Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cisco Acquires Splunk

splunk.com

Post reply on HN
Print view View original

201–210 of 525 posts

Re: Cisco Acquires Splunk

#201

Post by masfuerte »

wbl wrote: post #141
sanderjd wrote: post #115

Earlier quoted context omitted.

This is not actually dissonant! HN is mostly a place where technologists gather, not corporate heads of IT or other business people. This is especially true of the subset of users who actively participate rather than only reading. And it is not unusual in the least for an enterprise product to be wildly profitable but not admired by technologists. Indeed, it's the default; Oracle, SAP, Microsoft, etc. What is interes…

Microsoft contains multitudes, from the successor to VMS to the win32 API to some very advanced programming language stuff like F#.

F# is nice but seems like a fairly conventional functional language. My first reaction to some of the features of Koka (also MS) was I didn't know that was even possible.

https://koka-lang.github.io/koka/doc/book.html

Re: Cisco Acquires Splunk

#202

Post by hparadiz »

tkahnoski wrote: post #156
bane wrote: post #108

To pile onto the Splunk "love" going on here. Splunk is one of those systems that's too "powerful" for small use-cases, but too expensive for the ones it's really designed for. Anecdote, I once worked with a client that really wanted to get Splunk, but produced so much network traffic that the discounted annual costs were more than the entire budget for the rest of the organization combined. That's staff, the buildin…

Worked at a medium size enterprise and was trying to get some detailed performance metrics with a legacy tech stack that didn't have a drop-in APM soluion. This was in the age of graphite which was great for aggregating metrics cheap but not getting detail. Splunk was used by a much larger product (easily 10x our scale) for monitoring events so there was no red tape to start using it. After launching the detailed ins…

Comcast would drop all the error logs for all the cable boxes in the country into splunk. I then queried this to figure out the error code count in a given period. It's really the only thing that can handle the volume.

Re: Cisco Acquires Splunk

#203

Post by Damogran6 »

silverfox17 wrote: post #134
KomoD wrote: post #119

Earlier quoted context omitted.

> That's staff, the building, equipment, power, water, everything...the estimated Splunk cost was more than that. Wow, it's THAT expensive?

You can't really make an informed decision without knowing how much data they were moving. For it to be that expensive, you'd need to be moving a ludicrous amount of data, and you can always parse data down to the required fields before indexing, which saves on licensing costs.

in 20 years of doing SIEM and SIEMlike solutions, I've yet to find an engagement that said 'Oh, yes...our volumes are XX and YY'...mostly it's a /shrug and a less than educated guess.

There's even reluctance to turning things on and _watching_ it for 10 minutes. An activity that would immediately give you a much better idea of volume. Folks just don't like doing it.

Then you get the things were setting up a redundant logsource is just unwise. DNS logging was 2 orders of magnitude greater than everything else a SIEM was doing. And Email was about the same size.

Re: Cisco Acquires Splunk

#204

Post by magixx »

eigenvalue wrote: post #47

I hated Splunk so much that I spent a couple days a few months ago writing a single 1200 line python script that does absolutely everything I need in terms of automatic log collection, ingestion, and analysis from a fleet of cloud instances. It pulls in all the log lines, enriches them with useful metadata like the IP address of the instance, the machine name, the log source, the datetime, etc. and stores it all in S…

It's weird seeing no mention of Graylog anywhere here which is slightly different but I've found much easier to use in smaller setups. Unfortunately I have no idea what enterprise cost ends up looking like.

Re: Cisco Acquires Splunk

#206

Post by wbl »

silverfox17 wrote: post #134
KomoD wrote: post #119

Earlier quoted context omitted.

> That's staff, the building, equipment, power, water, everything...the estimated Splunk cost was more than that. Wow, it's THAT expensive?

You can't really make an informed decision without knowing how much data they were moving. For it to be that expensive, you'd need to be moving a ludicrous amount of data, and you can always parse data down to the required fields before indexing, which saves on licensing costs.

What are the required fields in an incident with a new bug pray tell?

Re: Cisco Acquires Splunk

#207

Post by JAlexoid »

sanderjd wrote: post #146
reducesuffering wrote: post #135

Earlier quoted context omitted.

> that are both profitable and mostly admired AWS?

Actually yeah, closer than most. I think it's a somewhat grudging admiration at this point, increasingly so as they do more and more also-ran services. But yeah, this does seem right for the "core" services; ec2, s3, maybe lambda, etc.

AWS business model is to just literally take a popular OSS system and provide it as a service.

It was like that from the beginning. That's why there's much less animosity towards AWS, because they just allow you to run your X without the overhead of infra investment.

Re: Cisco Acquires Splunk

#208

Post by wbl »

masfuerte wrote: post #201
wbl wrote: post #141

Earlier quoted context omitted.

Microsoft contains multitudes, from the successor to VMS to the win32 API to some very advanced programming language stuff like F#.

F# is nice but seems like a fairly conventional functional language. My first reaction to some of the features of Koka (also MS) was I didn't know that was even possible. https://koka-lang.github.io/koka/doc/book.html

The novel part is it gets pushed and used in prod.

Re: Cisco Acquires Splunk

#209

Post by bastardoperator »

bane wrote: post #108

To pile onto the Splunk "love" going on here. Splunk is one of those systems that's too "powerful" for small use-cases, but too expensive for the ones it's really designed for. Anecdote, I once worked with a client that really wanted to get Splunk, but produced so much network traffic that the discounted annual costs were more than the entire budget for the rest of the organization combined. That's staff, the buildin…

That's what I was wondering about when it comes to this acquisition. Can Cisco make Splunk even more expensive? I have faith they can, I know for many folks, Splunk tops the leaderboards when it comes to spend.

Re: Cisco Acquires Splunk

#210

Post by TheIronMark »

chelmzy wrote: post #21
aeonik wrote: post #9

Earlier quoted context omitted.

Which ones do you recommend? Every one I have tried hasn't really given me the same flexibility as Splunk, most seem to miss the core part of what makes Splunk cool. Though I'd definitely like to see Splunk improve their design.

He's talking out of his ass. But newish competitors are Devo/Sumo Logic.

SumoLogic is also not cheap.
Post reply on HN