Hacker News Reader

Comment by wenc | Hacker News Reader

For an on-prem general purpose logging server, it's fast and easy to maintain. The query engine supports fairly complex queries. Did I mention it's fast? Plus it's an industry standard so it's an easier sell in the enterprise. It's also actually not that expensive at low data volumes -- prices are comparable to Sumologic.

Cheaper alternatives? You can roll your own logging server with fluentd and a database. Some folks will recommend elasticsearch, but we tried it and it was challenging to set up just right.

View on HN

The minute you say “on-prem” a surprising number of sales people stop talking and just looks terrified.

Running and managing an ELK stack is just a hassle and a managing nightmare conpared to Splunk. Humio is a great alternative, if you need something cheaper, but you have to give up a lot of features.

Seconding this. If you want to do anything sophisticated in the ELK stack, you’ll eventually have to write some scripted indexes, and it’s a very bad joke how hard it is to do that.

I've managed a full elastic search + graylog cluster. It was very easy to setup and maintain. https://thehftguy.com/2016/09/12/250-gbday-of-logs-with-gray...

By far elasticsearch is the easiest distributed database to setup and scale.

At what scale is your on premise Splunk? As a member of a team maintaining very large on-prem Splunk service I haven't found maintaining Splunk to be an easy undertaking.

1 server install of Splunk Enterprise. Less than 150mb a day ingest. We installed it over a year ago and haven’t touched it since, aside from updates.

A typical small deployment is more like 150 GB a day. No wonder you have no issues at that incredibly small scale.

Oops wrong number, 1GB a day, not 150MB.

Yes, it's not big. But that's all we need.

I feel Splunk is maybe quirky

It has lots of query processing operations, sure. But it can't do (at least not easily) some things you could do with bash/grep in "traditional" settings (example, get the context between lines that match a pattern)

The equiv of grep -Cx in splunk is just hit the show source link in an event.

Splunk has a more powerful feature though “| transaction“ - often in multithreaded logs i want the context but ignoring entries not from my thread. This feature does that

I love the power of splunks query engine, there really isn't anything comparable that I know of. But setting up forwarders and injesting logs is quite a pain.

Reply on news.ycombinator.com