Menu Close
Data infrastructure optimization, availability & security software
Data integration & quality software
The Next Wave of technology & innovation

Customer Story

Global Financial Firm Controls Costs on IT Operations with Ironstream + Splunk for an ITOA Solution


Banks and financial services firms have many unique challenges in this digitalmobile-global era, and choosing which to address first is an important skill for their IT leaders. Better control over a multiplicity of costly IT operations was the goal of this multinational financial services corporation. One job, for example, was using 30% more CPU time than was normal; the cause was unclear, and the impact was unacceptable.

The lack of understanding exactly “why” certain things cost so much and took so long to resolve had to be addressed to ensure they remained a leader in this hyper-competitive sector.

More broadly, the customer was spending too much money on additional capacity on demand; the mean time to problem resolution was too long; timely alerts to many problems were lacking; and there was insufficient correlation of significant events picked up by operational and application performance monitors in various business segments. Even more critically, there was no correlation between its IBM z/OS mainframes and distributed systems.

IT operations analytics (ITOA) was the primary use case the company wanted addressed, and that included several capabilities to address their business needs:

  • Getting real-time alerts from RMF III and Db2 database access threads.
  • Proactively monitoring statistical anomalies relating to mainframe resource consumption.
  • Real-time tracking of transaction performance as transaction data moved through multiple stages from distributed to mainframe systems.
  • Real-time alerting on mainframe usage and contention issues in batch job performance.
  • Real-time monitoring of Db2 Stored procedures for excessive calls.
  • Identifying key areas for automation or consolidation.


The solution began with researching the IT operations analytics (ITOA) marketplace and choosing the clear leader in this big data analytics platform sector serving the high-transaction financial services firms. The customer’s overall platform selection for IT monitoring and analytics, which brings together inputs from its distributed computing environment, was Splunk® Enterprise. This platform was ingesting 40 terabytes of log data per day from hundreds of applications around the world.

Missing from this insight-generating stream, however, was real-time performance log data, or “machine” data, from the mainframe environment. That changed when it began a pilot program for Syncsort’s Ironstream product, the chosen partner of Splunk for solutions that access mainframe log data in real time. Ironstream is the industry’s premier real-time forwarder of critical SMF records and other operations and applications log data to the Splunk platform. Given its unmatched track record of success in this area, Ironstream was an easy choice.

The pilot was a success, the customer began working toward full implementation. It involved the mainframe and Splunksavvy Syncsort services team and the customer’s IT team working together on a detailed business-requirements roadmap, customized use-case designs, installation planning, and rollout of the Ironstream for Splunk® solution across the critical operations.

After the implementation was complete, the customer had the capacity via Ironstream to forward in real time up to 100 GB of z/OS log data from 13 LPARs to the Splunk platform. That enabled correlation and analysis with like log data from distributed systems and supported the desired new insights and efficiencies.

It was also just the beginning. The customer planned to bring on other mainframe data sources to provide additional value to the various users, with capacity expansion up to 2 TB per day anticipated. The more mainframe data accessed, the more value delivered for each additional use-case.

Performance Results

Once in production, the Ironstream for Splunk solution was delivering actionable insights, including:

  • Real-time CPU monitoring in Splunk Enterprise to pinpoint expensive transactions, business volumes, and other variables that correlate with MIPs usage.
  • Tracking of overnight batch progress in real time, including predictive analysis to identify potential bottlenecks, to alert when SLAs or other targets might be missed.
  • Highlighting of key CPU consumption anomalies, with alerts.
  • Tracking of Db2 stored procedures, with exceptions for lock contention and escalation, timeouts, deadlocks, excessive calls, and package wait time.
  • Real-time reporting, visualization, and monitoring of mainframe SMF data to monitor system health and identify real or potential failures in Splunk Enterprise.
  • Clear visibility into mainframe and distributed-to-mainframe operations and applications in Splunk Enterprise.

Business Results

  • Costly CPU consumption was reduced.
  • The expensive CPU processing of SAS/MXG reporting was offloaded to inexpensive commodity hardware via the Splunk platform.
  • Service quality was enhanced by more effective problem resolution and reduction in mean time to resolution (MTTR).
  • In-house tools made obsolete by monitoring in Splunk Enterprise were targeted for elimination.
  • Production of a wide range of business reports from one unified system in real time was made possible.
  • Operational efficiencies and predictive analytics were driving the desired resource savings and a competitive advantage.

To learn more about gaining these types of ITOA-based improvements with the industry-leading Ironstream for Splunk approach, visit: