Splunk: On culture, developer platforms, and commoditization

For those not in the know, Splunk is a company that’s been around for almost 10 years now, building log-analysis software. They’re now going after a larger market by targeting machine-generated data beyond logs — aiming to be a platform for more generic real-time, interactive analytics. With last week’s release of Splunk 5, I figured it might be a timely occasion to write up my experience at Splunk’s annual conference, suitably called “.conf” given the purpose of the software, as part of this fall’s insane travel schedule.

My overall impression of Splunk today is that it’s a maturing company (now 600 people, and post-IPO) that hasn’t gotten overly serious about itself. It’s got a sense of humor and that’s reflected in CTO and co-founder Erik Swan, who was up on stage cracking jokes about his penchant for flip-flops. In fact Erik Swan and a fellow co-founder, Rob Das, spoke about the importance of the company’s culture even as its size spiked (start at 08:50 in that video). On the other side of the picture from Erik are people like CEO Godfrey Sullivan and new SVP of Products Guido Schroeder (out of SAP), representing the serious side of the company.

Innovation comes from customers

Another thing I found very powerful about Splunk was its customer focus, which was exemplified at all levels of the company. Above is a picture I snapped while I was just hanging around in the hallway. It shows one example of the CEO doing everything he could to spend time with users and customers, rather than isolating himself into a bubble as often seems to happen. I also saw this focus in Splunk’s product direction, which is explicitly customer-driven — most of its changes are evolutionary, not revolutionary. Let’s take a few examples:

• the addition of a SaaS-based offering in Splunk Storm,
• the gradual transformation from handling log data to any machine data,
• the increase in report speed to real-time, interactive levels, or
• its growing interoperability with Big Data offerings such as Hadoop, and using OData to get at Splunk data from Excel, Tableau, etc.

None of these are massive changes from what Splunk had been doing, but they combine to create the (real) impression of a company that’s keeping up with many of the important industry trends, realizing that people are looking for ease of use and interoperability with the rest of their technologies. More generally, this customer-driven focus is an instantiation of Splunk’s history as software that was adopted bottom-up by ops people, not top-down by the CIO.

I think this focus on customer-led innovation naturally resulted in the next step (again, evolution not revolution) of enabling deeper levels of the same. That is, making Splunk into an extensible platform rather than a piece of software that’s contorted into all sorts of less-than-perfect fits.

Going after developers and creating a platform

We’ve covered the good; now for the challenges. Splunk wants to turn itself into a platform rather than a product (but really, doesn’t everybody?), which is going to be particularly tricky for a company that’s historically catered to sysadmins rather than developers. It not only has to figure out how to reach out to developers but also how to make a legitimate platform play.

It was a pleasure to see that the folks running the efforts were aware, at the highest level, of some of the critical aspects in getting developer traction — primary among them the barrier to entry (my writeup) and the community (Steve’s writeup), both of which were specifically highlighted during the keynote in the form of documentation, support, community, and ease of use. I had an outstanding chat with these folks at .conf and seem to recall that Brad Lovering (a former technical fellow at Microsoft) and I actually got kicked out of the room after running so long over our time slot. So what are the difficulties going to be? The tactics:

• how do you attack the barrier to entry from a product strategy and marketing point of view,
• how do you get developers to care about and start running Splunk,
• what are they looking for, and
• how do you find the intersection between that and what you can offer?

It seems like they’re generally going after a “more is better” approach now, with SDKs for Python, Java, JavaScript, PHP already and adding new ones for Ruby and C#, along with a REST API that those, as well as any unsupported languages, can hit. Given constrained resources, though, it could make more sense to go after a deep approach targeted on just a few of the likeliest candidate languages rather than something skin-deep that “works” everywhere.

Entering a broader market, and commoditization from below

Splunk as analytics software

As Splunk tries to compete in a new market for analysis of machine data, it gains a new set of competitors with varying levels of capability as well as a much deeper knowledge of the market. SVP of Product Guido Schroeder is well aware of this, as the ongoing themes for the next generation of Splunk that he mentioned in the keynote had clear tie-ins to the broader analytical market:

• Big Data
• Mobile
• Collaboration
• Visual Analysis
• Predictive

If you’re reading that list, you’ll see a heavy overlap with the existing and future feature sets of analytical software, be it from big guns like SAP, IBM, and SAS, or newer/smaller entrants such as Datameer, Karmasphere, Alpine Data Labs and Platfora.

Look out below!

A perpetual concern for every company should be disruption from the low end of the market, particularly as price seems to be a significant factor in the growing success of alternatives to Splunk. Whether it’s a SaaS startup like Sumo Logic or an open-source alternative like Kibana+Logstash (an increasingly popular combination in the DevOps community), you can’t rest on your laurels and assume you’ve won because there will always be new competitors at the bottom waiting to move up.

If I were Splunk, I would be far more concerned about competition and commoditization via open-source software than any of the other companies I’ve mentioned here. Why? Because particularly in the DevOps community, there’s an increasing focus on usability — as you can see if you simply click through to the above links. This is an area where open source has historically faltered, and if it manages to sort that out, it’s going to cancel out one of the major advantages of corporate software.

Disclosure: IBM and SAP are clients. Splunk is not a client but covered registration, travel, and meals for the conference. SAS, Datameer, Karmasphere, Alpine Data Labs, Platfora, and Sumo Logic are not clients.