Syncsort co-founder Harvey Tessler Live In theCUBE At Splunk.conf 2014

Splunk Inc. provides a comprehensive platform for collecting and analyzing logs from a broad spectrum of devices ranging from the tiniest of sensors to the biggest and meanest enterprise servers. But the company’s definition of “comprehensive “didn’t extend to mainframes until late last month then Syncsort Inc., a mainstay of the big iron world, introduced a first-of-its-kind solution for streaming operational records from big iron to Splunk Enterprise as they come in.

Syncsort co-founder Harvey Tessler dropped by SiliconANGLE’s theCUBE at the recently concluded Splunk Worldwide Users’ Conference to explain why his firm took the time and effort to bring a 50-year-old paradigm into the world of real-time analytics. Syncsort built its business on sorting large tables that exceeded memory capacity back in the days when memory was scarce. Working with massive amounts of data has been its core competency ever since.

“Our mainframe customers have known us for many many years,” Tessler said, referring to his firm’s 46-year history. ”We’ve got more than half of the market on zOS and those mainframe customers trust us to put software on their systems. So now we’re able to pull real-time machine data from zOS to Splunk.”

Traditionally, Tessler told hosts John Furrier and Jeff Kelly, practitioners had to rely on different consoles for monitoring mainframes and the rest of their organizations’ technology infrastructure. Worse, the two sets of system and activity logs were kept separate from each other with little interoperability, creating a situation where administrators would often have to manually scan records for error patterns across records in order to identify a particular problem. That task can take hours or even days, he said, which is unacceptable for a mission-critical application.

Splunk provides an alternative. Leveraging Syncsort’s streaming software, organizations can move mainframe logs into the same environment where they analyze the rest of their infrastructure data in real-time. Tessler said that kills multiple birds with one stone, not only consolidating monitoring operations and making it easier to correlate trends across different systems but also opening the door for customers to store considerably more data about their big iron than they could in the past.

That in itself is a tremendous advantage, Tessler highlighted. After all, the farther a record trail goes back, the more patterns there are to expose. With Splunk, mainframe users can “keep large amounts of historical data and then when something delays 3 seconds, they can say ‘What was it a week ago, last month, six months ago and what are the patterns here?” he said. “Splunk is delivering more and more analytics so that those patterns can be recognized.”

Tessler said that the platform can immediately alert an admin when two processes trying to access the same database table on zOS become “deadlocked,” thus sparing admins the embarrassment of being notified of a service outage by users. That application-level visibility is also handy for dealing with usage trends, he added, which traditional mainframe monitoring solutions only express in the form of their impact on the underlying infrastructure.

Watch the complete interview (13:00).