Straight From The Source: Splunk Partner Technical Symposium Review

Splunk Tech Conference

Format: Exceptional Content and Transparent Knowledge Sharing

Recently I had the benefit of attending the Splunk Americas Partner Technical Symposium in San Diego, California, with one of my co-workers Brian Glenn. This was the second annual event, as well as the second Splunk Americas Partner Technical Symposium, that I’ve attended, and it was my favorite of the two events. Atlanta, Georgia, in 2016 was also spectacular, but version 2.0 of the symposium in San Diego was all around more polished and formatted.

A couple of my favorite aspects of this conference were the clear, consistent communication, as well as the transparency throughout. This year was fraught with exceptional content that came straight from the source. The presenters themselves were also poised and ready to answer any of the questions being tossed their way. Plus, when I happened to throw someone a curveball, I was pointed in the direction of someone who was able to get me an answer almost immediately - which sometimes even meant talking to the developer of the very product I was inquiring about.

Communication: No more telephone game inefficiency

In several of the technical communities I’ve been a part of, knowledge is sometimes spread via the telephone game. I hear something, I tell that to someone else, they tell their version, and so on and so forth. Sooner or later the information becomes so corrupt and malformed that it loses the original meaning, is confusing, or worse - it’s incorrect. Fortunately events, like the symposium, help to eliminate this type of inefficiency. These are places where you can obtain answers to any of the technical questions that you, as a partner, may have.

The reason I bring this up is because every Splunker in attendance had a giant “Ask Me” pin attached to their lanyard and they really did answer any and all questions. If you end up going to one at some point, I’d highly recommend coming prepared with all of the questions you’ve been dying to get answered (you better get more of those pins, Splunk). All joking aside, this is a great way to level set your knowledge on topics you might be confused about, or even to just find out some great new partner specific information you’ve never seen before.

Relevance: Great way to gain brand spanking new Splunk info

What do I mean by great new information? Well, for starters, the updates to the Machine Learning Toolkit, released a couple of weeks ago, were some of the coolest and most practical things I saw demoed. As I’m finishing up a semester of teaching Business Data Analytics II at The University of Connecticut, I’m particularly excited to see these changes. Just about every single one of the concepts, that are no embedded inside this app, are those that I’d like my students (who are going into Data Science fields) to understand at the end of each semester. I’m even hoping to be able to find some use cases for this at clients in the future. This app comes complete with Splunk visualizations and the entire SciPy library via the required Python for Scientific Computing Add-on. You can find more information about the Machine Learning Toolkit on Splunkbase, or on this handy YouTube channel.

Another awesome presentation I got to see was from Brian Wooden and David Maislin, who were teaching us about about many different ways to improve Splunk searches and dashboards. One of the least known, but majorly beneficial features that was specifically discussed in David’s presentation was base searches for Dashboards. In addition to this, Brian Wooden had all kinds of great tips for improving searches that I can hopefully summarize and share out in some future blog.

I should also note that the release of Splunk 6.6 coincided with this conference. Splunk 6.6 includes many Search optimizer improvements. One of those improvements includes automatically removing calculations and evals that are not needed in final results.

Last but not least, I can’t stress enough how important the two-hour architecture session was, with Jenny Hollfelder, Chris Burnham, and Deep Bains. They talked in-depth about sizing and scaling a Splunk Deployment, including how important the Splunk Reference Hardware is in that process: http://docs.splunk.com/Documentation/Splunk/latest/Capacity/Referencehardware.

All in all: Looking forward to round three in 2018!

As I’m writing this blog, I’m hopeful that I’m not also guilty of a telephone game scenario. If I’m misstating something, or you’d like to correct this in any way (looking at you Splunkers that I’ve been fortunate enough to connect with again or for the first time recently), please feel free to let me know. To summarize, however, I wanted to thank everyone involved in putting together the Symposium. It was a terrific event filled with great networking, lots of laughs, and tons of new knowledge that I can’t wait to take to my future engagements. I’d encourage all other partners not to miss the third annual event in 2018.