# Large-scale observability migrations

Cvent (Splunk to Datadog) · Latitude (Sumo Logic to Datadog) · Shipped · Role: Migrated at Cvent and at Latitude

**~880M and 20M+ log events per week moved to Datadog**

Two log platform migrations to Datadog, both completed: one at Cvent, and one at Latitude Financial Services (client, via Viable Solutions and Synechron).

## Key facts

- **Cvent**: ~880M log events per week, Splunk to Datadog (completed)
- **Latitude**: 20M+ log events per week, Sumo Logic to Datadog (completed)
- **Standards**: SLI/SLO and instrumentation standards for Java microservices
- **Also**: Moved a newly acquired company to Datadog (10+ dashboards)

## Problem

Logs, metrics and traces split across platforms make incidents slower to diagnose. Both migrations consolidate them for single-pane dashboards.

## Architecture

Generalised before-and-after for both migrations.

1. **Sources**: Microservices (Java services and more); Business systems (Including payment logs)
2. **Before**: Splunk (Cvent); Sumo Logic (Latitude)
3. **Ingest**: Datadog log pipelines (Grok parsing)
4. **Operate**: Logs, metrics, traces (One platform); Monitors and dashboards (SLIs/SLOs)

## My contribution

- Cvent: migrated ~880M log events per week from Splunk to Datadog.
- Cvent: owned SLI/SLO and custom instrumentation standards for Java microservices.
- Cvent: led a newly acquired company's move to Datadog (10+ dashboards).
- Latitude: migrated 20M+ log events per week from Sumo Logic to Datadog, including Grok parsing pipelines and detection monitors.

## Key decisions

- One platform for logs, metrics and traces instead of separate tools.
- Parse at ingest with Grok pipelines, so payment logs arrive as structured fields.
- Standards alongside the move: SLI/SLO and instrumentation standards for Java microservices (Cvent).

## Implementation

- Cvent: migrated ~880M log events per week from Splunk to Datadog, unifying logs, metrics and traces on one platform.
- Cvent: owned SLI/SLO and custom instrumentation standards for Java microservices, and led a newly acquired company's move to Datadog (10+ dashboards).
- Latitude: migrated 20M+ log events per week from Sumo Logic to Datadog, with Grok parsing pipelines for payment logs.

## Reliability and safety

- Detection monitors for anomalies in payment transaction flows (Latitude).

## Outcomes

- Cvent: logs, metrics and traces on one platform.
- Latitude: migration complete; 20M+ log events per week now on Datadog.

## Stack

Datadog, Splunk, Sumo Logic, Grok parsing, SLIs/SLOs

_Pipelines and monitors are described by purpose only; log content and client system names are omitted._

Web page: https://naman-kumar2397.github.io/projects/observability-migrations/ · Author: Naman Kumar, Lead Site Reliability Engineer (naman.kumar2397@gmail.com)