Customer Scenario and Challenge:
Qmulos engineers are pros at managing and tuning Splunk environments of any size. A large international telecommunications company leveraged the expertise of a Qmulos engineer to reign in an environment that had grown steadily over the years, without much of the necessary tuning along the way.
The particular issues the engineer was tasked with resolving included significant skipped search ratios, a large number of unhandled messages on the Enterprise Security Search Head, and other typical issues found with steady growth and lack of consistent tuning. For context, this customer had nearly a petabyte of searchable data, 700 unique monthly users, and 200 unique daily users. They were leveraging SplunkCloud with unclustered Core and Enterprise Security (ES) search heads.
Qmulos Solution:
To help this customer, the Qmulos consultant added the Extended Search Reporting Dashboard and showcased the many benefits of the Cloud Monitoring Console. The engineer reduced the skipped search ratio from over twenty percent, to less than five percent, during peak times. Additionally, he implemented an understanding of best practices regarding saved search scheduling to avoid complications, tuned a variety of process heavy searches, dashboards, and accelerations, and resolved several data quality issues.
Comments from Customer:
Beyond those successes, the Qmulos engineer tutored the on-site team on best practices and provided guidance on how to move forward with proper, consistent checks and balances in place. The customer commented that “this teamwork proved to be extremely beneficial,” and that the engineer’s guidance will “help maintain optimal health going forward.”
Thanks to the technical acumen and mentor-like approach of Qmulos consultants, the customer was able to move forward with a better understanding of managing sustainable growth, monitoring common problems before they cause impact, following a standardized app and update review process, and better monitor their data quality.
