Travelport | Keep It Up(Time) - How To Prevent Unplanned Downtime With Splunk

[LesediK]

Watch on-demand 

Prevent unplanned downtime with Splunk | Featuring Travelport

Distributed ecosystems, tool sprawl, and high customer expectations. 

Those are only a few of the many challenges that make it increasingly more difficult for ITOps, engineers, and developers to fully track what happens in their environments. In this context, it can take too long to detect incidents, diagnose them, and resolve them before they impact customers.

Find out how Travelport , a Splunk customer, leverages Splunk to address infrastructure and application issues with a unified and integrated observability approach.

Learn about real-world troubleshooting and monitoring use cases and see how the combination of Splunk Cloud and Splunk Observability helps Travelport extract meaningful insights and take action promptly. 

What you’ll learn:

• Perform real-time troubleshooting with logs and traces in a codeless environment
• Improve incident response journey with glass tables view of your IT environment
• Collect key insights in dashboards for better business performance analysis

Who will benefit:
Splunk Administrators, Frontend Engineers, Site Reliability Engineers, DevOps Engineers, Directors of Web and eCommerce , Director of UI / UX, Mobile App Developers, Platform Engineers. IT Operations Engineers, Systems Administrators and many more.

About Travelport

• Travelport is a global technology company that powers bookings for hundreds of thousands of travel suppliers worldwide.
• Buyers and sellers of travel are connected by the company’s next generation marketplace, Travelport+, which simplifies how brands connect, upgrades how travel is sold, and enables modern digital retailing.
• Headquartered in the United Kingdom and operating in more than 165 countries around the world, Travelport is focused on driving innovation that simplifies the complex travel ecosystem.

[LesediK]

Key Resources

.conf paper :

• conf23 OBS1476B and PLA1511A

Free Trial

• 14-day free trial for Splunk Observability Cloud

Training Course :

• Introduction to Splunk Observability Cloud
• Introduction to Log Observer Connect
• Introduction to APM
• Introduction to Infrastructure Monitoring
• Introduction to RUM

Documentation

• Platform and Observability
• Log Observer Connect 

[LesediK]

Your Questions Answered

Here are a few questions submitted by Tech Talk attendees:

Q. If I’m already a Splunk Platform and Observability user, do I get access to these capabilities?  Yes, you do!

Q. How can I get started today with Splunk Observability Cloud ?

• Reach out to your account manager
• Get a 14-day free trial on www.splunk.com

Q. Can I use Splunk Observability if my environment is on-prem?

Splunk Observability

Cloud is provided as SaaS, and ITSI can be used on-prem since it’s part of the Splunk EC.

Q. Do I need Infrastructure Monitoring, APM or RUM to get started with logs in Observability?

In addition to logs data, Observability Cloud also includes infrastructure and application performance monitoring. You need IM or APM or the Observability Cloud Suite.

Q. Where can I learn more about Splunk Observability Cloud?

You can visit our website or reach out to your account manager! We’ll also soon launch a way for you to learn more about Observability directly on Splunk Cloud via an app.

Q. What kind of AI capabilities does Splunk Observability offer?  

With Splunk IT Service Intelligence, you could get access to a few AI/ML features, including “Predictive analytics”, which helps you predict future incidents up to 30 minutes in advance using machine learning and historical service health scores.

Q. Did Travelport started with ITSI or do you adopted ITSI after Splunk CORE? 

Travelport started with Splunk Cloud and ITSI in Splunk Cloud

Q. How did you create your dependency mapping between services and how did you keep it current? 

Travelport started with diagrams and internal sessions with application and infrastructure teams. As the service models were created they were stored in Github with artifacts that could be updated and versioned. The deployment of those services was a manual ITSI effort once the data was in the indexes.

Q. Does Travelport got Cloud Victoria experience default or it were transition from Classic ? how Splunk handles this movement? 

Travelport was transitioned in late 2022 from Classic to Victoria.

Q. Hows licensing work when it comes to Splunk Cloud B2B on-prem ITSI implement ?

Splunk ITSI is licensed by daily indexing volume, just like Splunk Enterprise. “Daily Indexing Volume” the daily aggregate volume of uncompressed data for indexing. See Licensed capacity and limitations on the Splunk web site, as well as How Splunk licensing works in the Splunk Enterprise Admin Manual. 

• Splunk Enterprise Admin Manual

Q. What made it to take a decision of going with a Premium app ITSI, it would be great to know some experience on the use cases?

Travelport has a very large hybrid enterprise that consists of applications and infrastructure in Data Centers they own as well as applications and resources built in Cloud service providrs such as AWS and Azure. ITSI helped them get started in bringing together all the relevent metrics and KPI's for those Technical and Business services into the dependency models available in ITSI to see where problems start and how they propagate and impact other services or infrastructure that depends on the failing component... "better insight to what started the escalating issue"

Q.  What is better to opt hybird searches with classic or federated with victoria?

Hybrid Searching is going end-of-life so Federated Search across Splunk to Splunk environments and out to AWS S3 storage is the future supported mechanism.

Q. How does Travelport manage its Splunk Cloud across US and GB instances in AWS? 

Travelport is currently leveraging one Splunk Cloud deployment in a US Region. There are no requirements at the moment for International instances/regions for their use case.

Q. How come we can't install ITSI (Work Essentials) with other Splunk Security products?

Splunk would need more context on this item. You may need to open a Splunk Support case for your particular environment to get more detailed assistance.

Q. Are you using REST API yet via Token Auth in Splunk Cloud?

For the HEC use case, yes using the standard Token capability.

Q. We like to hear few of the great success achieved through ITSI ?

Having the flexibility of using a KPI approach to refine and aggregated alerts and health visibility.

Q. Did you need assistance for the GDI to get a good observavility posture? or were you able to plan it within your team?

It depends on implementation timeline but Travelport did request assistance and used that to grow.