Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Splunk IP suit against Cribl

splunk.com

Post reply on HN
Print view View original

21–30 of 107 posts

Re: Splunk IP suit against Cribl

#21

Post by flounder3 »

ec109685 wrote: post #18
flounder3 wrote: post #16

Earlier quoted context omitted.

Sounds crazy, but Datadog. I’ve been hammering their product teams for years with specific use cases for the sole purpose of replacing Splunk. They recently migrated search technologies and are rapidly closing the gap. Plus, their exclusion features are instant and fantastic, and their C-suite replies to me when I escalate. Elasticsearch simply couldn’t handle key collisions. We have hundreds of various apps across 5…

Sad. Splunk should be more fantastic. They have done the heavy lifting of taking streams of data at high volume, which should be the basis to build a log search product, metrics And alerting, and observability. Instead, each of these systems have their own collectors and correlating from one to the other is hard. A canonical log line is so much more valuable than a metric collected every 60 seconds, and the former ca…

Absolutely agree. It’s tragic.

Shoving SignalFx down our mouths and trying to get us to create “metric” indices was the straw that broke my back.

Re: Splunk IP suit against Cribl

#22

Post by flounder3 »

jollofricepeas wrote: post #19
ec109685 wrote: post #12

Earlier quoted context omitted.

What are you planning to move to?

Exactly. This is the question. If you’re looking for APM well you’ve got great options but for those using Splunk in the security space (SIEM & SOAR) you’re screwed. There’s no better SIEM alternative that deals with logs at scale. Splunk recently screwed a friends Fortune 50 company. They didn't pay a bill on time (renewal negotiations) and Splunk without even contacting them just left all the logs from one of their…

Lol, this is exactly what I was referring to! We were negotiating a massive renewal (50x budget IN EARNEST!) and out of nowhere they threatened to cut us off with less than 24 hours notice because we were a week behind their schedule, despite signed agreements. Thankfully our VAR (a longtime partner) jumped in and cut a PO to vouch for us and our word.

NONE of our other vendors have EVER done that shit in my entire career. EVER. My word means nothing to them; they act like a pure private equity player now.

Re: Splunk IP suit against Cribl

#23

Post by windexh8er »

flounder3 wrote: post #8

Splunk, as a company, is a shell of its former self. All they care about is pimping themselves out to maximize profits to an extreme that only Dilbert can relate to, even at the expense of destroying a long term professional relationship over trivial matters. They are more than happy to kill a deal over a 5% disagreement rather than understand the needs of a Fortune 500 customer and negotiate. They are mad because Cr…

I can add from the other side of the fence. I worked for a startup that was acquired by Splunk. They are everything listed here and worse on the inside.

My first few weeks at Splunk were very odd. They try to indoctrinate new hires with a barrage of "A-players" that continuously talked about how awesome Splunk was. Except... When I started Splunk was getting their ass kicked by cloud-first players that had recently come to market. Splunk's monolithic architecture wasn't well suited to be run as SaaS at the time and Splunk was burning cash and losing money on every customer that they suckered into moving away from their perpetual licenses into subscription hell. I left money on the table when I ran out the door less than 6 months later.

I'm curious what Splunk's long game is with this because they just told every F2000 that their bottom line is being chipped away by Cribl and friends. So if I'm an enterprising procurement department I'd be tossing Cribl or Rudderstack or whatever other data transformation preprocessor on the table alongside my renewal. Expand opportunity? If you put your ear to the tracks you can almost hear all of the account managers digging out missed quota excuses.

Splunk isn't innovative and hasn't been for a long time. Most of the employees saw the writing on the wall and went to Snowflake as soon as the opportunity presented itself. Splunk tried to capitalize on the security market by, basically, double charging customers for ES. Instead of delivering value it seems to be Splunk is just looking for ways to squeeze a few last drops of lemonade.

Re: Splunk IP suit against Cribl

#24

Post by stevewatson301 »

throwawanginee2 wrote: post #13

Splunk is a great tool but expensive. I like splunk's aggregation feature very much. If it is server logs, it can aggregate and tell me how many http 500 errors I have, how many requests resulted in 404 etc. It can tell me top IP addresses where I am getting requests from, etc. I want to take a CSV file and provide same functionality. Eg. Give user information on how many times each field occurs. For example, if it i…

> Is there an open source version of splunk I can modify?

https://github.com/grafana/loki might work for you. It’s not a drop in replacement for Splunk, FWIW.

Re: Splunk IP suit against Cribl

#25

Post by greggsy »

chillfox wrote: post #7
_8j50 wrote: post #4

Splunk is the best at what it does with no close competition. I've been looking into Cribl and it seems their product has surpassed their competition as well but not in search, more in data summarization and log reduction, possibly before you ship it off to a more proper place like Splunk. Splunk's cost makes it inaccessible to most people or companies. I mean, I work in infosec and I highly caution against Splunk be…

Is Splunk fast now? Last time I used it was almost a decade ago and it was rubbish, queries took 10-40 minutes to complete.

No offence, but that sounds like lazy query design, poor architecture, or both.

Re: Splunk IP suit against Cribl

#26

Post by chillfox »

flounder3 wrote: post #10
chillfox wrote: post #7

Earlier quoted context omitted.

Is Splunk fast now? Last time I used it was almost a decade ago and it was rubbish, queries took 10-40 minutes to complete.

It has always been the Cadillac of search, and moreso with unstructured indexing (e.g. key collisions with different data structures. Foo = string vs foo = integer vs foo = array). Your queries or infrastructure were not optimized. It’s very fast when optimized.

Interesting,

It was Splunk managed and configured, so I would have thought it optimized, but I guess they made more money from it not being optimized.

If I remember right then we were throwing about 200+ GB at it a day.

Re: Splunk IP suit against Cribl

#27

Post by [deleted] »

windexh8er wrote: post #23
flounder3 wrote: post #8

Splunk, as a company, is a shell of its former self. All they care about is pimping themselves out to maximize profits to an extreme that only Dilbert can relate to, even at the expense of destroying a long term professional relationship over trivial matters. They are more than happy to kill a deal over a 5% disagreement rather than understand the needs of a Fortune 500 customer and negotiate. They are mad because Cr…

I can add from the other side of the fence. I worked for a startup that was acquired by Splunk. They are everything listed here and worse on the inside. My first few weeks at Splunk were very odd. They try to indoctrinate new hires with a barrage of "A-players" that continuously talked about how awesome Splunk was. Except... When I started Splunk was getting their ass kicked by cloud-first players that had recently c…

[deleted]

Re: Splunk IP suit against Cribl

#28

Post by psaux »

flounder3 wrote: post #8

Splunk, as a company, is a shell of its former self. All they care about is pimping themselves out to maximize profits to an extreme that only Dilbert can relate to, even at the expense of destroying a long term professional relationship over trivial matters. They are more than happy to kill a deal over a 5% disagreement rather than understand the needs of a Fortune 500 customer and negotiate. They are mad because Cr…

No comment about the company, but want to make clear as a buyer you understand the procurement and legal parts i.e. MFN or MFC.

If they do discount, even 5%, then it ripples across their accounts as a legal matter, esp at your scale. I was a buyer for some big companies, 8 digit, and the procurement office would only do a deal with MFN/MFC clause. They would also audit the supplier from time to time.

Re: Splunk IP suit against Cribl

#29

Post by _8j50 »

chillfox wrote: post #7
_8j50 wrote: post #4

Splunk is the best at what it does with no close competition. I've been looking into Cribl and it seems their product has surpassed their competition as well but not in search, more in data summarization and log reduction, possibly before you ship it off to a more proper place like Splunk. Splunk's cost makes it inaccessible to most people or companies. I mean, I work in infosec and I highly caution against Splunk be…

Is Splunk fast now? Last time I used it was almost a decade ago and it was rubbish, queries took 10-40 minutes to complete.

Very very fast, I can do an all time search on terabytes of data in seconds.

But you have to learn to use it, if you don't give it an index and a sourcetype that will slow it down, and like ES leading wildcards slow things down. The fastest searches are simple terms like a word or an IP.

Re: Splunk IP suit against Cribl

#30

Post by chillfox »

jitl wrote: post #9
chillfox wrote: post #7

Earlier quoted context omitted.

Is Splunk fast now? Last time I used it was almost a decade ago and it was rubbish, queries took 10-40 minutes to complete.

We recently transitioned to it at Notion and it’s been very fast, outperforming the previous log vendor substantially while offering better search and UX. If you used the on-prem version, the cloud version is quite a different experience.

I don't know which version we used, just that it was managed and configured by Splunk.

We were only sending a small subset of our logs to it so about 200+ GB a day. Our Linux box with spinning disks could grep the full set of logs much faster than querying Splunk, so I don't think anyone really used it.

Post reply on HN