How ASU integrated Splunk as a university data security tool | #splunkconf16 by Gabriel Pesek | Oct 2, 2016 While corporations and marketing specialists are finding virtually limitless opportunities in the developing potential of data analysis, the more scholarly side of tech is having just as much fun uncovering ways to apply and recombine the data already at their disposal. Chris Kurtz, Splunk evangelist at Arizona State University (ASU), sat down with John Walls (@JohnWalls21) and John Furrier (@furrier), cohosts of theCUBE, from the SiliconANGLE Media team, during Splunk.conf 2016 to talk about how Splunk is being utilized at his university and where he sees the strengths of the product and its community. First encounters Kurtz outlined how ASU had initially been drawn to Splunk and how it found room for further growth. “Splunk was brought into Arizona State for the security group to pull the information from our operations group, real-time or as real-time as they possibly could,” he said. “I came in at that level, at the very beginning, and have shepherded Splunk into a full-blown enterprise product. We started as a 50-gigabyte customer a little over four years ago; we’re at a terabyte now.” He also shared plans for expanded availability and access to the singular Splunk instance the school is running. “Our goal is to make Splunk into an enterprise tool that the entire university can use, not just security, not just operations; everybody is going to be able, at the university, to use it,” Kurtz said. “And hopefully, eventually even researchers … will be able to use Splunk.” Brainstorms and ease Asked for more detail on Splunk’s appeal, Kurtz dug deeper into the specifics of the original encounter. “We started with an actual need: We had data that was in operations, and that data needed to get to the security group in a timely fashion,” he shared. “And so we started there, and as the security group used it more and more, we turned that on its ear, turned back to the operations group and said, ‘Look at how good this is working; look at how much simpler this is making your job. Let’s bring in more data; let’s bring in new sources of data.’” RELATED: Data 3.0: Empowering enterprise by bringing data to the center | #BigDataNYC He also touched on how easy it was to come up with new uses for the data, often spur-of-the-moment in nature. “The best way to get use-cases is hallway use-cases; you’re standing around with your coworkers in the hallway, or getting a drink of water, and you say, ‘I wonder if we could take this bit of data, and if we could combine it with this bit of data, and we could do something new with it,’” he said. “And almost every single use-case that we’ve come up with has been this ‘I wonder if we could take these two pieces of data and combine them.’” Comfort of use And beyond those collegiate networkings, Kurtz said, Splunk is making interactions easier for the review side of things as well. “One of the things that I love about Splunk is that as an audit tool it’s very comfortable,” he explained. “So that I can turn around and I have this compliance, or I have other compliance, and I can say, ‘Yeah, we’re using Splunk, we’re compliant, we can keep the data separate, we can keep it for as long as we need to.’” Looking at the Splunk.conf event and the roles conference attendees play in the field at large, Kurtz was highly enthusiastic. “This community is amazing. I’ve been in higher [education] for 14 years. I’ve been in the IT field for 25 years. I’ve never seen a community around a product like this. [It’s] absolutely wonderful,” he said.