Cisco Go-To-Market President Gary Steele On Splunk-Cisco Integration, This Week’s .Conf24 Event, And Building AI Into Observability

Gary Steele, who serves as Splunk general manager in addition to his Cisco post, says in an interview with CRN that a major focus for him is not allowing the nitty-gritty of the ongoing Cisco-Splunk integration to disrupt Splunk’s track record of innovation.

In mid-March Cisco Systems completed its $28 billion acquisition of Splunk in one of the IT industry’s biggest acquisition deals in recent years. Since then, work has been underway to integrate Splunk and Cisco both operationally and from a product point of view.

Splunk, based in San Francisco, develops a platform for collecting and analyzing machine data with observability and cybersecurity the most popular applications for the technology. The vision was that Splunk meshed well with networking giant Cisco, based in San Jose, Calif., and its own efforts to expand into AI, security and observability.

At the Cisco Live conference in sweltering Las Vegas last week, company executives provided additional details about how the Cisco and Splunk technology portfolios will work together. This week Splunk has its annual Splunk .conf24 event, also in Las Vegas, where company executives are expected to make a series of product announcements that take that integration even deeper.

Splunk General Manager Gary Steele (pictured) and Cisco Chair and CEO Chuck Robbins are both scheduled to address thousands of Splunk customers and partners in keynote speeches Tuesday.

Steele was originally named general manager of Splunk and a Cisco executive vice president at the time of the acquisition. Last month he was elevated to the post of president of go-to-market for Cisco while retaining his Splunk general manager post. That coincided with the departure of Jeff Sharritts, a 20-year Cisco veteran who was executive vice president and chief customer and chief partner officer at the networking giant.

This will be Steele’s third Splunk .conf event. Prior to the Cisco acquisition, Steele served as president and CEO of Splunk for two years, replacing longtime CEO Doug Merritt, who resigned in November 2021. Before joining Splunk Steele was CEO of security technology developer Proofpoint.

In addition to the latest innovations in Splunk’s security and observability product lines, Splunk .conf24 attendees will be looking for hints about the company’s plans to build AI into its technology offerings. And partners will be looking for guidance about Splunk’s channel plans as Cisco and Splunk work to integrate their products and their operations.

Splunk is also expected to highlight the results of a recent study that quantifies the costs, both direct and hidden, of unplanned IT system downtime—something that Cisco and Splunk aim to reduce with their combined observability software.

Last week Steele, who was in Las Vegas for Cisco Live, took a few minutes to talk with CRN about the ongoing Splunk-Cisco integration, his own role across both entities, and what Splunk partners can expect to hear at the Splunk .conf24 event. He also dropped a few hints about the product unveilings expected at the conference.

Here is what Steele had to say in his interview with CRN.

Talk about your new job as president, go-to-market at Cisco. And I presume that includes all channel operations?

I really have two critical roles, as you think about it. I run go-to-market for Cisco and I continue to run Splunk. And I’m driving the integration for Splunk

with Cisco [and the position] includes all the channel operations. So I’m super excited about it. I’m really focused on ensuring that we’re driving great customer outcomes and working closely with our sellers and our partners to ensure that we’re getting all the amazing innovation that we’ve been announcing at Cisco Live and what will be announced [at Splunk .conf.24], making sure we get it into the hands of customers.

So very excited about the new role, the new opportunity. And my focus, as I mentioned, on customer outcomes is also looking at how do we make it easier for customers and partners to do business with Cisco. And working hard to simplify things that we think will ultimately increase velocity and agility as a company.

What is Splunk’s status right now within Cisco and going forward? Is it a subsidiary? What’s the way to define it?

No, we’re basically a business entity within Cisco. And so when we came into Cisco, basically, we moved the whole organization into Cisco. The only person that changed job titles was me, literally only one person among the whole 8,000 people that came over.

And we’ve kept it very much aligned to the goals that [Splunk] had previously— continuing to drive great innovation, delivering great value to the customer. And I think you’ll see that in our [Splunk] .conf24 announcements. There’s a lot of good stuff happening. And then, we’ve been obviously working on all the interesting points of integration that we can across security and observability within Cisco.

The other thing, from an integration standpoint, the one thing that did happen right out of the gate is we moved all of the [Cisco] AppDynamics development team and the full-stack observability developers that were operating within Cisco into Splunk. And so that team is [now] part of the Splunk team so that we could deliver a single, integrated solution to our customers.

That happened right after the acquisition?

It actually happened on day one. The move organizationally happened on day one. And the rationale there was simply [that] we want to make sure that we’re bringing [a] single solution for observability to our customers. Bringing the development organizations together, we felt like we could move faster, make better decisions and deliver better outcomes. And so Chuck did that right on the first day.

Since we’re talking about development, where do Splunk and Cisco stand in terms of product integration?

What we’ve been doing is focusing on the critical points of integration where we can deliver great value to customers.

At RSA we started this—at RSA we announced the integration between Cisco XDR and Splunk Enterprise Security. That’s basically taking high-fidelity alerts out of XDR and ingesting those into enterprise security. That received a lot of very positive input.

And then here at Cisco Live we’ve had another set of announcements, mostly focused on the observability side of bringing AppDynamics and integrating it with the Splunk platform. There’s actually a whole slew of announcements, all integration-focused, that we did in the observability product line here at Cisco Live this week.

The focus for us has been—and I’ve been describing this as a strong ground game—it’s really critical for us to continue on our path of innovation. We’ve been really continuing to ensure that we’re not being disrupted by the acquisition and that we’re continuing to deliver critical innovations to the customers. The simple ground game, the strong ground game, has been our focus because we just, literally, don’t want to lose a beat.

As you look at how integration will work, then, broadly within Cisco, we’re actively working to integrate G&A [general and administration operations], but we’ve aligned the development teams so that we can get the right outcomes there, and our sales teams are collaborating with their colleagues, broadly, in sales.

So the sales teams right now are still separate, but collaborating?

Yes, that’s exactly right. They’re separate, but they are collaborating. ... And the rationale for that is we want to make sure that we don’t disrupt Splunk’s growth and ensure that we’re continuing the market momentum that we had prior to being acquired.

But integrating general and administrative operations?

Yes, general and administrative, legal, finance and HR.

How about from the channel perspective? What’s happening there from an integration standpoint?

Obviously, Cisco’s channel program is strong and very dominant around the globe. What we’re doing today is we’re beginning to enable the Cisco channel to, more broadly, sell Splunk. We obviously have overlap there, but there’s still a lot more opportunity in terms of where we can go in terms of enablement of the channel.

We’re keeping the programs separate for now. If someone in the Cisco world wants to be enabled and drive sales with Splunk [products], they basically enroll and get enabled through the Splunk channel program. And we’re going to continue to keep them separate for the time being. Because what we want to do is really capture the opportunity with the broader Cisco channel while continuing to embrace and support the existing Splunk channel, so we don’t have disruption.

Is there much overlap between the partner bases?

There’s some, obviously, you would expect that … if you look globally. I don’t know what that percentage is [and] I don’t know that we’ve made that [public] externally.

Cisco’s biggest partners have not traditionally been Splunk’s biggest partners. I think that’s the easy way to think about the opportunity. And so we really want to enable Cisco’s large strategic partners to have the opportunity to sell Splunk as part of their overall Cisco portfolio.

The thing we’re excited about with this is we really get a lot more channel leverage as I’m coming to Cisco, given Cisco’s historically very tight alignment with the channel.

So the goal right now is to provide the Cisco partner base with greater access to sell the Splunk portfolio?

That’s right.

Splunk is making product announcements at .conf24 around observability and security. While I know you can’t disclose details ahead of time, how do those fit into what we’ve been talking about here in terms of Splunk-Cisco alignment and long-range goals?

I think on the observability and the security side, what you’ll see is a set of really interesting announcements that continue to drive our innovation to help customers on their journey for digital resilience.

As you can imagine, in today’s world, what people are really focused on is how do they keep their systems up and running? And that really means ensuring that they’re well protected and secure, [and that] they don’t have different forms of application outages, etc., that would bring downtime. We recently published our downtime study, but it’s kind of amazing, frankly, the impact that downtime has on businesses today.

But all of the things that we’ve been working on have been in support of this broad digital resilience messaging. And that’s the reason I bring it up. And so in the security category and the observability category, you’ll see big announcements.

In security, for example, we have our next major release, which is 8.0, it has a range of really important features in it. We’re very excited about it. We think customers are going to be excited about it and it’s really helping customers on this journey of digital resilience.

And then on the observability side, we have a similar set of very significant announcements that we think are going to be incredibly important [around AI] for observability that really drives more efficiency and how you identify and resolve issues in your runtime environment. So, a lot of really good capability that’s coming out.

We’ve gone this far in our conversation and I think that’s the first mention of AI.

To that point, we have a whole series of announcements around AI, as you’d expect. We’re effectively putting AI in all the critical products that we have. I mentioned observability. We’ve got an AI set of capabilities that you’ll find in security. We also have built it as a stand-alone assistant so that you don’t have to understand the proprietary SPL [Splunk Search Processing Language]. All these capabilities are either in preview or coming to market soon, and you’ll see that [at Splunk .conf24]. But that’s a broad theme and a very important set of deliverables for us.

What should channel partners be looking for at Splunk .conf24? What do you expect will be the biggest takeaways for them?

I think what people will walk away with is a level of enthusiasm, excitement for the level of innovations happening at Splunk and the problems that they can solve for customers that are top priority. So just circling back to that downtime report, I think everybody understands the impact and damage created by downtime and the fact that customers are willing to spend money and get innovation to help them solve these problems.

And I think Splunk is best positioned in the industry to go do that. And I think channel partners will see that when they come to[Splunk .conf24] and they experience all these interesting new capabilities that we’ll be announcing.

Anything in terms of overall benefits for customers in terms of these announcements?

I think they’re going to get a full taste of AI across the entire product line. Which I think, again, for the channel, is a very good thing to talk to customers about because they also want to hear it. And then I think the other dimension that I didn’t mention earlier is we’re really helping customers manage the broad amount of data that they’re dealing with. And there’s a lot of really interesting [upcoming] announcements on this front as well in the core platform.

Data and AI are two sides of the same coin today.

They are, for sure. I think that all fits really well together.