Splunk integration with Cisco Intersight

Hello, good everyone, and welcome to today's.00:10Expert insight series, the topic today is Splunk integration with intersight. Today we have Brianka Sukija and Jorge Ayala?00:15Our customer success specialist, and Jorge is a customer success specialist specializing in data centers, automation and AI. He holds certifications such as CCIE and CCDE.00:33Priyanka is a customer success specialist focused on data center compute and hybrid cloud technologies. She has CCIE and routing and switching. Before customer success specialist, she was a network consulting engineer for four years focusing on service provider technologies.00:49Now today we will be using Slido for interaction. You see on your screen, you can open a web browser and go to slido.com and use the join code splunk-inter site, and the passcode is the same splunk-inter site.01:09If you're on a mobile device with a camera, you should be able to use the QR code you see over to the right that should produce a link that you can click on and go right to our Slido, and we have.01:29Our 1st question that we'd like to gather.01:48Information from our audience today is where you're joining from today. So let me bring that up and if you can go there and put in where you might be joining from today.01:52We should be able to see on our screen. This will give our CSS specialists some indication of where the folks are located at that are gonna be in the audience today and perhaps help them tailor their.02:11Presentation and demonstration around that. As you can see, we've got folks joining from the Atlanta area, as well as the state of California, then we see Cancoon.02:28Great to see that participation. Thanks everyone for chiming in. Now we can move to our our next poll here that we are interested in knowing how you're using Splunk today.02:46You could indicate using one of the prepared responses, your method of using Splunk, whether you are using it, not using it or if you are using it, are you using the inter site based add on, which is the topic of.03:02Today's presentation, and if you watch those votes come in here, so far we're about a 6040 split between those not using Splunk and those using it with the inter site.03:19Add on, all very good information that we want to have for our audience. Thank you very much for everyone that participated. At this point, I can turn it over to our.03:39Presenter, Jorge and let him take it away with today's topic. So over to you Jorge. Thank you Joe. Let me share my screen.03:58Okay, so welcome everyone. Today we have a comprehensive agenda focused on modernizing your infrastructure observability. So we will start with a brief Splunk introduction and cover the basic of installation.04:15Not getting started.04:34From there we will dive into the core concept of Splunk technology at once and specifically the inter site. We will then walk through the input configuration required to get your data flowing, explore the powerful dashboard available for visualization.04:36And finally, look at some sample reports to help you hit the ground run. So let's get started.04:56So before we dive into the specifics of the, this slide, it's important to establish what Splunk is. So Splunk is a leading data platform designed to search, monitor and analyze machine generated data in real time.05:02So it acts as a central nervous system for IT and security operation capturing data from virtual any source. We are talking about servers, network devices, application, and even sensors.05:22And transforming that raw data into searchable actionable insights. So by providing a unified view of an organization digital footprint Splunk enables teams to identify trends, identify troubleshoot issues and bolster security posture to.05:38Two data driving decision maker.05:58So now let's address the fundamental question. So why is Splunk? So to understand the value proposition of our infrastructure, we look at the three core pillars that drive operational excellence, cons consolidated dashboards, intelligence and the Splunk based ecosystem. So 1st of all, we.06:01So Splunk provides a single pane of glass. Instead of toggling between multiple disparate tools, we offer an end to end view of both network and security events. So this consolidation is a game changer for net ops and secops teams.06:22By breaking down these silos, we empower our teams with the context they need to troubleshoot complex issues unefficiently. So moving to 2nd pillar, Splunk isn't just about collecting data.06:40It's about making the data work for you. So the platform interacts directly with Cisco controllers creating a seamless experience for managing or network and security fabric. So furthermore, we leverage Splunk AI tools.06:55Such as IT IT service intelligence and machine learning toolkits. So these tools allow us to move beyond manual monitoring into the real or predictive analytics and automating anomaly detection. And finally, we have Splunk base, which is a vast ecosystem of thousands of.07:12Applications so these apps are designed to help you, shape parts and index your data according to your specific business needs. So whether you are looking for a pre built dashboard for Cisco hardware or a specialized security model.07:32Splunk based ensures that the platform is infinitely extensible and custom customizable. So when we combine these three pillars, we achieve four critical outcomes, as you can see on the right side of the slides of full stack visibility, faster root cause analysis.07:49Data correlation and artificial intelligence. So this slide illustrates the fundamental architecture of how we move data from our diverse Cisco infrastructure into the Splunk platform. So think of this as the three layer pipeline ingestions, normalization and intelligence.08:08So at the bottom we have our gate gate data in layers, so this is where we collect raw telemetry logs and events.08:28From our critical domains. So what kind of domains device and user e.g. capturing endpoint and identity based data? Wireless monitoring, connectivity, health and client performance, switching and routing, collecting flow data, interfaces statistics, and system health metrics.08:37And finally security, aggregating fiber locks, threat detection, and access control events.08:57Once the data enters the platform, it passed through the normalized layer. So this is the most important part of the process. Splunk takes this, this formats, whether they are matrix, they are events, alerts or raw logs.09:05And standardize them. So this normalization is what allows us to compare apples to apples across different solutions ensuring that our data is consistent and ready for analysis. And finally at the top, we reach the intelligence layer.09:22Because the data, the data has been normalized and stored in a common data repository. We can perform cross domain correlation. So this mean we can query data from our wireless network and correlate it e.g. with security logs or with routing metrics.09:39All in a single search. So this capability enabled us to move from simple monitoring to proactive problem solving utilizing custom search to find the exact answer we need regardless of the data structure.09:58To effectively manage and scale a Splunk deployment, it's it is essential to understand its modular architecture. So Splunk is designed as a distribute system, meaning different tasks data collection, indexing and searching are handled by a specialized components.10:14By decoupling these functions plan can scale horizontally to handle massive volumes of data while maintaining high performance for user requests. So at the bottom of our architecture we have the forwarders. So these are the agents that reside on your servers, on your network devices or you.10:33On your endpoints. So their sole purpose to collect data and send it to the indexers. We typically use two types.10:53Universal forwarded. This is a lightweight agent designed specifically for data collection. It has a minimal impact on system resources, and we have a heavy forwarder. This is a full instance of of Splunk enterprise. It is used when you need advanced data processing such as filtering masking.11:02Or wrote the data before it reached the indexers. Moving up the new layer, we have the indexers. So this is where the heavy lifting happens. The indexer receives the raw data from the forwarders, process it, and convert it into searchable events.11:22It is store this data in buckets of the risk. And finally at the top we have the search head. See, this is the component that user interact with. When you run a query or or look at the dashboard, the search head manage the request, so it distributes the search across the index search.11:40Collect the results and consolidate them into a single readable format for the user.12:00So it acts as the brain of the operation, providing the interface for all your visualization and reports. Let's talk about a little bit about installation and getting started. So installing is the 1st step in establishing a robot.12:06Observability and security data pipeline.12:26Splunk is designed for cross platform flexibility, supporting deployments on Windows, Linux and macOS. So this slide highlights the two primary ways to deploy Splunk Enterprise because our infrastructure often expands different operating system. It is critical to.12:30To understand that the core functionality remains consistent.12:50Regardless of the platform. So you can find the latest installation package directly on the Splunk website. You can see the URL address in the top of the slide. In any production environment ensuring that critical service like Splunk automatically rest.12:54Car after a system reboot is a vital for maintaining high availability.13:14So without this configuration, a server restart will leave your data pipeline offline resulting in gaps in your logs and potential monitoring blind spots. So configuring Splunk to run as a managed service ensure that your observability platform is always online.13:20Is always resilient and ready to capture data at the moment the server is back up. So I'm not going to enter into the great detail in this slide. This slide is just for reference. A successful as long deployment is only as effective as it's a.13:39Ability to communicate with the rest of the network. So because Splunk relies on receiving data from various forwarders.13:59And serving web interface to user configuring the firewall is a critical security and connectivity step. So without the correct ports open, data ingestion will fail and the Splunk Web interface will remain inaccessible.14:08So these slides cover the necessary steps to ensure your Splunk instance is reachable while maintaining a secure perimeter. Again, this slide is just for your reference in case you need to configure the firewall during the installation process.14:25So let's talk about Splunk technology at once. While the current Splunk platform provides the engine for data ingestion and correlation, the true power of the ecosystem lies in its extensibility.14:44Splunk apps on technology app owns TAS, allow you to tailor the platform to specific technologies, vendors, and use cases. By leveraging reveal integration, you can drastically reduce the time it takes to go from raw data to meaningful insights.15:02Ensuring that your monitoring solution are always aligned with the latest industry standards. So think of Splunk base as the app store of your data. So it is the central repository where you can find thousands of pre built application and add ons.15:23Whether you are looking to integrate Cisco networking equipment, close services like AWS or container platforms like Kubernetes, Splunk based is the starting point for extending your visibility. So it's important to understand the difference between.15:41Technology at owns and apps. Technology at owns are the work horses. As noted on the slides they are specifically designed to collect, format, and normalize data from a specific technology source.15:58The Apps are the visualizers, so they typically include dashboards reports and safe search that tool that normalize data into actionable intelligence. So why use preview interventions? So instead of of.16:14Is Instead of you writing customer parcers for every single device or service, we leverage this community and vendor supported add ons. So this ensures consistency ensure speed.16:31Ensure also reliability. Let's continue talking about add ons, but in this case specifically talking about inter site. So as our data center evolved, the complexity of managing diverse hardware.16:47Especially high performance GPU than servers requires a more sophisticated approach to monitor the Cisco inter site at home for Splunk version 3.2 .0 represents a significant leave forward in this space by integrating deep infrastructure telemetry into the splunk.17:07One platform, we are moving beyond simple status checks toward a comprehensive, predictive and compliant operational model.17:27That brings the gap between hardware management and enterprise data analytics. So the latest version of the inter site add on is designed to solve the silo problem. So by bringing inventory metrics, and I'll give logs into Splunk, we are going to gain.17:36E.g., enhanced visibility because a single source of truth of our entire.17:56X 86. We are going to gain optimized operations by unifi unifying this data with reduce our mean time to resolution. We are going to gain predictive power because we can now leverage Splunk machine learning to move from reactive by Python to proactive isolation.18:03Actions.18:23We also have a key feature supporting the modern data center. So what I want to highlight today is the expanding feature set in version 3.2 .0, which is particularly relevant to our current initiatives. E.g., GPU then server support, we now have native support for C.18:24CAA5 and CA 45 servers.18:44This is critical for GPU dashboard projects. We also want to highlight the advisory and alarm dashboards because as shown in the screenshot, we now have dedicated dashboard for advisory insights. We also have interse inter site pool inputs. We we have added new capabilities.18:47For pool monitoring which give us better granularity into resource allocation across our cluster. We also have custom input flexibility for those unique ad hoc data collection needs. We have added custom input support ensuring that if it's in the inter site, we can get it into Splunk.19:08And finally, these act on strengths or security posture. With billing user activity monitoring and audit log exploration, we can track exactly who is making changes to our infrastructure ensuring that we remain compliant.19:27With all internal security policies. Before deploying any integration into production environment, it is critical to verify that the solution meets your organization architectural and license requirements.19:43So this add on is designed to be high versative. Whether you are running inter site in software as a service model or utilizing the connected virtual appliance or prevail virtual appliance, this integration is fully compatible. So furthermore, it supports both inter site management.20:00And a standalone mode, ISN ensuring that NO matter how your compute infrastructure is configured, you can pull that data into your analytics. To leverage this integration, you need an inter site essential license or hider.20:21So this is the baseline requirement to enable the API connectivity that the add on use to pull data. On the splunk side, the solution is platform agnostic. It works seamlessly whether you are hosting your own instance or utilizing the Splunk cloud.20:38So the most important takeaway from this slide is the certification status, as you can see as you right. So being Cisco supported and Splunk goal standards certified means reliability because the code has been tested security because it meets the security standard required.20:57By Cisco and Splunk and support. You have a clear path for technical assistance if you encounter issues. Let's move on and talk about now about configuration. So the final technical step in enabling.21:17In enabling your observability pipeline is the account configuration. This is where we established a secure authenticate bridge between your Cisco inter site environment and the Splunk platform. So by using all out 2.0 credentials, we ensure that the data flow is both secure and.21:36Authorized it.21:56Allowing the Splunk add on to programmatically pull the telemetry needed for your dashboard and reports. Once the initial connection to Cisco Intersight is established, the next phase is managing the specific data streams. So the Cisco inter site add on for.21:57The Splunk provides a granular control panel where you can define exactly what data is collected and how often. So this level of customization is vital for balancing the need for real time visibility with the result constraints of your Splunk environment.22:17Ensuring also that you are only ingesting the data that truly drives you operational insights. Effective infrastructure monitoring relies on capturing the right data at the right frequency.22:36While default settings are excellent for getting started, the ability to fine tune your inputs specifically for alarms is what allows you to put through the noise and focus on actionable insight. By customizing the alarms inputs, you ensure that your dashboard.22:54Accurately reflect the health of your environment without overwhelming your analyst with unnecessary information. An accurate up to date inventory is the bedrock of IT operation.23:14So without knowing exactly what asset you have under current states, you cannot effectively monitor or secure or optimize your data centers. So the inventory input configuration in the Cisco inter site app on for Splunk is designed to automate this discovery process.23:31Pulling comprehensive asic data directly into Splunk so that your dashboard reflects the reality of your infrastructure in real time. While inventory tell us what we have, metrics tell us how our infrastructure is performing.23:50By ingesting performance data such as temperature, and speeds, power status, and interface utilization into Splunk, we transition from from simple asset management to true observability. So this allow us to detect performance degradation.24:10Identify thermal issues and optimize resource utilization across all compute states including or high performance GPU then servers. And with that, I'm going to pass the ball to.24:28Thank you. Thank you. I'm gonna go ahead and share my screen. I hope you all can see my screen here. Yeah, thanks so for confirming. So for our 1st demo, we are going to look at how to install inter site add on to Splunk.24:47Before that, let me show you all the resources that you can use to educate yourself on inter site add on, its installation process and basic troubleshooting steps. So for that, let's go to Cisco inter site login page and from here you click on help center.25:05And then on the left panel, if you go to resources, now come to the right side panel, scroll down and you'll see inter site add on for Splunk tab. If you click on it, you'll see an inter site add on for Splunk user guide. You can use this user guide to educate yourself to understand.25:25And the prerequisites and the basic installation steps. 2nd resources which I highly recommend you to go through is Splunk base. So when you are on Splunk base, go to apps and then write into site. You'll.25:45Find this Cisco inter site add on for Splunk page. Come here and if you scroll down, you'll see all these tabs called submit detail, installation troubleshooting. So all these have very good information. If you go under details, you'll see the release notes for our latest version, which is three dot.26:04Two.oh, and as Jorge mentioned, it's supports our AI server as AI servers as well. If you go down, you'll see our previous versions, new features as well.26:24For installation it goes through the step by step configuration process. For troubleshooting, if you are facing any troubleshooting, if you're facing any issues during the installation process, these are general checks that you can go through. And of course at the end version history for all the versions versions.26:38That has been released for Cisco intercite. So now, now we've gone through the resources. Let's go back to the installation process. So there are two ways to install inter site add on to Splunk. The 1st one is to download the.26:57Pack it from here and once you download it, you go to home page of Splunk enterprise. I have Splunk enterprise license here. Go to apps and then to manage apps. Then on top right corner, you'll see this tab called install app from file.27:16So you choose the file which you downloaded from the Splunk space and upload it here. So this is very relevant to your PVNCVA deployment for intersite. Now 2nd way to install inter site add on to Splunk is you go to apps and then click on find.27:34Find more apps.27:54Then write inter site and you'll see this called Cisco inter site add on for Splunk. The tab here shows open app right now because I've already added it to the Splunk, but if you have not added it, it might show here to add it or if you have not.27:56Not updated your app and added it if the icon might show to update the app.28:16So these are the two ways you can install inter site add on to Splunk. Now I'm gonna go and click on open app. So if you are coming to this account page for the 1st time, you'll prompted to do all the account configuration. Now to configure the account, we have to generate API scheme.28:21From intercite. And to do that there are some best practices that you could follow and prepare your inter site account. So let's go to inter site and let's log in here.28:41And then we're gonna create a role that will determine the privileges the user has, and we are gonna generate API keys from that user so that we have limited connectivity.29:05Activity to Splunk and it will prevent the Splunk add on and anyone getting that API key.29:16So I'm gonna go down to settings and then click on roles. I'm gonna create a role. Let's call it Splunk user, click on next. And then I'm gonna add audit log viewer privilege and read only.29:22Privilege and click on create on bottom right corner. So now the role is created. I'm gonna go to users and add that role to the user. So there are two ways to do it. I can just click on my name and click on edit and just add another role to it.29:42And the other way to do it, if you are creating a new user with that account permission, so you can click on add user, you can add their email address and role, and then click on add. So now that we have created the role, let's go and log out from this account.30:05And then we're gonna sign back with that user role and create tokens from there.30:25So if you see, the, this account has a Splunk user role and then I clicked on it. So if you look here, I'm logged in with my Splunk user role, and now I'm gonna go down and click on auth tokens.30:45Create an auth token for me. Let's call it Splunk app token and set an expiration date and time.31:04And create. Now I'm gonna copy the client ID and client secret, go back to our Splunk page and click on add on top right corner. I'm gonna give an account name to this. Let's call it CX.31:27Okay cloud prod lab paste our client ID that I copied now the secret and then I'm gonna go ahead and.31:45And click on create default inputs. The reason I'm gonna do that it's gonna automatically create some some inputs like audit alarm, inventory automatically so that I don't have to go to the inputs and create different inputs for all these. And then click on add.32:05So this is gonna add our inter site account to the Splunk. So if you see the this is the account that we just added. Now under configuration, this is where under account this is where you add your account. If you.32:27You have any proxy settings, you can come here and configure it.32:46Then the login information is to determine what level of logs to be written to Splunk. So if you drop, look at the dropdown menu, it has five different types of log levels. Starting from the bottom, the critical one, it logs critical events and errors.32:50The error, it only logs errors, the warning messages, it only logs warning critical events and errors. Info, it logs normal operational messages in addition to your warning and error messages. The debug, it logs literally everything including your detailed API requests.33:07And responses and this is best for troubleshooting. And the default one is info, so I'm gonna keep it info.33:27Now the KV lookup, it is only needed if you want to change the management port for Splunk or if you're working on distributed Splunk environment. So now, now that our configuration setup is done for the account, let's switch to the inputs.33:36So if you look at the inputs tab on top left corner, I'm gonna click on that and this is where you'll see all the inputs. Since I have other four accounts, other different four accounts from inter site I see a lot of inputs here, so I'm gonna go to search and just filter more.33:53My input, my account inputs. So these are the seven inputs that got created when I created the account and checked that little box that said create inputs.34:13Now you'll see that all the status are in in active state right now, but and I'm not gonna make them active. Before that we're gonna go to index and create an index so that all these inputs can be logged there.34:27Now if I since I have four to five accounts already added to Splunk, I haven't already have an index, but I'm gonna add and create another index. The reason is the searches might become slower because we just added another inter site account and now more.34:45Data is going to be scanned now. So it can lead to more complex administrative work while we are troubleshooting. So that's why I'm gonna go and create another index. So now on top right corner, if you look at the settings account, I'm gonna go to indexes.35:04And click on create new index. Let's call it inter site demo index. You can change the size of the entire index. I'm gonna keep it as default and click on save.35:20So now that we have created our index, let's go back to inputs. So onto the apps and click on Splunk inter site add on for Splunk, and.35:36Go to inputs, let's filter our inputs for the account and now I'm gonna make them active, all of them and start data collection. So let's do that. I can just click on activate all, but before that, I forgot.35:53So let's go and click on edit and change our index. So right now this is the index that is by default added for all my inter site accounts, so I'm gonna go ahead and cancel it and just click on inter site demo index that we just created because I want all my inputs to be logged in that index.36:13And similarly, we're gonna do this for all the inter site input.36:33And then the last one.37:01For the interface, if you see, if you look here, interface metrics, you have all these metrics here. If you don't want all of them to be collected, you can choose your network metrics to be collected here and I'm gonna go ahead and click on all and click on update.37:07So we have changed the indexes. Now I'm gonna activate everything here. Now that we have started the data collection by enabling all the inputs, it might take some time to ingest the data from inter site. So in the meantime, let's go ahead and look at some of the best.37:28Practices for the account.37:48So let's go to settings and to data models, and then this is where we're gonna add acceleration. So if you look at inter site and click on edit and edit acceleration, it is already enabled because I have other inter site account as well, but if it's not enabled for you, I highly recommend that you.37:50Enable it.38:10This is going to help you to load your dashboards very faster. Then the summary range, it's the time for how many days the recent data you want to be accelerated on your dashboard. The one thing to notice here is the longer the time range, the more additional data Splunk will have to store for this.38:11Okay I'm gonna go ahead and click on save. The next best practice that I'm going to recommend is you go to settings and then to advance search, and this is where we're gonna configure macros.38:35So again, the macros are can be reusable in your SPL query, so you can insert it anywhere in your searches, in your query, in eval statement or any search terms as well. So now let's look at for.38:49Intercite. And if you look at here in Cisco inter site index, the main index is already added. So I'm gonna go ahead and click on it and then add the index that we have created, which was inter site demo. You can add.39:04Multiple indexes here.39:24And then click on save. So the next best practice that I highly recommend is to make the summary only tab true. So with acceleration enabled, this should be set to true because you enable the acceleration in Splunk and it creates the summary which is.39:27Precomputed results and setting this true tells the search to use these fast summaries instead of your large raw database files. So with all these best practices, I'm gonna pass it to Jorge and Jorge is going to talk about dashboards, reports, and.39:48With some other insights and then I'll come back and demo them.40:08So back to you Julia. Thank you Priyanka. I'm going to share my screen again. Okay, so now we move to dashboards. So this is where we transfer raw data into a visual single pane of glass.40:11For real time infrastructure monitoring and operational intelligence. So in any enterprise environment and security and accountability are nonegotiable. So knowing who is accessing your infrastructure.40:31Where they are logging in from and what changes they are making is fundamental to maintaining secure and complaint operation. So the activity monitoring dashboard that that is the 1st dashboard that we are going to review is going to power by the audit logs ingested via the.40:49Cisco Intersight at on for Splunk.41:09It provides this critical oversight in a single intuitive interface. So this dashboard is our primary tool for tracking user behavior within Cisco Intersight. It's not just about seeing who login, it's about understanding the entire life cycle of user activity, so we can.41:11Monitoring logging and logo patterns.41:31Track when permission modified, give a close eye on operational events that could impact our environment. So moving on, we are going to review the power of unified infrastructure visibility.41:34So managing a modern data center requires more than than just knowing if a server is up or down. So you need a deep granular visibility into the physical health configuration and compliance status of every component.41:52So the server inventory dashboard in the Cisco inter site add on for Splunk provides exactly this. So it acts as a single pane of glass allowing you to navigate your entire infrastructure hierarchy and drill down into the smallest physical details.42:08From individual disk health to CPU capacity, all within the Splunk platform. So this dashboard is built around an interactive hierarchical preview. It allows us to navigate seamlessly from the high level account.42:25Or domain or domain down to a specific chassis fabric interconnects and individual servers. Whether you are managing a standard rack server or the latest unified edge deployments, you have a clear logical map of of your entire physical state.42:42Right at your fingerprints. Now we are, we are going to talk about monitoring logical infrastructure. So while physical hardware health is vital, modern data center management is increasingly focused on the logical configuration.42:59Of cellulars.43:19So in Cisco intersight, a server profile is the blueprint that defines a server's policies, firmware and identity. If that blueprint is out of sync or failing, the physical hardware cannot perform its rolled effectively. So the server profile health dashboard in explore.43:20Is designed to bridge this gap, providing a single view of your logical configuration health.43:41Deployment status and associate faults. So this dashboard gives us an immediate pulse on our logical infrastructure. So at the top we can see the big picture, how many profiles are deployed, how many are unassigned.43:47And most importantly, the template sync status. This is critical because it tell us if our servers are actually running the configuration we intended. If a profile show us out of sync, we know exactly where to investigate to prevent configuration there.44:02Moving down we have the server profile config state table and visualization. This allow us to quickly identify which profile are associated versus not assigned. Beyond just the status, the dashboard categ categorize active false by severity and type.44:21This is our primary tool for risk analysis. We can see if a specific configuration is generating repeated faults allowing us to identify persistent risks before they impact our production workloads. So the true power of this dashboard is is ability to support root cause analysis.44:39By correlating configuration states, we, with active alarms, we can quickly answer, is this fault caused by a bad hardware component or is it a result of an incorrect policy applied via the server profile?44:58This correlation save usage from wasting, wasting time troubleshooting the wrong layer of the stack. In a complex infrastructure, the sheer volume of alerts can often lead to alert fatigue where critical issues are both.45:13Put it under a mountain of noise.45:33So the alarms inside dashboard is the solution to this challenge. It provides a centralized single pane of glass view into all Cisco UCS alarms managed within Cisco Intersight. By ingesting this data into Splunk, we can perform advanced triage.45:36Track resolution progress and gain the visibility needed to keep our infrastructure healthy and operational. So this dashboard is our common center for alarm management. At the top we get an immediate status summary. How many alarms are active?45:55Clear it, suppress it or acknowledge. This allow allows an administrator to instantly access the temperature of the environment without having to log into multiple systems, so we don't just want to see that there are alarms. We want to understand what they are.46:14The pie charts on the dashboard allow us to analyze the distribution by severity, could be critical warning info and by category, hardware network configuration. So these help us identify system systemic issues. E.g., if we see a spike in network cutoff category alarms.46:33We know exactly where to focus or troubleshooting a force. One of the most powerful feature here is the ability to monitor trends over time. So we can see how alarms are being generated and resolved, which help us our team's response efficiency. Furthermore, we can identify chronic.46:53Those persistent alarms that remain unresolved for 71530 days?47:14And more, this capability is vital for preventing silent failures where a minor issue is ignored until it becomes a major outage. So the detailed alarm records provide in the table allow for rapid thresh. We can see the description, the severity, the affected object, and the current status.47:19Suppress it acknowledge for every alarm. So this level of detail ensured that when an operator pick UPS an alarm.47:39They have all the context required to start the resolution process immediately. In a UCS Fabric Interconnect management environment, resource pools such as IP, Mac, WWN, and UUID are the foundational beating blocks of your server identities.47:47However, as the environments grow, managing these pools become increasingly complex, so overlapping address ranges or conflicting assignments can lead to intermittent connectivity issues, storage failures or even server identity collect collisions that are not.48:07Notoriously difficult to troubleshoot. So the pools inside dashboard is all proactive solution providing a centralized view to detect and resolve these conflicts before they impact production. So the current strength of this dashboard is to use a link graph, so in a large scale environment.48:27It's nearly impossible to manually track how different pools overlap. So these graphs provide a visual map of the relationship between your address ranges.48:48If you see a conflict or an overlap, it's immediately apparent in the visualization, so allowing you to identify the source of the issue in seconds greater than the hours of manual lock review.48:58In a moderated data center set it and forget it is a received for operational risk. Security vulnerabilities, hardware end of life milestones and critical field notice are a constant challenge that requires a structured response. So the advisory inside dashboard is for proactive defense.49:15This mechanism.49:34By aggregating this intelligence from Cisco Intersight into Splunk, we gain a comprehensive real time view of our big posture allowing us to manage our infrastructure life cycle and security compliance with precision and speed. So at the top of the dashboard, we get an immediate.49:35Napshot of our we can see the total volume of active versus acknowledged advisories. This is all to do list for infrastructure maintenance. It tells us exactly how much work is outstanding and ensured that NO critical security advisor or field notice is overlooked.49:55In the day to day noise of operation.50:15The pie charts here are essential for prioritization. We don't just see a list of alerts. We see them segmented by advisory type, management platform and hardware type. So this allows our teams to prioritize based on impact. E.g., if we have a security.50:19The advisor, affecting our entire GPU then server fleet.50:38We can immediately identify those specific assets and escalate the response. The the this dashboard is a key tool for avoiding operational depth by tracking end of life and end of sales announcements. We can plan our infrastructure refresh months or even years in advance.50:42So this prevents the emergency last minute migrations that occur when hardware is NO longer supported, allowing us to budget and plan or upgrade strategically. So finally we have integrated security intelligence. So the table at the bottom links specifically advisories to reference.51:01A common vulnerability and exposure. So this is critical for all security and compliance teams. They can see exactly which vulnerabilities are present in our environment and link them to the official Cisco documentation ensuring that our response to emerging threats is both rapid.51:21And fully compliant with regulatory standards. In a high performance compute environments, the network is often the most critical and most difficult component to troubleshoot, whether it is congestion packet loss or unbalanced traffic, network issues can manifest as.51:40Application latency.52:00Or a server under performance. The network troubleshooting dashboard within the Cisco inter site at home for Splunk provides the visibility needed to pinpoint these issues. By correlating inventory and matrix data, it allows us to analyze traffic patterns across our entire infrastructure.52:02With unprecedented clarity. So the power of this dashboard lies in its flexibility. So we don't just look at the network from one angle. We provide three distinct perspective to help us isolate problems.52:22The 1st perspective is domain view. This is our high level overview, allowing us to see traffic distribution across entire management domains. 2nd is chassis view. This let us drill down into a specific physical enclosure to see how traffic is distributed among the blades. And finally server view.52:38This provide the most granular level of detail allowing us to inspect the traffic patterns of individual servers.52:57This type of supports both internet and fiber channel traffic analysis. And so this is vital for our modern data center where converged infrastructure is the standard. So we can track utilization, congestion and error rates across all our network objects.53:05The traffic distribution table is a great example. It breaks down transmit and receive traffic by fabric interconnect fabric interconnect B helping us to immediately spotty for traffic is unbalanced across all redundant paths.53:23In a large scale data center, physical space and power are premium resources, so knowing exactly where you have available capacity is essential for a strategic planning.53:40Whether you are deploying new workloads or consolidating existing one. So the server slots utilization dashboard provides a clear at a glance view of your chassis capacity, specifically designed for X series environments, allowing you to identify available slots.53:54Instantly and optimize your hardware footprints. So this dashboard is all about efficiency. It give us a direct view of our X series chassis utilization comparing occupied slots versus unoccupied slots.54:13The color code interface is designed for speeds. Bread indicates high back vacancy, lots of unusage slots while bring indicates high utilization. This allow us to quickly scan our entire global infrastructure to see where we have room to grow.54:30Network cycle redundancy check errors CRS CRC errors are one of the most common indicator of physical layer issues such as faulty cables.54:52Bad SPF models or interface misconfiguration. So this error can cause several performance degradation packet loss, and application latency that are notoriously difficult to track down. The network RXCRC errors dashboard is all specialized tool for detecting these issues.55:03Early, allowing us to maintain the high integrity network fabric required.55:23For our mission critical. So this dashboard provides a system wide view of network health. Instead of manually checking every interface, we have a central centralized table that aggregates our X CRC error counts across all all inter site domains.55:29This give us immediate visibility into which domain and a specific port are experienc experiencing issues, allowing us to focus on troubleshooting force exactly where they are needed. Okay, now moving on to help you get.55:47Start immediately the Cisco Intersight add on for Splunk includes a suite of.56:07Pre build sample reports. So these reports are designed to provide instant value covering the most common operational and security use cases right out the box. So instead of building queries from scratch, you can leverage this templates.56:13To quickly generate insights into your infrastructure health performance trends and security posture. So think of this as your accelerators. So they serve as ready to use reporting tool and a great starting point for customizing your own advanced.56:31Analytics. So while custom dashboard are powerful, sometimes you need immediate answer to common operational questions. So the Cisco inter site add on for Splunk comes equipped with a library of prevail sample reports.56:48That acts as your operational shortcuts. So these reports are ready to use, providing instant visibility into critical areas like hardware compliance, inventory status, and life cycle management without requiring you to write a single line of.57:04Splunk processing language. As you can see from the list, we have included a wide range of reports that cover the most frequent tasks or administrators perform. This includes e.g. compliance and life cycle these reports like Cisco compute hardware compatibility list report and.57:20Help us stay ahead of hardware maintenance and support requirements.57:42Another example is inventory and status reports like chassis slot utilization and license status per account gives us an instantive view of of resource consumption. Another example is security and health. Reports like advisory details and view of servers with alarms.57:47And HCL status allows us to quickly identify and prioritize the most critical issues in our environment. So these report aren't just static views. This, they are fully interactive. By clicking opening search, you can take any of these prebuilt reports and modify the underlying query to feed your specific.58:06Minutes.58:26So this makes them excellent learning tools. If you want to understand how to query inter site data in Splunk, opening one of these report is the best way to see the logical behind the search. So by leveraging this report we significantly reduce the time spent on manual data gathering, whether you need to prepare for an.58:27Did plan a hardware refresh or perform a quick health check. These reports provide the data you need in seconds.58:47You are a core part of the accelerator strategy we use to ensure our infrastructure management is as as efficient as possible. Sample SPL queries. A SPL stands for Splunk processing language.58:56It is the powerful common driving language used to search, filter analyze, and visualize and visualize data with Splunk within Splunk. So think of SPL as the SQL of the machine data world.59:13It allows you to take the raw telemetry we have ingested from Cisco inter site and transform it into meaningful insights such as calculating error rates, identifying trends or creating custom dashboards. So these sample queries are designed to help you get.59:28Get comfortable with the syntax so you can start building your own custom analytics.59:48To see the powerful SPL can be, let's look at a practical example analyzing alarm date. So the query shown here is, as you can see at the bottom of the of the slide, index source type Cisco inter site alarms, start comb by severity. So we are telling Splunk to search across.59:56All indexes for data originating from our Cisco inter site alarm source. We then use the stat command.01:00:16To group these events by the severity level and content. As you can see in the visualization, this instantly transferred thousands of raw log entries into a clear actionable chart. We can immediately see that we have 120 critical alarms.01:00:24Compared it to 34 cleared ones. So this is the beauty of SPL. In just one line of code, we have moved from raw data to a higher level operational insight inside that help us prioritize our response.01:00:44Moving beyond simple counts, so let's look at how we can extract specific inventory details such or license status. So you can read the query used at the bottom of the slide. So we are filtering by the license source type and specific object type.01:01:00To target the exact data we need. The, there is a comment the dup mode command is crucial here because we only see the most recent status for each unique object removing any redundant log entries. And finally the table command formats the output into a clean readable report.01:01:18So wh what is the results? So we get a precise tabular view for license health across all accounts. So we can instantly verify our registration status, check for any sync status issues and configure the highest compliance license tier for every environment. So this query is a perfect example of how SP.01:01:36Will allow us to move from row on certain logs?01:01:56Do a clean audity audit ready compliance report in just a few seconds. And with that, I'm going to back to you Priyanka. Thank you, Jorge, Sharing my screen again. Okay, he looks good.01:01:59Thank you Joe. So in our 1st demo, we looked at input and configuration tabs and in this demo we are going to look at some of the dashboards and reports. So if you look at these three tabs called inter site insights, inventory browser and show in.01:02:20Network troubleshooting. So this is where our default dashboards lie. And then the reports is a tab where you can see prebuilt reports and search is where you can make your own queries or or have the queries from dashboard or reports and modify them.01:02:39So starting from the 1st dashboard, inter site insights, the 1st one is activity monitoring dashboard. So this is where you'll see all the user activities. You can select the time range, you can select the account name. Since I have multiple inter site accounts here, I see.01:02:58All of them here.01:03:18And then this map also gives you details about user geography and longitude and longitude as well if you go down, but coming from the top, the, there are some event type distributions, browser access insights. You can see your browser.01:03:19User user browser login information as well, user activity, timeline.01:03:39Login activity overview, and if you go down this is what I was talking about. You can see your details about geograph user geography, and if you hover over it, you'll see some longitudes and longitudes as well. If you go down, you'll see some more details as well about user information.01:03:46And their activity?01:04:05Now coming back to our second dashboard called alarm insights. This is where you'll get the comprehensive view of alarms. So by, instead of reviewing alarms, one device at a time, Splunk aggregates them across all your environments so you can immediately.01:04:07That is the most critical issues and alarms.01:04:27So again, the similar kind of filters, the time range, the account name, inter site domain, if you're looking for any specific domain, you can come and select here. Then this one, if you want to include your servers with profile or without profile, you can do that here. Now coming to our widgets, there are you can see some.01:04:30Active alarm cleared alarms, suppressed alarms.01:04:50Acknowledged alarm, the alarms that you are acknowledging on inter site will be viewed, can be viewed here. If I come down to our next widgets, you'll be able to see the name of the alarm, its description, the severity, the affected object and the affected object type.01:04:54Right, if it's suppressed or not and if you have acknowledged it or not.01:05:13Then alarms by severity, by category, and then if you come down, if you're if you have any persistent alarms that are older than seven days, you'll see the list here. Now coming to our 3rd dashboard called advisory.01:05:19The insights.01:05:38So this dashboard aggregates Cisco inter site advisories across all your managed infrastructure. So these device these advisories include end of life advisory, security advisory and field notices, and all of them are published by Cisco and they should match your environment against your environment.01:05:40To show up here.01:06:00This dashboard helps you kind of move from reactive troubleshooting to proactive maintenance. So instead of waiting for failures, you can just quickly come here, look at your affected infrastructure and take actions. You can upgrade it or take actions on the work around activities.01:06:01So if you look here, you can select the timeframe and account name. You can exclude the servers that are not associated to your server profiles, and then looking at the widgets, you can see active advisory instances, acknowledge advisory instances. If you come down, you can see the.01:06:20Advisories, details, types and object types, and then advisories instance by object types. So moving on to our next dashboard server profile health monitoring.01:06:41So one of the biggest operational challenges maintaining consistent server configuration. So this dashboard allows you all to monitor profile deployment health and quickly identify servers that have failed profile association or require any kind of action from your side.01:06:59So again, you can select your account name, your total server profile, server profile with assigned servers. If you come down, you'll be able to see the server profile config state, then you'll see a server profile config state based on their statuses. If you hover over.01:07:18For it you'll be able to see the count as well. So the inconsistent server profiles are the profiles that you have made changes to, but have not deployed to your servers. So you can come here and look at those change, look at those configurations as well.01:07:39Then if you select the time range, you'll be able to see the active alarms and in by your server profiles and then by the server profiles type as well and so much more.01:07:56Coming to our next dashboard called pool insights. So this dashboard provides a consolidated view of various pool objects in inter site, so including all your network storage and identity pools. So it helps you monitor your pool utilization, your availability, and assign.01:08:13Time status as well. And we all know the pools are finite resources and without monitoring without monitoring your deployment can fail because the pools are either exhausted or NO longer available. So this dashboard kind of provides the visibility into infrastructure identifying your resources. So if you.01:08:33Look at the widgets, you can see the Mac pool linkage here.01:08:53Oh, yeah. And then over and different different widgets and if you come down you'll be able to see the resource pool utilization check. So this is very interesting field called utilization percentage.01:08:59So if it's hundred, meaning your pool is exhausted, if it's near to capacity, it's 80 % utilized and if it's healthy, which you see here, this means they are healthy and you have enough space in your resource pools.01:09:14Now coming to our next dashboard called slots utilization and CPU metrics insight. So this dashboard provides both capacity planning and operational monitoring. So instead of simply showing whether the servers are healthy, it helps you understand how efficiently.01:09:35Your compute resources are being utilized across your environment. So if you look here, you'll see unused server slots.01:09:55So you can see the list of your unused server slots, your slots that are being used. If you come down, you'll be able to see the CPU utilization. You can click on your account and look at the specific account name as well. Select your domain if you're looking for anything specific.01:10:05Now the last one under inter site insights is error metrics insight. This dashboard consolidates your infrastructure error metrics in a single view. So if you see any trend in any of these widgets, it helps you determine trending over time, meaning you can actually distinguish.01:10:30Between your isolated events and all the recurring issues.01:10:51You can select the account name, inter site domains, and then you'll be able to see some of the things popping up here. If you have any errors here, they'll pop up here. Now this was about inter site insights.01:10:56Dashboards are now coming to our next dashboard called inventory browser. So this inventory browser kind of acts like a centralized asset inventory, so whether you're looking for a specific server, checking a specific firmware versions of verifying hardware models or even locating of.01:11:15Fabric, interconnects, you can quickly come here, search and filter your infrastructure from a single interface.01:11:35So you can either select your inter site account or you can come here and keep going down to your account and then to any, any of your hardware and then the data will start populating on the top on the right.01:11:44Right side of the page.01:12:04Then you can see the ports. If you come down all your PSUs, everything here. So this was about the inventory dashboard. Now coming to our network troubleshooting dashboard. So let's see if you have identified some issues in inter site.01:12:05Dashboards inter site insights dashboard. Now you can move into network troubleshooting dashboards. So these dashboards provide you deeper visibility starting from your domain level to chassis level and to server level. So starting with the domain.01:12:25So this dashboard provides you a domain wide view of your network health. So instead of investigating individual devices, you can immediately come here and look at the error trends, heavily utilized ports or or anything unhealthy going with your fabric interconnects.01:12:42So which will help you with the troubleshooting and once you identify your domain, you can just select a specific domain and continue troubleshooting in that domain. So, I selected a timeline for last seven days and now let's go and select a specific account and then we'll see what resources will.01:13:02The data is here. So it gives you utilization for traffic distribution of your uplinks. Then you come down, you have a utilization percentage per port.01:13:22And then the errors. So here we are looking at some CRC errors across the UCS these two UCS domains. So previously you would have to connect to multiple fabric interconnects, inspect.01:13:35Interface counts compare CRC values and sometimes manually determine which links are affected. And in a large environment that process could easily take 30 min or even more in some scenarios. And this is just to identify the problem, the issue area.01:13:51But with inter site integration with Splunk, Splunk kind of integrates all these metrics into a single dashboard and it is allowing you to see the CRC trends. And if you look at this table, you'll be able to see which fabric interconnect is affected your port type, your port role, your.01:14:09Port number. So instead of spending time in gathering data, you can actually spend time in resolving the issues because you have everything you needed in this, in this table.01:14:29So this was about the domain dashboard. Now moving on to the chassis. So the domain dashboard, this sorry, the chassis dashboard narrows the scope of troubleshooting from, domain to chassis, so it helps you identify all the issues related to your chassis connectivity, I/O model.01:14:42And any shared infrastructure, so.01:15:02Before investigating specific blade servers, you can come here and look at your chassis performances and utilization. So again, similar filters, time range, your account name, domains, chassis.01:15:07Then if you look at the widgets, you'll see the utilization percentage per port. If you come down here, you can see the IFM uplink port, downlink port for transmit and receive. And then if I come down here, if I have any errors, it'll, it'll come up here in this way.01:15:22Now moving on to the next dashboard called server, after narrowing the investigation to an individual server, this dashboard provides detailed interface level visibility. So you can quickly come here, identify your network errors, bandwidth utilization, any.01:15:45After health issues impacting your specific workload.01:16:05So a similar filters, account name, your time range, if you know which domain you're specifically looking for, you can select them here, the chassis, server profiles filters, and if you go down, you'll see all kind of utilization, transmit received from server.01:16:11And then of course the errors at the end of the dashboard. So if you notice this network troubleshooting dashboards, these are narrowing down the scope of analysis. So we begin with overall a UCS domain to determine which, whether the issue is widespread.01:16:32If necessary, we drill down into affected chassis to inspect all the shared infrastructure we have and then finally to an individual server to isolate if we have any interface level or adapter specific problems.01:16:52Okay, so this was about the dashboards. Now moving on to the report. So this section provides pre built reports based on the data collected from intersite. You have an filter here that you can apply if you want to see just the report constructed by you.01:17:09You can just click on yours and if you want to see the default reports, you can just click on this apps. So let's take an example of one of the.01:17:29A reports here. So let's see you cisco compute HCL report. So if I click on edit, I will be able to see the description edit description permission, edit schedule. So if you want to.01:17:39Trigger any actions if you want to schedule the report for weekly, let's say you have something that you want to deliver every Monday at 08:00 A.M. so you can do that. You can schedule this report and then it will be delivered to.01:17:54During that time. And then if you want to look at the a query that's this report is running and maybe modify it, you can just click on open in search. It will take you to the search tab we have here and this is the query that this report is.01:18:10One, you can of course make any changes to it if you'd like and then click on save as you can save it as a different report. You can also save it as an alert.01:18:30You can also save it to an existing dashboard or you can build a new dashboard out of this as well. And then you can also see the table view for this report. So well, that is all I wanted to show you all for dashboards and reports. Now I'm gonna pass it back.01:18:41To Jorge to close out the session.01:19:01Thank you. I'm going to share my screen again last time in two. Okay, just to wrap up, here are the three key takeaways from our session about integration with Intersight.01:19:05What are the advantage of using this integration? 1st of all unified visibility, we have established a single pane of glass to monitor hardware health and network performance across your entire inter site estate.01:19:23Second proactive operation, we are shifting from reactive to firefighting to predictive remediation by leveraging automated alarms, advisory tracking, and hardware compatibility list compliance monitoring.01:19:40And finally operational efficiency, so we are drastically reducing mean time to repair by utilizing prebuilt dashboards, interactive inventory browsers and deep dive network troubleshooting tools. So in short, this integration gives you the clarity and intelligence.01:19:56Needed to manage your infrastructure with confidence. And with that back to you Joe. Wonderful. Thank you very much Priyanka and Excellent demonstrations and presentations.01:20:16Now for our audience I'm going to share my screen here and we're going to close this out with a few final thoughts. At this time we are open to live Q and A, and I'll provide some additional resources. For Q and A, you can use that Slido if that's available to you, slido.com.01:20:34And enter that join code. Otherwise, if you got something that you're not unable to put in Slido, just put it in chat just so we can get your question. We don't have any at this time, but I'm going to.01:20:52Give you some additional information here. I'm gonna give you a link to our community@Cisco.com let me paste that in here.01:21:09And we will keep an eye out for any questions that come in. We also have a session survey if you don't mind, just taking a few minutes to go in and answer a few questions for us.01:21:30Tell us how we did and let us know what we can focus on to give you a better presentation. Survey should be underway. Here you've got your QR code and the.01:21:48Join code and passcode there at the bottom. Now, this is second to the last in our current series on intercite. You see here at the bottom, we've got our next upcoming session. It's a live Q and A and quick reca.01:22:04Cap of all the previous sessions.01:22:24Is coming up on 21 July of this year, 10aM. Central, and we've got a QR code there for you. I'll also paste a link to the series in chat for you so you can go right to that. By the way, this is also where the record.01:22:26Recordings get stored. So you want to go back and watch the recordings of previous sessions that's a common topic with folks. But we do want to make sure that you have access to that, but still intend the upcoming recap and Q and A.01:22:46Now let me share with you a little bit about Cisco IQ. As far as your IT landscape, we know it's evolving into the mythose era, time of unprecedented complexity and scale. Cisco IQ is ready to meet that challenge.01:23:07Moving beyond traditional support to provide absolute clarity and intelligence. This is a digital intelligence platform that's gonna leverage anonymized global data in order to provide you with personalized insights and benchmarks tailored to your specific IT environment. It also allows you.01:23:26To measure your current technology maturity against industry standards.01:23:46Helping you to identify exactly where to focus your optimization efforts. Now by transferring complex data into clear actionable intelligence, it empowers your team to make data driven decisions that are going to accelerate your digital transformation goals.01:23:51We see four points here on the screen of the value that Cisco IQ can bring to your business. We see it provides complete landscape clarity, gonna be managing modern infrastructure, which is like solving a 10000 piece puzzle without the box cover.01:24:09Now you're very often flying blind until a complete failure occurs. Cisco IQ is gonna help eliminate those blind spots providing a single absolute view of your entire Cisco IT landscape. Moving on to number two for active resilience.01:24:29Every outage leaves a digital trail. Most disruptions are preventable stemming from unpatched vulnerabilities or misconfigurations that go unnoticed. Cisco IQ identifies these risks before they impact your business. Shifting you from a role of a reactive firefighting into one that's doing proactive.01:24:47To resilience.01:25:07Now number three, rapid resolution. When A one incident occurs, every minute of downtime erodes trust and value. We are collapsing the traditional resolution timeline from hours to minutes by eliminating the manual documentation hunts and complex escalation chains.01:25:09And lastly, complex deployments are often stalled due to a lack of talent, not necessarily, but because critical knowledge is siloed. Cisco IQ brings over 40 years of institutional expertise to your projects ensuring we built it right the 1st time, every time.01:25:29Now for existing cloud CX customers, you'll be able to migrate your data automatically over to Cisco IQ. Yeah, you do have to be an admin for that. Step one, you'll just want to log in to Cisco IQ and enter your Cisco connection online ID or CCO ID.01:25:51Login help, you can go to login and account help. Second step, you'll need to name your account and select what to migrate. Step number three, you'll simply create an account and migrate that data.01:26:11And for the 4th and final step, once your migration is complete, you'll be redirected to the Cisco IQ launchpad or the welcome page if there are more accounts for you to do. Now if you're a new Cisco IQ administrator.01:26:27A couple of easy stuff there to get your stuff in there. You want to create a new Cisco account, you want to create a name and select the primary storage for your account, and lastly, just a 3rd step. There you want to do a self.01:26:47In account configuration where you can explore Cisco iq's features and applications. These are gonna include things like Cisco Connect Cloud products.01:27:06You're gonna be able to add service contracts, add a link in Cisco IQ and manage your users and explore Cisco IQ itself. Hopefully you've had time to take a look at the survey that we started.01:27:16In the meantime, I have a link here that I'm going to provide some frequently asked questions for Cisco IQ. Put that into our chat here. Please visit that link, walk through those frequently asked questions.01:27:38May turn on some lights to you and explain just how easy that process really is. Otherwise, this has been today's expert insights series, the Splunk.01:27:54Integration with intersight. We thank you for joining us today. Thank you for your time spent with us.01:28:11