one of the big benefits obviously is the speed of detecting and.06:17And resolving those issues. Definitely a better together story. Maximizing value for, for the customer having your licensing or or all in the one package, being able to shape that to your needs.06:37And and and and as I said using the the best tools in the in the industry to to resolve and detect and resolve those those observability issues. Improved investigation. The way we've integrated these two systems is amazing. One click and you are directly.06:54Sent to exactly where that log information is stored. So with, so the business transaction that that you're investigating, one click will take you directly to that related log information, filtered by application filtered by time, and then once.07:14You're in that space, for those Splunk users on this call, you've got that power for to use that Splunk search engine and everything else attached to the Splunk platform such as dashboarding, report creation and so on.07:34Alright, I, I did say it was a quick call, a quicker quick presentation, so let's just jump straight into, the demonstration.07:55Sorry, I think I've just stopped the I'll just pause the slide but I don't think it wants me to have two screens at once. Okay, we're in AppDynamics, our demonstration environment. Hopefully you're very familiar with this screen. We use this environment to.08:10Demonstrate all our features and functionality. Let's have a look at the demonstration of how this is all.08:31Connected to a Splunk platform through Splunk sorry log observer connects. A typical application that we demo for this feature is this AD e commerce. And straight away you can see that this blue button is available to us to click. Now we won't click it now. I'll sort of work back.08:39Backwards, but basically if we do click this, it will take us straight to the.08:59Platform and we can see related logs related to the AD e commerce application. But in a real world, we will do some troubleshooting, so I can see here that there's some errors and some some other related issues. So let's have a look at some business trans.09:05Transaction related issues.09:25Usually there's this there's this demo, oh sorry I have to change the time period. Sorry about that, 4 h. Okay. Usually there's this demo business transaction that's always, always jumping presenting errors for us to investigate. So this adds a cart business tra.09:30Conversations showing a few errors that we can.09:48Going in and investigate. Alright yes as you can see here on our KPI indicators, a couple errors are popping up. We'd like to investigate this further, so typically for AppDynamics user, I would then go to transaction snapshots.09:51Oh, in our transaction snapshots, I've got some good transactions, some slow transactions, and then yes, we do have here a transaction with a very slow issue.10:11Let's see if we can find one that has a full call graph and also very slow, maybe this one here. Okay, great. So AppDynamics is already pointing out where the potential issues maybe, but if we have a look at this.10:30It it presents us a call stack or the stack trace and for developers, you know, this, this will probably be useful, but it does fall short in allowing us to then analyze this information. So, how many of these events have occurred? What can we correlate this.10:52These.11:12Errors too. Can we actually even put it in the graph or a or a dashboard? So those are the limitations that we had experienced for a very, very long time with AppDynamics. Mainly because we just didn't have the, the, the log analytical engine in the background to to support all this type of.11:13Information or this this massive amounts of information. But as I said now with the with with the logs of connect and and Splunk platform, we can do that type of analysis now. So let's minimize this for a second. So we can actually now click on this.11:33View logs in Splunk button. And as you can see, it did a little authentication because I have federated access to both systems. I didn't have to log in.11:53Right, it opens up a new tab for me, so it's very seamless in in its experience. And as you can see here, it's already added the application name in context, the business transaction ID in context, and the time period that I was.12:08Previously looking, oh, I was looking at in the in the other screen, right? So it also brought that into the Splunk platform search as well. We've got over 400000 events for this business ID and in this sense, we can start using the power of.12:26Of.12:46Splunk platform to refine this search, and also use all the different features that come with Splunk platform visualization, savings reports, creating new dashboards etc. Right, now I won't go through all that detail because we could, we could spend another session just looking at Splunk platform.12:47Form, but as you can see, it brought us here quite quickly and with all the relevant information related.13:06To that business transaction. If we go back, we can actually go to many multiple layers, so we can go up to a node layer.13:15And then we can view logs related to the node. It'll open up a new tab, and then again, the data sorry the the events have been filtered out according to this node ID.13:32Again, we can go back again another layer. Oh, sorry, our tears and I think after this you get the general gist.13:52So in this case, we filtered out the search for the relevant tiers. Obviously there's definitely gonna be a lot, lot more events because we're looking at a broader layer to to do our investigation.14:09So as I said, it was quite a quick demo. There is one more thing that I guess you you definitely need to want to see. I just need to log into another environment. How do you connect the two you may say? Okay, well, you.14:30Integration of AppDynamics and Splunk platform through log of the Connect is very, very easy.14:51Let me go through our integration screen and this is increasing by the, by the minute. And we have this Splunk logs tab, and then here we've got.15:01A service account password, a Splunk Cloud URL or Splunk enterprise URL and provided a connection name. That is it. As long as you've had the, as long as you have this information, you will then get access to.15:14Splunk platform within AppDynamics. You'll get the the little blue button. Now getting the data into Splunk platform is the same way as getting data getting log data from any other data source. You will still be using the universal forwarder, and, and once.15:32Data is is put into the platform, as I said, you'll be able to view that from here. How it's done, the universal forwarder is actually configured to contain these appdynamics.15:51Attributes. So all the events that the universal forwarder will collect and forward to, to Splunk platform will be enriched with with AppDynamics.16:09Properties. So that was our demo. I hope it wasn't too quick. You will need a few things to to get this working, obviously AppDynamics APM license.16:25Logs that connected is specifically around APM. You'll also need a Splunk core or Splunk Cloud license for logs, either ingestion base or SVC base. But as I said, this is all.16:40Customizable and packageable for your needs. And then there's a couple of versions where this feature will will work with. So universal forwarder greater equal to the version seven.17:00And AppDynamics controller greater than equal to 20 four.one. On prem virtual appliance came out a little bit later, so you will need 20 five.seven for that. Now, a few months ago it was restricted so that.17:15Appd SAS and Splunk Cloud needed to be in the same region, but I'm pretty sure.17:35That that is either NO longer a limitation or it's being rolled out to too many regions so that you can have appd and Splunk Cloud in different regions if required. And just a couple of, resources.17:43That are available to you. A couple of videos on YouTube around LOC.18:03And some introduction documentation available as well. And then obviously you can reach out to myself and, and the team if you want to discuss it further and and want to, you know, explore and.18:10Try this out wherever you maybe. So that's it folks. Thanks very much for for your patience and attendance. Deparli. Paul, we do have a question in the Q and A section from Silky. Do you think sorry I missed the start of sessions on.18:27Not sure if it was discussed, how can, how we can get this Plunk logs enabled for our controller?18:46Yeah, fantastic. So it would it was there I'll I'll just go back to that screen. Every controller that is in the right version, sorry I'll just for some reason it doesn't want to swap from slides to.18:53Browser. I'll share this now ok so yeah so so if you if you have the appropriate version of your controller, you will already have this screen available to you in integrations.19:12And then Splunk logs, and it's just a matter of filling in the required details. So obviously on the Splunk side, you're gonna need a service account, provided its password, and then give AppDynamics the appropriate.19:32URL to connect to that. So that's just the integration side of things. Now if you don't have a federated access, every time you click that little blue button, you're going to be requested to log in to the platform, but if you do have if you do have federated access with with.19:50AppDynamics and Splunk managed by the same access provider then it will it will do what happened to me when I clicked on that blue button, it will just pop up or automatically authenticate and you'll have be straight into the platform.20:09Any other questions Depali? Sorry, I was again speaking on mute. I don't see any questions in the Q and A or in the chat window, but yep, I just wanted to say that everybody feel free to reach out to us via your account manager or your assigned customer success manager specialist.20:44If you have any request for a focused session or a discussion around the topics, we'll be happy to help you.21:04That's all for today. Thank you so much everyone. Thanks Paul. No problem. Thanks everyone. Thank you, have a good day.21:15
