Meet the Doers: Charlie Huggard’s Splunk Journey Includes a Passion for Building Community

In the next installment of our 'Meet the Doers' series, we highlight Charlie Huggard.

Charlie Huggard discovered Splunk working as a senior software engineer at Cerner Corporation, an American supplier of health information technology solutions, services, devices, and hardware, contracted in more than 27,500 facilities in over 35 countries. The company needed a platform to help monitor and run Hadoop and other systems required for processing patient data — and Splunk was just what the doctor ordered. But Huggard’s career took a new turn when he began contributing to Splunk Answers to help solve other people’s challenges, and learning all about the platform in the process. “If I could solve their problems, I could learn it as well, and better deliver it to my users and my company,” he says. As he took the role of senior technology architect at Cerner, he further developed his passion for building community and helping customers garner new value from their data. Once he transitioned to the role of senior Splunk engineer at Splunk, that same passion for helping others spurred him to make the platform stronger and more efficient for Splunkers as well. 

I sat down with Huggard at .conf19 to discuss his transition from user to employee, and how he has used experience on both sides of the aisle to resolve some of the toughest problems for Splunk customers.

So, being a customer who made the transition to Splunk employee, what was the selling point? Was it the community? The people? The technology?
As a programmer/technologist, the technology just made sense. It was very easy to throw data at it and start getting value very quickly.  It was the community that helped me through the journey. Not only was I throwing data at the platform, I was actually starting to make this scale out and get ideas from the community about how I could get value and really make it work.

As a Doer, what project are you most proud of? 
Splunk logs data volumes by sourcetype and index. Initially, we were able to use this to look at our Splunk license volume and see if we needed to buy more, or if we were using too much. But then, we set up a saved search to trend that data over the previous 30 days each night, and we calculated a standard deviation and average hourly ingest rate for each index. We then set up a Splunk alert that told us when indexes were far outside their own calculated norms. We quickly found bugs in our own systems as well as issues with systems owned by other teams. And we found them not even looking at the data itself, but by looking at the metadata around the data that was coming into Splunk. 

On the community side, I started the Kansas City user group to bring people together and actually discuss those problems or learn about new platforms. But when I became an employee, it was actually very important to me that our user groups are in the hands of our users – that it should not be a sales venue It should be what the users are wanting to hear. Problems they want to solve and topics that are interesting to them.

Now that you’re a senior Splunk engineer, can you give me an example of how you've helped a customer with insight from being a customer yourself?
One of our local sales engineers in the central region asked me to come with him to a customer in Kansas City. This customer had three different teams that all had their own Splunk instances and needed to discuss options and tradeoffs around an architecture migration for consolidation. Because I had experience going through Splunk infrastructure migrations at Cerner, I was able to help them with that. 

For Splunkers, I actually hold open office hours twice a week, through a regular Zoom call that anyone can join to discuss whatever topics are on their mind. Anything from my past experiences, bouncing and/or workshopping ideas around systems, or even stories about Splunk swag and history that I’ve collected on the Splunk Gallery site is fair game. It's one of the ways I combat the distance bias — even though I’m a remote employee, I am present and accessible all the time. 

Finally, I’m now part of the Splunk at Splunk team, which has many highly capable Splunk administrators who bring their own insights and experiences to the table. Being part of Splunk’s Products and Technology organization, we can have direct communication with Splunk product teams around issues that we’ve previously run into as customers — which we can then use to improve the platform for other customers. 

How do you stay motivated to continue learning?
A lot of things are changing so quickly, and I feel a need to keep up. But also, I like making sure we're delivering the proper value — both to customers and to Splunk itself. The most valuable resources are people and people's time. And the more ways that we can use the technology to save people's time and deliver better value and be able to have observability into our environments, the better off we all will be. It’s not only being able to have an overall understanding of data challenges, but being able to engage other people who have a deep understanding of those challenges.

And Splunk gives you a way to do that?
Definitely. The Splunk community is the most welcoming technology oriented community that I have ever known. It’s one of those places where people can come when they're stuck. They're able to get that one nudge and see the next step. It feels good to solve problems and it feels good to help others solve problems.

Last January I made the transition to Splunk. I really love that Splunk walks the talk when it comes to its core values. You can feel them in every Splunker, and it makes me proud to have come over. I'm challenged every day. I feel like not only am I a good Splunk administrator, I also can help deliver better value to the company and to our customers.

Looking ahead, Huggard wants to find more ways to help people. Currently he works with internal security and IT teams who have helped him find ways to achieve better visibility into customers’ sites and web properties. He’s looking forward to working with newly incorporated teams from Omnition and SignalFx to help integrate the combined Splunk community, and ultimately solve even bigger problems for Splunk customers.