Prague SUG #3 - Splunk & AI with Philipp Drieger

Prague SUG #3 - Splunk & AI with Philipp Drieger

Introduction

Good afternoon, everyone. It's Thomas Moser here. Welcome to the third session of the Prague Splunk User Group (SUG) for the year. We're delighted to have both physical attendees in Prague as well as a broader online audience for this session. For the first time, we're streaming this event, so please be patient with us and provide feedback to help us improve. Our key topic today is AI, and we're especially thrilled to welcome Philipp Drieger, Splunk’s Global Principal Machine Learning Architect.

Introduction to Philipp Drieger

Philipp Drieger has been a Splunker for nine years and advises top clients worldwide. He is known for presenting complex topics simply and effectively. Philipp helps shape how we discuss AI with customers and designs workshops and demos. As a Principal, Philipp is key in building machine learning and AI solutions, leveraging Splunk’s capabilities to solve real-world problems.

Philipp Drieger’s Session

A Look Back and Moving Forward

Philipp started the session by reflecting on the evolution of AI and machine learning over the past 10 years and exploring possibilities for the next 10 years. Emphasizing the necessity of AI for digital resilience, he summarized various initiatives undertaken by Splunk related to AI, machine learning, deep learning, and generative AI.

Splunk AI Landscape

• Generative AI: Solutions that guide users through SPL generation and explanations.
• Assistive Workflows: Making it easier for non-data scientists to leverage AI.
• Embedded Capabilities: In-product functionalities that utilize machine learning.
• Custom Machine Learning: Tools like the Machine Learning Toolkit (MLTK) and the Splunk App for Data Science and Deep Learning (DSDL).

Philipp also emphasized several product philosophies and principles, including being domain-specific, keeping humans in the loop, and ensuring extensibility and flexibility with third-party frameworks.

Exploring Current Splunk AI Features

Philipp broke down major themes Splunk is currently focusing on:

• AI for SPL: Assisting users in writing and explaining complex SPL.
• Security and Observability Assistants: Enhancing detection and investigation capabilities within Enterprise Security (ES) and ITSI.
• Predictive Analytics: Empowering features in ITSI and observability tools to accelerate root cause analysis and event correlation.

He demonstrated some of these tools and initiatives using real-world use cases and scenarios.

Detailed Demos

Splunk AI Assistant

Philipp showed how the AI Assistant can assist in generating and explaining SPL queries based on natural language inputs. Users can ask questions and receive detailed, explanatory responses from the AI, helping them understand complex SPL without extensive training.

Machine Learning Toolkit (MLTK)

Next, Philipp demonstrated Splunk’s Machine Learning Toolkit, guiding the audience through various use cases such as anomaly detection and predictive modeling. He emphasized how the toolkit integrates deeply with Splunk’s SPL, allowing operationalization of machine learning models easily.

Splunk App for Data Science and Deep Learning (DSDL)

Philipp showcased the DSDL app which enables container-based computation, extending the capabilities of Splunk to accommodate machine learning workloads. This app allows users to create, train, and deploy complex models using powerful tools like Jupyter Notebooks within a managed environment.

Conclusion and Future Trends

Philipp concluded by touching on future trends and adventures in AI, particularly focusing on the integration and synergy between Splunk and Cisco. Splunk aims to power and protect the AI revolution by leveraging both infrastructures for AI and AI to enhance security and operation.

Contact and Networking

Thomas wrapped up the session with a reminder to provide feedback via a post-event survey and encouraged further discussions and networking at a nearby venue. The entire session's recordings and slide presentations will be made available for those who missed parts or want to rewatch the presentations.

Keywords

• Splunk
• AI
• Machine Learning
• Deep Learning
• Philipp Drieger
• MLTK
• DSDL
• Generative AI
• Predictive Analytics
• ITSI
• Enterprise Security

FAQ

Q1: Who is Philipp Drieger and what is his role at Splunk?

A1: Philipp Drieger is the Global Principal Machine Learning Architect at Splunk. He has been with the company for nine years, helping shape AI strategies and consult on top client projects.

Q2: What major trends is Splunk focusing on in AI right now?

A2: Splunk focuses on generative AI, assistive workflows, embedded capabilities, and custom machine learning applications. They are integrating AI into their core products to enhance detection, investigation, and operational efficiency.

Q3: Can I use the AI Assistant and Machine Learning Toolkit with Splunk Enterprise?

A3: Currently, the AI Assistant is generally available for Splunk Cloud users, while the Machine Learning Toolkit can be used with both Splunk Enterprise and Splunk Cloud.

Q4: How can I learn more about using AI with Splunk?

A4: You can visit the Splunk documentation, attend Splunk education courses, or explore public resources such as ebooks and blog posts on Splunk’s website.

Q5: Is Splunk AI only focused on specific domains like security and observability?

A5: While security and observability are major focus areas, Splunk AI also looks into broader industrial applications as the technology and its applicability evolve.

This shift towards AI-centric initiatives, especially within specific domains like security, observability, and custom machine learning tasks, positions Splunk as a powerful toolset for advanced analytics and operational intelligence.