Technical Tuesday – 22 January 2013 – Finding Splunk Before Splunk Finds You by Rob Frazier of Whiteboard Federal Technologies

Splunk is a software product that has been around for almost a decade. Most people think of Splunk as a log aggregator with some security monitoring functions thrown in. The truth is, Splunk is all that and a whole lot more. Right out of the box Splunk is a product that can provide useful information that justifies its deployment. It is easy to use and set up, and can collect machine data right away.

The real value of Splunk comes when you take machine data of every stripe, from computer log files, web servers, IDS and IPS, applications, sensors, databases, and so on, and run correlations and comparisons on that machine data. Splunk can grab any kind of log file, or even text files, XML or source code, etc., create a “log” file that is indexed, and then can search all those files, singly or across multiple files using Splunk’s Search Processing Language. The end result is not just log data, but operational intelligence.

Operational Intelligence can improve security by telling you which user had log in failures as an administrator, and then if that user had log in failures on other machines, applications, file access, etc., across the enterprise. Splunk can find abnormal activities, actions that occur outside what is expected, outside time periods, or correlate it with other log data from IDS, firewalls, ldap, etc. Splunk is a virtual Swiss army knife tool that has multiple uses, use cases, and abilities to view your machine data.

Operational Intelligence is more than security. It can improve performance of web applications and system operation, and it can identify bottlenecks, application defects, and choke points. Insights from Splunk can improve mission effectiveness and performance. Using NOSQL data capture, indexing and parallel search capabilities, Splunk is the Big Data analysis tool that sifts through mountains of your enterprise machine data to uncover the operational gems that make a difference. Splunk provides insight to your mission whether across the enterprise, a single machine, or an application running across several tiers of operations. Once Splunk finds the operational intelligence you are looking for, it can create alerts, email reports, and build visualizations, charts, and dashboards.

This session on Splunk will cover these topics and more, exposing the attendee to the wide horizons of use cases and scenarios where Splunk can add value. Topics include examples for security, performance, operations, and analysis of everything from a single machine to the largest Big Data analysis.

Presented by: Rob Frazier of Whiteboard Federal Technologies

Curiosity, either you have it or you don’t.  Rob Frazier grew up in a small town in Texas where the summers were long, hot, and boring. The antidote to boredom is curiosity. But for curiosity, there is no cure. Once infected with the passion to explore, discover, understand, and invent, there is no turning back, only a life of figuring things out.

Rob Frazier’s career has been driven by that curiosity, and a job history as varied as his interests. Rob worked his way through Texas A&M as a computer operator, was commissioned and served as an Army Intelligence Officer. After the Army, he worked as a computer security engineer for a stealth aircraft program, and then took a diplomatic commission and served as a decorated diplomat for three presidents. After leaving the government, he became a VP and CIO of McMurry University, then security practice leader of a dot.com, followed by nearly a decade of security consulting with IBM, including time as CISO of IBM Security Systems and in the IBM Federal CTO office. Rob joined the startup of Fusion-IO, helping guide it through growth to IPO, and now is at Whiteboard Federal Technologies.

Rob serves on curricula development boards for Computer Science at Abilene Christian University and the College of Liberal Arts at Texas A&M. He also served several years on the board of the Continental Automated Buildings Association. Rob speaks five languages, is an amateur magician and cyclist, an avid winemaker, home brewer, and coffee roaster. He was quoted with his online hacker handle on the back of the official DEFCON 12 T-shirt and is related to Will Rogers and a member of the Cherokee Nation of Oklahoma.