Unified Data Center Visibility with Cisco Splunk

Oh, again, thank you. Thank you all for joining us this morning. This is the session we're gonna cover today. There you have a QR code for the Slido questions that we are going.00:00To launch during the session to get more insights and information from your side. The Slido poll is also embedded in the Webex app, so if you're joining.00:20From a PCR computer, you should already have a tab on the right side with the slide of questions showing up. And we already launched the 1st question actually, to understand a bit of your role.00:30Within IT, so we know a bit more on what's your experience and what's your, what's your priority and your your view concerning monitoring operations and and Splunk. So let me just 1st remind you so today by the way, my name is Harry Pico and.00:47I have with me Khalid and Barris, we are all from the same customer success team covering the data center and C and cloud and AI solutions for Cisco in in EMEA region.01:07And they are gonna help me as panelists to answer your questions during the session. If you have any questions, please do use the Slido tab for questions and not the questions from the Webex itself because we it's easier for us to track.01:21And respond and make sure we are following and responding all the questions through the, through the slido. And the other thing I wanted to share with you is our upcoming calendar for for experience for May and June covering the DCN part. So this is.01:37How it's how it looks like. You have the QR code as well and you have a link in order to register to those upcoming sessions about micro segmentation, data visibility, next dashboard and on latest news on our hyper fabric solution that it's gonna be within May and and June as you can see.01:55So that was for the introductional logistics. We we are already got We already got a few votes on your on the 1st question. What I see mainly we have networking and compute field engineers or.02:15Architects and a bit of operations as well. So it's it's fairly balanced, which is good. That way you can you can you come from both sides of the, of the data center house and you might get insights on what we.02:31Are offering and why we believe.02:51It is a good idea to use Splunk to grab information and data analysis for for our data center solutions. So let's kick it off. This is how the flow of the session of the session looks like. We will initially cover.02:53A bit of an introduction on Splunk, why we think Splunk brings value to the operations teams and we next s we will next focus on the DC applications for Splunk and we will cover them in detail on 2nd part of the session where we will also believe.03:14For a demo, a leave them on our lab of both the DCN app for Splunk so covering the networking part of the data center and also the applica the app for inter site where we can also grab information and insights for the, from the UCS compute side of the house.03:33And finally, as usual on our expert inside service, you will review questions if there is anything left that we didn't cover, and you will get the survey at the end of the session where you can always ask for follow up session with.03:50One of our experts within the team. Alright, so let's let's start about Splunk. So what we usually see on the most of the operations organ organizational departments in the IT.04:10In the IT world is we, the complexity on the IT solutions and the different stacks within IT is getting higher and higher, as you may know, and we, this comes with visibility gaps, right? We are.04:29It's harder and more complex every day to get all the valuable information when it comes to troubleshooting or being proactive towards incidents, issues and lots of services, right? We have lots of tools, different vendors, different, teams managing.04:46Them so it's very fragmented.05:06On the data side, but also on the on the review revision and the and the monitoring of each of those solutions, right? So we tend to have silos, we tend to have war rooms like it says here on the slide, where each team takes care of their own vendor platform environment, but.05:10There is NO direct correlation or relationship between the different layers which are all in the end.05:30Part of the same service, right? In the end we are providing a service to our, other organizations within the company or to end customers outside of the company. And in the end, we are just handling or monitoring or.05:37Provisioning a specific layer, but there is NO an overall view on what is going on, which makes it very hard to troubleshoot or to be proactive on the incidents when it comes to, to the IT world. So luckily, we have.05:53Something that may provide full stack or cross observability through all these different layers and one of the solutions that provides that it's Blank, right? So NO matter we're talking on the infrastructure, whether it is compute storage, networking, where we talk about the hypervisor vitarization layer, the operating system.06:10Kubernetes whatever or even on the higher layers, the application layer, the user experience and so on.06:30And of course security which is across all the different layers, we Splank has the ability to ingest, analyze, and correlate all the information that comes from those different layers, whether that is events, logs, metrics.06:36Or traces, which is the four main different types of data we can gather from, from all those different systems. And by the way, this is vendor agnostic, right? Today we will focus on how we integrate and what kind of visibility we get from the Cisco DC networking and compute solutions.06:55But you know, and you may know Splunk has many hundreds of different apps and add ons from different vendors, NO matter it is security, vitarization, operating systems and applications, right? So this is vendor agnostic not only related to to Cisco, but that's the good news. So again, as I was.07:13Saying the what we call now unified observability experience covers.07:34All the stacks through that come that make that build an application or a service towards your customers or towards another organization in your, in your company. Today we will focus on the two that are in blue, right? The infrastructure monitoring and the network.07:40Observability from the data center perspective. Now, just a small recap on how Splunk works and how it can be deployed. This is mainly for the people who don't have experience in Splunk or the monitoring side of the house. As you know.08:00Or you may know Splunk can be deployed or consumed in two different favors. Either you can deploy an instance of server on prem and that runs on a Linux operating system and maybe a virtual machine, maybe a bare metal server, and.08:19In between you may also deploy what we call a forwarder or several forwarders which are kind of proxies that will gather the information, the data from the different devices and platforms you are while to monitor in your environment, right? And then when it comes to gathering data, this can be done.08:37Via API queries, it can be via receiving syslog via SSH and doing CLI commands via webhooks. So there are different kinds and ways to.08:57For Splunk to gather this information. And again this forward can act as a proxy in order to centralize all the data gathering and then sending forwarding it back to the server where we have the database, where everything is indexed and stored in a proper way so that searches can be done.09:09Effectively in a and in with a good performance. So it can be.09:29Deployed on prem, that's what we call enterprise or we can consume it as a SaaS, right? As a service as in cloud format, right? And then in that, in that model, you can also deploy it forwarder or several forwarders on your data center premises. You that will in that.09:34Scenario they will have.09:54Secure connection and connection towards your Splunk instance in cloud and all the information will be ciphered, encrypted and sent to the cloud where it will be stored for the later analysis and queries and correlation and so on. And in both scenarios you can either consume that base.09:56On storage ingestions so how much storage your Splunk is ingesting per day?10:16Or how much complete capacity, how many virtual CPUs your instance is consuming. So these are the two consumption models. Now, that tendency today, is more towards the cloud because it's a service provided by, by Cisco, by us.10:20There is NO maintenance required, NO app is required, NO capacity planning for the storage and the compute required on your side and also every new feature that comes out is always cloud 1st release, right? So more and more companies are moving from the on prem scenario to the.10:40Cloud SaaS consumption. So that's just a bit of a recap or ah an overview on how works. So the way we interact with different systems in our data center or in our network or in our infrastructure is by using apps and add ons.11:00So these are small plugins that you may install over your Splunk instance, whether it is on prem or in cloud, it's valid on both. The process is the same. There is a marketplace if you want to call it, which is called Splunk base, where you have thousands of different apps that have been validated by Splunk. So these are.11:19Through reviewed and approved and validated by by Splunk to be consumed and to be installed and deployed over the Splunk server or the Splunk platform. And that's how we usually allow or make it easier for you to start consuming and gathering data from a specific platform a specific.11:39System, NO matter what vendor it is and NO matter what layer it is. So we have.11:59Different, different type of add ons. So here the example for Cisco solutions you see we have add ons for Meraki, for Catalyst, for CC networking and inter site which is which are the two I'm gonna cover in more detail. We we also have another one for appdynamics and so on. And as I said before, the thre.12:04There are different ways how each app may collect information from your systems.12:24And in the end it's all about, again, metrics, events, logs, and choices, right? So if we focus on the DC area, what we have on one side, on the left side you see the DC networking app and you have the URL.12:31Well if you wanna check the details on the on the application, you can just go to Splunk based.Splunk.com and you can there's a search bar where you can just put Cisco DC networking e.g..12:50Or the you have the number of the app which is 7777. This app, this app will allow you to ingest data from ACI fabrics, Nexus dashboard clusters, and individual autonomous nexus 9000 switches. That's on one side, now the compute side of the house, on the right side of the screen, you have the inter site add on.13:00So it's exactly I mean the difference between app and add on maybe you saw on the slide before it's a bit on what it's supposed to include, but it's in reality it's the same. You can call it either app or add on, it's a plugin that will have some predefined connectors and data that is going to gather from the system. So there's the inter site add on.13:20To connect either to your cloud inter site account or to your private or connected virtual appliance.13:40On prem and it will help you gathering the data. There's the URL link as well. And finally, we have what we call, we have recently released a Cisco app navigator, which is kind of a an easier way to search and look for the different apps. There are more than 30 apps available as of today.13:46For our covering our whole Cisco portfolio. So this is just like a searcher for Cisco apps within Splunk. You can install that and it will, it will show you all the apps available. And from that inst initial app you can later on install additional apps like the CC networking or the inter site app e.g..14:07Now we have a different thing which is not directly related to the apps and it's specific for Nexus dashboard for the two. So this is our latest release in the Nexus dashboard train, which is what we call native Splunk. So you may have heard if you come from the.14:28DCN world, sorry. If you come from the DCN world, you may have heard that there is a nexus dashboard.14:46For the two that was released like mid March so month four six weeks ago and for a specific deployment, which is the one node deployment of when you're using the latest generation of UCS server, the UCSM eight, we allowed it was the 1st one that was validated, this is the new.14:52Initial release where we are allowing to launch an embedded or a native Splunk instance within the next dashboard cluster itself. So there is NO need to deploy Splunk outside of the cluster.15:12It is already embedded there. Again, it's only on the one node cluster as of today because it's the one that we were able to validate initially, but the plan is to allow that on further releases on the three nodes and the six nodes cluster as well. So it's.15:22A set of Kubernetes ports that will be deployed on this cluster, allowing you to run Splunk inside Nexus dashboard. Now, in terms of licensing, the good news is that if you are using consuming DCN from your licenses on your switches, on your fabrics.15:40It is already included, so NO NO need for a Splunk license. It will be provided within the DCN premier licenses. If not, you might have to acquire a separate Splunk license for that instance. It is a native.15:56Instance that is only intended to be used for Nexus dashboard. So you cannot add external apps or external targets or sources for data. It will only gather data from Nexus dashboard that and that will be done automatically by the way, once you enable Splunk on the system settings, you will have that icon there that you can see.16:13See here about launch splunk. It will now be launched internally, it's same might be and the dashboards are provided here by default about anomalies and advisories. These are the 1st ones that have been included in the dashboard, part of the of the Splunk tool, but there will be more to come. So this is very.16:33Specific to latest release nexus dashboard with the latest hardware model and as of today, single server deployment only, but there is more to come on the next next to dashboard release. So that was a bit of a.16:53And the isolated comment on the nexus dashboard platform, but let's go back to the, to the EDC applications that you can install on any Splunk server, whether it is on prem or cloud instance that you maybe running. So that's for 2nd part of the session and.17:10We will, we're gonna launch a second question, right? Before I start with the details of the apps. I don't know if you can take care of that and and launch 2nd question where we are asking if you are already monitoring.17:29Your data center or your network or your system using Splunk. We are interested to know if you're already using Splunk to monitor your environment. Let me see if I can launch that. There we go. You should already see 2nd question popping up.17:47So about the apps, so is I see most of you are not using Splunk yet, so it's a good way and day to discover that and maybe evaluate usage in the future. So the VCN approves the three items you can see here, as I said before, next.18:05For ACA and access 9000. Now the kind of data do what you will be able to ingest from those systems is different as you can see.18:24I will go through some of those information on the demo in a bit. Now, the question might come and we usually get that from customers. What is the value of visualizing that data on Splunk compared to Nexus dashboard, e.g.? Cause you if you.18:34Don't know Nexus dashboard. It's our visibility and observability and analytics tool specific for data center networking for next to ACI and so on, right? So what is the value, what is, what should I use Splunk for in if I if I'm already consuming next to dashboard? So the question, I would say that the the the key thing here.18:52Here is not the value it brings to the data center networking team because you.19:12If you are a networking engineer, you might be already consuming next dashboard and using the different tools inside and seeing anomalies and seeing flows and events and so on. The value in Splunk, you will not see different data there, so exactly the same data in a maybe a different format, a different way to visualize it, but the.19:17The key value in Splunk is the.19:37Cross domain visibility. So the the ability to correlate and ingest data from all the different layers that we saw before at the same time. So imagine there is an issue in an application and users start complaining if there is a delay on the, in the answer of a specific.19:40Application or specific process and you don't know what the issue is. Can it be of the application layer, it can be on the compute side and processing memory CPU can be on the network side. Each team starts looking on their own systems, right? Now the good thing about Splunk again is that every.20:00Single all there is across these that are consumed by this application can send the data and the logs and the valuable information to Splunk and Splunk can show that information and filter that based on application on timing or IP addresses or an environment whatever and correlate that information to show you what.20:18Might help you further to isolate and fix that issue, right? So.20:38The value in Splunk is not what information I can see different than I see on this on the next e.g., but it's what information I can see in parallel at the same time from my different layers and my different systems across the data center, across my network or across my IT, my IT infrastructure. That's the key value in Splunk.20:44There is a second part in Splunk as well, which are the alerts, right?21:04So, I will show you very quickly on the demo that for everything you can see on Splunk, you can generate alerts based on triggers. So whether that is launching a script or sending an email or whatever, so you might react on specific.21:08Triggers, values, log messages, thresholds, and Splunk will be able to do that. And you can even do that based on different, so you can do a cross domain search and whenever three different log messages from three different layers.21:26Occur in the same time, then you can trigger a specific reaction. And that's one, that's 2nd key value in Splunk. So again, I was just trying to share why we think it is it is valuable to have Splunk on top of your Nexus dashboard or your ACI fabric monitoring.21:44Again the key thing here is the correlation and the data ingestion and and insights. Now, I, I will I will cover that in the demo as well, but just to, to let you know how that works, so once you install the app, what the 1st thing you will have to configure is the accounts, right? So you need to tell Splunk.22:05How it can reach the devices you want to start monitoring and gathering data from. So in terms of DCN, we are on your, we are using API and for Nexus devices we are also using some CLI commands via via SSH. That's how it works. So we need to introduce basically the IP address or host name.22:24And credentials to access those devices, whether it is Nexus dashboard ACI or nexus.22:44Individual Nexus switches, if you are already using Nexus dashboard, maybe connecting nexus dashboard to Splunk is enough, NO need to connect ACI, NO need to connect the individual switches. Now, if you don't have nexus dashboard, you might still want to connect ACI.22:51And or individual switches to start gathering the information. And there is a second part of the app once you do the configuration, which is the what we call the inputs, and I will show you quickly as, as well. So the inputs is, specific.23:09Data that with the Splunk is going to gather from yours systems. So in this case, if we take Nexus dashboard, you see here the screenshot there is specific input for advisories, another one for anomalies. For ACI there is one for faults. There is another one for.23:24Contracts and then and traffic, there is another one for endpoints and so on. So there is a specific input for each type of data we are going Splunk is going to gather from your systems and you have to enable them. So you see here there is NO button to activate them because when you initially start install the application.23:44You have to bind those inputs to an account. So here you see account names because you need to bind them to a specific next dashboard instance or a specific SA fabric and so on. And then it will start ingesting the data. Now for the inter site add on, for the compute side of the house.24:02We are gathering the information that you see here, so inventory of the devices, alarms advisories, events, so pretty similar to what we get on next to dashboard but on the compute side of the house. We are also gathering details on the server profiles utilization, CPU metrics, and network traffic utilization. That's what we get today.24:20And about configuration, it's pretty much the same. You need an account. Now the different thing in inter site since it's mostly cloud based, even though you can also connect the private appliances. The way to authenticate Splunk against the inter site is used by using a.24:38No auth token, so there is NO username and password, we are using a token that can be generated from the info site portal and you can put an expiration time or you can put it as never expired like it's shown here. So this the token that will be used by Splunk to be to authenticate the queries that we launch against.24:58So as you can see, whether we are using it and by the way in Splunk we are in interest we are also attacking the, the API. So it's a polling model where we are requesting data. Now for Nexus dashboard, we have in roadmap.25:19A push model, so we are planning to leverage the HTTP event collector from Splunk and instead of having Splunk attacking the API on Nexus dashboard and asking for specific information, it's gonna be Nexus dashboard who is going to push that information using HTTP.25:35Towards the world's Splunk. So, but, but as of today it's working with API and it's working properly. So that's how you configure the inter site account on the, on the inter site side of the house.25:55Now, let's switch to the, to the demo and I see most of you don't have Splunk today based on our, on our, on our board. So maybe it's for you it's a good day today to discover and start discussing within your IT department if you.26:12It makes sense to start testing Splunk. So let me end the presentation mode and I'm gonna switch to my Splunk server here.26:32This is a virtual machine we are running in the lab. Now, 1st thing I'm gonna show you, so this is the initial dashboard I have here. So here I have some custom dashboards I've built on my own. I will show you a couple of them later on. Now you will see here on the left side of the screen I have.26:42Several applications installed, some of them are there by default, but the two I'm gonna cover today is Cisco DCN networking app and inter site add on for Splunk. So if we start with DC networking.27:02This is the 1st thing I can see. There is a normalized dashboard already coming up, so this being fed by myself dashboard which is already also sitting in the lab. Now, as I said, the 1st thing I do when I install the application is.27:16Configuring the accounts so IP address and credentials, so that Splunk starts gathering the information, same for ACI, here I have two ACI fabrics and same for Nexus switches and here I have two Nexus switches. Once I do that, I can start enabling inputs.27:31So the inputs are, as I said, predefined processes to ingest data from my server for my systems, I can filter by platform types, so if I check what I'm ingesting from nexus dashboard, I have enabled advisories anomalies congestion endpoints and second fabric endpoints, right?27:47So here I'm as I let me show you how this looks like. I am associating that associating that to my account that they already configured on the configuration part. This is how often it's going to pull the cluster. This is the index internally in Span where it's gonna be the information is going.28:06Gonna be stored. And I could even filter by category or by severity if I want, but by default I am gonna ingest everything and I will later on filter based on searches or dashboards and so on. Same thing for every other. There might be some differences of e.g. in the congestion, I think you can e.g..28:26Be very specific, yeah, you can very specific and name the different notes you want to gather the congestion data from or even the interfaces names. That's just an example. So there are depending on the input, you may have some additional filters that you can use initially on the input configuration. And of course if there is some information that is not here, you can always create your own.28:46Custom input where you are going to specify what API queries you wanna launch against the system or what SSH command and so on. So you are, there is flexibility in terms of adding new inputs and creating your new data specific data ingestion. So all that, all that data is already being.29:07Ingested and into the database in the index in Splunk and the way we see that we can visualize that is either by doing searches, but it's very specific normally when you want to search some specific data or log messages or whatever or you can build dashboards. So.29:26What I'm going to show you is what the predefined or pre packed dashboards that come with the app. Now, you may need or you may think that dashboards do not cover the exact use case you wanna start getting data or visibility from next, from Splunk. You can also build your own.29:43Dashboards and I will show you a couple of examples later on. So if we start with anomalies.30:03I'm I'm gonna cover just a few of them for the sake of the time. But e.g. here I can see of course you can always tune what time range I wanna I want to cover. I can select my next dashboard cluster, it's only one in my case, and I have several ASA fabrics. Now, let's say I wanna focus on my fabric one.30:08And this is what the number, the anomaly score over the last 24 h. This is the type of severity that I'm having in the anomalies and this is the category. If you know nexus dashboard anomalies, that might be familiar to you. Now let's say I'm I've been reported issues on connectivity side of the, of an application, so I'm gonna.30:26Focus on connectivity anomalies that are critical.30:46On every node that are not clear so they are still active, the problem is still there and I see the following result. So again, this is same information we could get from but imagine that there's an operator that it's agnostic to, specific platforms. He just wants to know what is going on on the DCN part.30:51Are Related to connectivity for the last 24 h, so that's what I'm going to see. I see VPC downs, I see duplicate IPs, and I see packet drops. So imagine I wanna focus on flow events, which is.31:11Basically packet drops. So this is what I see. Different leaves are going close. Now, I could potentially have a different dashboard for the flows. Maybe you have seen when I clicked here there is a flows here, we are not going to show cover that in the lab because it's.31:25And the initial reason of the application is targeting flow telemetries, which is the legacy way we were ingesting or we were visualizing the traffic flows on nexus dashboard. Now the latest way to do that is called traffic analytics and there is NO embedded dashboard yet on the app.31:43For traffic analytics. It will come in later releases and that's why I'm we prefer not to show that because it's based on the legacy way to visualize flows. But if we focus on that, I was, I I said before that one of the interesting things that you may generate alerts based on specific events. So for every dashboard you can see here that.32:03There's always a magnifier glass here which is which says open insearch.32:23So this is a specific query in Splunk that is bringing as response to the table we're seeing before, different format, but it's exactly the same. I see who was the fabric, what's the severity, what's the time of the detection that last seen kind of type of event, not affected and description. So imagine I wanna have.32:27An alert generated every time there is a packet drop due to forwarding or whatever, on whatever note for fabric one. So this what basically the the this search feature is saying, I can do save as and create another. And here you have the trigger action where you have many different parameters.32:45Can tune but the interesting thing is the trigger alerts, so I can generate.33:05Log event and send it to a, to, to an external receiver, I can run a script, I can send an email, I can send to Splunk mobile or I can pull a specific generated post to a specific webhook. So, and you can even create your own your custom actions.33:10So that's one of the powers and the value in Splunk this getting a specific event or mixture of events conditions based on that search. The Splunk search if you've never played with is extremely powerful. It's like browsing in a database and based on different kinds of filters and so on, it has a.33:27Can be very flexible in terms of searches and you can generate an alert based on that specific search that you can come up with. So this is just an example on how to generate an alert based on a specific type of event that I got from Nexus dashboard.33:47Now, what else can I see here? I can also check the endpoints, e.g.. And this is again something you might see on Nexus dashboard, but we are again we are thinking on a a NOC.34:01Or an operator who may not have access to next dashboards, he may not know it. He has to take to deal with storage virtualization, networking firewalls. So he doesn't, he wants a unified and centralized tool to be able to and get visibility across the different vendors platforms.34:17Some domains, and that's the meaning of Splunk. So here I can see all the endpoints that have been registered in the last.34:37I I it's here the filter says all time because the way it works with next dashboard, the endpoint is only reflecting the discovery date. So if the endpoint, the specific IP was discovered three months ago and it didn't go away, the timestamp will be from three months ago. So that's why the filter by default shows all time. So.34:43I can filter by IP. So imagine there was a problem related to that IP address, so I can just filter by IP address, I can see.35:03Where it is there, it's active, it's healthy, it's connected to a specific switch, a specific interface, it's ACI so I can see the BD and the EPG, and you can see the anomaly score is zero. So looks good, nothing to worry about. Maybe I can get some other information like.35:10The EPG belongs to on the ASA fabric so I can filter based on that as well and I can see what I wanna see what what IPs or what endpoints are seeing under that EPG, there is one, but the health is major, you see?35:29And there is anomaly score 63. So I could maybe do more specific searches based on that IP later on or again, create an alert whenever whenever they see duplicate IP, and by the way, I don't know if you saw, but this anomaly score I I just mentioned duplicate IP cause if I go back to my anomalies here, there was a duplicate IP maybe.35:44Mentioned for that AP address. So if I filter again.36:04On connectivity, critical and false and this time and points you will see this duplicate IP, that's why it was shown with an anomaly score higher than zero. So.36:08Again, this is just some examples of what are predefined dashboards here, but you may create your own based on specific pains or tables you wanna get from, from the information we are gathering, so I can show you.36:27As an example of custom dashboards for Nexus dashboard, what it's very it's not very, might not very shiny, but it's just an example.36:47Of what I built is a history on the interfaces rate for each of my leaves so I can see what, what's the throughput look like usage on my different interfaces in the last 24 h from my different switches as you can see here.36:57And one the interesting thing and I will show you a specific example is the data that we are gathering. So this is just a very, so the dashboards as always are always shown a very small portion of the data that Splunk is ingesting. So as an example, I have here a small search already saved beforehand.37:13Just to show you and you can see this is a search I did on specific fabrics specific all nodes starting by eleven physical interfaces internet one/whatever. I'm looking for a specific entry in an array, which is basically the ingress or the.37:33Byte rate. So whenever the rate is different than zero, it's showing up here. So e.g. here this is an example I wanted to show on what the specific information I'm getting for every interface. So e.g., this is internet one/thirty for switch name, let's see the switch is.37:53That one IPN, so this is the Nexus interface, not even coming from, yeah, it's coming from fabric one and sorry that's the the neighboring form, so the the node will be here, node eleven, yeah. True. So the different entries I want to show you so you can see error.38:11If IFD drops, that's.38:31Created to to traffic. Buffer drops. Ingress or egress. I have also interface egress or interface ingress. I have also CRC errors, I have drop egress, drop ingress, so this and and so on and on.38:34And on. So as you see, the dashboards are also only examples of what information you can visualize, but the amount of valuable information that Splunk is gathering and ingesting and and storing is immense it's really it's really big. So this is just an example. You may focus on, ok, I wanna see.38:54Whenever the CRC errors go more than whatever value, show me an alert and I want to see a graph on specific CRC errors, so you may build that dashboard on your own. That's, that's one I want to share as valuable here.39:15So imagine now you don't have Nexus dashboard. So I say ok that's very nice, but I'm only running ACI on our Ork What can that bring to me? So in ACI there are also a series of dashboards available. I will stick to.39:32Faults which is what most of our customers care about. So here I can filter by sites. E.g., I can filter by severity. So there are 30 critical severities right now in the latest 24 h on my fabric one that's one. I can see by domain, by cathy.39:49Go to here so calls, support down, interface VPC, interface down and so on. And.40:09I can focus on the, I don't know, the physical interface down and it will filter here and it will give me all the information. So again, is it different from what you see from ACI? No, it's not. But you have to think of from the point of view of an operations team who might be probably acknown.40:15Stick to the vendor to a specific platform. So NO need to be an expert in ACI and go to the ACI UI when where.40:35The operator might even not have access. Here he can quickly check what is going on on about on the faults side and we could again generate an alert for a specific type of critical faults when it raises based on the code or the naming or whatever, Splunk could generate an alert based on that specific filtering that you may.40:44Use.41:04So I'm not gonna cover the rest of the, of the dashboards here on ACI, but there's different stuff of information you can get info traffic rates, you can get endpoints from the ACI fabric directly as well. So there are different kind of information you may gather and it's already gathering. I didn't show you the inputs from ACI.41:04By the way, but it's basically showing authentication messages which I by the way didn't activate faults. This is traffic related on the and contracts related. There is also, by the way, I don't know if I have something enabled, but there is another one for the ACI, for the.41:25ACL logs of four contract logs. Whenever you have a contract pool.41:45And you enable the log directive, you will see that will be shown here. So here I'm not sure whether we are storing anything. Yeah, we are running those these are the logged information whether drops or permits and we can see a bit more information by tenant or by node, right? As you can see.41:51Here. So this is just again an example on what it is retrieving a small portion of what is being retrieved being shown as a dashboard.42:09Now, if I switch to Nexus switches, so imagine you have individual switches only, there's also a few dashboards that we are delivering by default. One of the interesting things is the resource summary here where you can track.42:19The CPU and memory usage of the device, so might be a interesting KPI to keep monitoring, so here e.g. you see CPU idle, so it means 97 % is idle, so only two point something percent usage as you can see here, and same for memory, how my, how many.42:34Megabytes it is using consuming more memory. Here again you could generate alerts based on specific thresholds, right? And the other thing I can show you is the.42:55On the, on the performance is the interface and overview on the interfaces, you can filter by operational state, whether it's up or down, if I want to see only the app ones, I can filter by internet speed, and here I can see summary on description if it's say up or not.43:03And the input and output rate in the last, in my case last seven days. So again, just examples, but if you want to build your own view on specific traffic rate on specific uplinks that are going through to whatever part of the fabric or your data center, you may build them. The information is being.43:20Ingested and it's there in splunk. It's just a matter of.43:42Tuning your searches and your dashboards that will give you that information in a more visible way. So that was for the DCN part. What I can show you also is also the for the compute part is the inter site.43:45Add on, so here is again very similar approach. So 1st of all, we need an account where basically here I'm targeting the EMEA region for inter site, it could be also appliance on prem that's here it's this is my.44:03Part of my token for it to authenticate. And once I have my account here, I can start configuring inputs which are also pretty packed with the app, with the add on, and here as you can see I'm gathering alarms, audits, metrics, inventory, network metrics and so on. And this is what is feeding the dashboards.44:20That they have here.44:40I will show you, a couple of them. So 1st of all the alarms, so this is pretty similar to the anomalies that you have in Nexus dashboard, right? This is covering what all the events that inter site considered as not NO normal, takes a bit of time because there's a lot of data to be analyzed in the last 30 days.44:41But you see I have a number of active alarms for the last 30 days, a number of clear alarms, I have a bit of table view here, so I have PSUs missing, and here I have based on categories, so e.g. I have here port down, adapt to not reachable target is connected from inter site at some point, so I'm gonna focus.45:01On that one, e.g..45:22And in a bit, if I click here, it should filter, yeah, it should filter the table below. So luckily this was clear but they can see that the target DCC 05:30 to 60 was disconnected on the and what that's when it was cleared on the 10th April so it was probably disconnected a bit before.45:23Just an example on what information you can get from the alarms. Another.45:43Interesting dashboard is the CPU utilization, right? So here at the beginning you have the number of servers per fabric and per chassis and so on. But the more interesting part if you ask me is the CPU consumption where you have an average trend here, the max CPU trend for the different servers I can focus on a specific one.45:48Let's say that one, the three.one.46:08And that should pop the table of CPU consumption here. So that will that would be average and that would be the big usage based on the information we got. And again, here we could set specific threshold and generate alerts or build my own dashboard where I'll see the.46:10CPU usage for my specific service per application environment or whatever. So it's just a matter of modulating and tuning a bit the information and building your own dashboards based on your priorities. And for the network part under inter site we can also.46:30Verify the traffic consumption and volumes per fabric or per domain or per server. So this is just an example on here. Let's see if I have maybe it's more relevant per server. Yeah, so per server you can see transmit and receive utilization.46:50As you can see here based on all megabytes per second. So here are my two most active servers in terms of traffic are those two, which by the way are are the two that was showing with more CPU usage on the other pane of the other dashboard. And by the way, you could build your own dashboard where you can compare I have both.47:09Views, right? The CPU and the networking and see if they correlate somehow. That might be something interesting. And, yeah, that's just another example of what kind of information you could, you could retrieve. Now, I told you before.47:28When I was covering the nexus dashboard part that there's also different stuff like in the inventory, you can see all the status of the devices and so on. But I wanted to mention before closing the the demo, I don't have a life view of that, but I can share a screenshot of an example of custom dashboard we built for.47:44And next is from a specific customer. So if I grab back my presentation, I will show you here. So this is just a screenshot, but it it's thought to provide you an idea of what we can.48:04Visualize and get and get from Splunk if we moderate and filter a bit the data we are gathering from in this case from next to dashboard. So you can see here number of flows per we are gathering, what are we what is being dropped.48:26Per minute and in global, what are the top notes and the top IPs and the top protocols that are being detected and the top flows based on the number of repeated flows with same source IP and destination IP and destination port. So this is just an example on.48:41The kind of information related to traffic flows and patterns that you may visualize from Splunk if you create this again a custom dashboard that was built in lab, just to showcase what we may achieve in terms of traffic visibility from Splunk.49:00So, that was it from my side. We still have barely 10 min, so I, I was a bit faster than expected Hopefully was clear and you were able to follow.49:19Again, this is just an a quick overview of what you can get from the DC side of the house if you interconnect your Splunk instance to to your Cisco DCN or compute solutions in terms of visibility correlation.49:36Data ingestion and so on. The.49:55Main power in Splunk as I said before, is the ability to correct all that information and have all the information available and it's just a matter of knowing and learning how to extract the most relevant relevant information from you and build your dashboard or your alerts and your triggers that.49:58May help you being more effective in the problem.50:18Resolution and problem prevention, right? So I don't know Khalid, if you, if you want there are some questions you may want us to cover live or if everything is good from the questions on the there's NO questions but regarding the survey.50:24Okay for the 1st one what is the main rule in the data center area main rule, ok, we have most of the attendees from the network and compute architect.50:45Okay. That's 2nd questions, are you already using Splunk to mentor your environment? Yeah we have 60 say 3 % NO saying NO and 25 saying yes.50:55The 3rd question here, which is what you what would be your priority data inside from the data center infrastructure to enhance monitoring or see answers, ok, one of them is monitoring events, one of them is monitoring the top talkers in the network, and the 3rd one is.51:12The interface usage. The last questions which is this is what you have seen in the webinar, are you planning to install any of the data center apps in your Splunk platform? 64 %, which is the ok which is the majority of the answer.51:31I will evaluate with my Splunk team later. Okay, good, good. So yeah, so hopefully that sheds some light on the capabilities you may get from Splunk in the visibility part and that will encourage you to, to, to try evaluate and see if it makes sense.51:49It's for your customer, your environment to to start playing with Splunk. So you as usual, if you already joined some of our expert series, you will get a quick survey at the end of this webinar. When you close it, it will pop up.52:09With just three or four questions that will help us enhancing our content on the next series of webinars and you will also have the option to ask for a follow up session with us where we can guide you through more details and maybe.52:26Plan and evaluate and help you testing the apps that we just saw for Splunk. So that was it from, from our side. Thank you all for your attendance today and hopefully see you soon in again in another webinar.52:43