Skip to main content
Lantern Home
 
Splunk Lantern

Event analytics

  1. Last updated
  2. Save as PDF

 

Event analytics is a computing process that addresses the triage and resolution of IT events and incidents. An event can describe any change in state or condition of a component on your network. Over the course of regular operation, all technology devices create events in the form of log entries and regular status updates, which are recorded as event data in various databases and other files. Event analytics aims to improve the management and understanding of these events.

Historically, these events - and subsequent event actions - had to be managed individually by human analysts, either as the events emerged or by manually searching through log files to look for anomalies and outliers. Event management systems eventually evolved, giving IT managers a way to sift through the various event alerts and streamline operations. However, as networks continued to grow, the number and complexity of alerts in many large-scale enterprises quickly became unwieldy. As such, it’s common to find multiple tools that manage various events - from the success of GTM and marketing campaigns to network latency - in different segments of the organization.

Event analytics consolidates multiple systems into a centralized platform, which simplifies discovery of the root cause of any given problem. As cloud and universal analytics have, machine learning algorithms have also automated much of this process. Now less human interaction is required to successfully resolve an event, so organizations across all industries can have a significant competitive edge.

Before you begin implementing the use cases listed below, review Splunk Docs for the Content Pack for ITSI Monitoring and Alerting. The content pack provides a set of preconfigured correlation searches and notable event aggregation policies, and provides a faster method for onboarding external alerts into Splunk ITSI with universal alerting. 

You can also check the overview of event analytics in ITSI for more information on the components used within the event analytics workflow.

How can Splunk ITSI help with event analytics? 

Splunk ITSI lets you intelligently group alerts using machine learning and other defining methods to provide business context, reduce noise, and provide the means to prioritize, troubleshoot, and find root cause quickly. There are several out out-of-the-box grouping approaches, but these can also be completely customized for your needs.

  • The simplest method combines single alerts into relevant alarms. This deduplicates flapping alerts into a single alarm. You don't need 84 tickets or emails telling you that a system is down and up and down and up. Splunk ITSI can group those 84 alerts into five alarms to reduce notifications, but still allow your team to drill into these episodes to see all of the alert details. You can also group by host or device, showing all the alarms affecting that source.
  • Another method is to group by business service. You can see all the alarms associated with a business service correlated from different monitoring tools across devices, applications, containers, and anything else in your on-premises and cloud-based infrastructures.

When you have a manageable number of alarms to react to, you can switch to root cause analysis to see which alerts started an episode. You can also define relevant instructions and runbook actions within the alarm, implement predefined or custom actions such as opening an incident ticket in your ticketing system, or use machine learning to find earlier episodes which might be similar to this one, based on the associated alarms. Reviewing similar episodes shows you associated tickets to see what was done to resolve the issue, or see how Splunk ITSI defined these as similar episodes based on similarity in fields or other correlations.

Watch the following video to learn more.

Event analytics use cases for Splunk ITSI

Splunk recommends following the Prescriptive Adoption Motion: Event Analytics. This guide walks you step-by-step through implementing a best-practice event analytics workflow.

In addition, integrating with Splunk ITSI can help you achieve even more event analytics outcomes.