It's almost funny how difficult the Splunk homepage makes it to figure out what Splunk does and if it can help me.
Who designs these things? I gave up after two minutes.
Who designs these things? I gave up after two minutes.
In a nutshell, Splunk is valuable because it turns your unstructured untyped data into something much easier to analyze and Business Intelligence (BI) ready. IMHO, the strength of Splunk is two folds. First, it provides a central place to view and mine your logs across hundreds or thousands of machines. This is very useful in many organizations with large scale distributed computing because you don't need to ssh into your database server in one terminal and compare the results in another terminal connecting to your web server, if you could ever figure out which of the 100 database servers you should look at. Second, instead of just greping, it treats each log entry as a list of key-value pairs and provides a simple yet powerful query language for it. On top of that, it gives you a library of visualization components. I was able to build a fully-customized Google Analytics style dashboard for my application in 20 minutes. And I would say that is empowerment, and empowerment is the most valuable value.
And if you are very into technologies, they are a Python house, which is always a plus :)
- No up-front pricing, you need to get a quote
- No screen-shots, you need to see a prepared demo
- Any contact what the company results in assignment of an "account manager", the used-car salesman of the software industry.
- Lots of testimonials from people you've never heard of talking about software you've never heard of using the very same buzzwords found on the website.
The one useful thing it can do is give (say) devs access to logfiles from prod servers that they aren't allowed for whatever reason to log into themselves. But you could do this yourself with a periodic rsync to an internal webserver...
Competing business idea...?
I have since left working with Splunk directly but I would still advocate its use because it's one of the better commercial (albeit expensive) log management/SIEM products around.
* the largest data source in any enterprise
* increasingly must be stored for long-term analysis ...
* by corporate policy or ...
* by government regulation/demand
Splunk will do well. I hope this boosts acquisition interest in my old company, http://www.sensage.com, another log analysis company.
Honestly, your competing with inhouse scripts people spend a few weeks / year maintaining. Which is not to say you can't make a lot of money doing so. Ideally, your saving people significant time writing these scripts, but tossing out buzzwords just alienates your users.
I am not a Splunk developer or serious user of it, but you greatly underestimate the problem space to suggest this class of products address the same problems solved by even a very skilled scripter's scripts.