Splunk Business Flow: Event Logs In, Process Improvement Insights Out

UPDATED 6/21/2020: Splunk Business Flow is no longer available for purchase as of June 20, 2020. Customers who have already purchased Business Flow will continue to have support and maintenance per standard support terms for the remainder of contractual commitments.

Hot on the heels of the launch of Splunk Business Flow (SBF), I wanted to share some insights into the benefits of deploying our new premium app which has been developed to help customers 'mine' their business processes. 

IT is deeply rooted in all modern processes, and wherever there are IT applications there is a “digital exhaust” of data for Splunk to plug into. Applying data-driven process mining can enable you to understand “what’s really going on” in your business processes - with the aim of making them more efficient and profitable. This is where SBF can deliver new insights.

As with any new product, we ran comprehensive Beta testing of SBF to test its functionality, as well as its ability to deliver business value. One of the partners we worked with during this process was Octamis. Based on his experiences, I spoke to Paul Adams of Octamis to get his thoughts on the customer benefits of deploying SBF:

Charles: Paul, based on your experiences - what are the key insights that customers can derive by using Business Flow?

Paul: Only by generating a complete view of the end-to-end process can you understand what's driving the customer experience. Before we had a complete picture, "point insights" may have thrown up worrying or encouraging individual facts, but without the contextual insights you need to act appropriately. 

For example, the impact of a credit card payments outage needs to be judged taking into account the number of customers resorting to an alternative payment method in order to complete their purchase. An order uplift would be a positive story but if customers have to negotiate a longer or more complex journey to make a payment, this could have a negative revenue impact.

When a process lasts hours or days, as with the complete ‘order to fulfilment’ process, a demand surge for a particular product (e.g due to a marketing promotion) could overwhelm downstream fulfilment capabilities. Process-driven insights can enable you to prepare for the consequences of this and with SBF you are no longer making isolated decisions without seeing the complete picture. You make the best call for the business using all available data. 

Charles: You’ve worked closely with SBF over the past six months and I know you’re very excited about it. Why is this?

Paul: I'm excited because the customer is excited. Splunk has always been great at visualising "point insights" but SBF gives greater context as well as the ability to drill down into the data. For example, a doubling of purchases could be bad news if generated by a quadrupling of visitors! Start to factor this in, as well as the ability to monitor conversion rates, and you are making your first toe-dip into what process mining is all about. I am also excited because I’ve seen the results. As soon as we turned a set of individual events into a journey, a raft of new insights (as well as further questions!) just poured out.

Charles: Could you share some practical hints about how best to configure SBF to drive new insights? 

Paul: The requirements are actually very simple. Besides a timestamp, SBF needs only two event fields to surface a basic process flow model;

·      The first is a "Correlation ID" which is used to track the process – this could be a session or order ID for example. (Note: if there are multiple “Correlation IDs” it is possible to stitch these together in order to create the end-to-end process.)

·     The second is the "Step Name" which defines all possible steps in the process. 

You also need to check that your “Correlation ID” is a consistent format across steps and “Step Name” sometimes needs to be derived from other fields using eval or eventstats. Once you provide the information, SBF will automatically build a visualisation of the end-to-end process. This makes it really quick to deploy.

When you have reviewed this initial visualisation, you can weed out any "uninteresting" steps that crowd the picture, or identify areas where more "event coverage" would be welcome. If it's too visually complex, you can use filtering or a pared-down event set to get sharp-focus. I would definitely recommend employing an iterative approach!

To illustrate the outputs, below is a screen shot from Splunk’s new ‘order to fulfilment’ retail demo. This a visual representation of the most recent 1,000 journeys for the first two phases of this process, i.e ordering and payment. 

Each individual journey is derived by identifying individual events using ‘session_id’ as the ‘Correlation ID’. An example of a journey is show below.

This is the first in a series of four blogs that Paul Adams and I will be writing this year to highlight the benefits and usability of SBF. We welcome any feedback, as well as ideas for future subject matter!