Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cisco Acquires Splunk

splunk.com

Post reply on HN
Print view View original

251–260 of 525 posts

Re: Cisco Acquires Splunk

#251

Post by anonzzzies »

eigenvalue wrote: post #243
eigenvalue wrote: post #47

I hated Splunk so much that I spent a couple days a few months ago writing a single 1200 line python script that does absolutely everything I need in terms of automatic log collection, ingestion, and analysis from a fleet of cloud instances. It pulls in all the log lines, enriches them with useful metadata like the IP address of the instance, the machine name, the log source, the datetime, etc. and stores it all in S…

Since someone asked, I cleaned up my script and released it: https://news.ycombinator.com/item?id=37600019

Great, finally someone who actually does that. So many examples here with people whining about their Dropbox thingy in 4 lines of Perl but never releasing anything for us to check out. Well done!

Re: Cisco Acquires Splunk

#252

Post by prabhatsharma »

eigenvalue wrote: post #47

I hated Splunk so much that I spent a couple days a few months ago writing a single 1200 line python script that does absolutely everything I need in terms of automatic log collection, ingestion, and analysis from a fleet of cloud instances. It pulls in all the log lines, enriches them with useful metadata like the IP address of the instance, the machine name, the log source, the datetime, etc. and stores it all in S…

Why build in this age when too many open source solutions backed by opentelemetry standard are available. Use fluentbit/vector/otel-collector to capture data and send to some open source solution.

Re: Cisco Acquires Splunk

#253

Post by DylanDmitri »

petetnt wrote: post #33
reacharavindh wrote: post #10

Somebody: Splunk has exorbitant prices and locked-in enterprise customers! Cisco: Oh these guys are just like us. Better buy them up. We know this business.

It's apparently cheaper to buy Splunk than to a buy Splunk license.

Microsoft’s “request for external license” form is one page long, and has a “how much would this company cost to acquire” section. Or so I’ve heard.

Re: Cisco Acquires Splunk

#254

Post by closeparen »

tkahnoski wrote: post #156
bane wrote: post #108

To pile onto the Splunk "love" going on here. Splunk is one of those systems that's too "powerful" for small use-cases, but too expensive for the ones it's really designed for. Anecdote, I once worked with a client that really wanted to get Splunk, but produced so much network traffic that the discounted annual costs were more than the entire budget for the rest of the organization combined. That's staff, the buildin…

Worked at a medium size enterprise and was trying to get some detailed performance metrics with a legacy tech stack that didn't have a drop-in APM soluion. This was in the age of graphite which was great for aggregating metrics cheap but not getting detail. Splunk was used by a much larger product (easily 10x our scale) for monitoring events so there was no red tape to start using it. After launching the detailed ins…

We had an ELK stack I was never very happy with (granted it was very old versions) and then it got replaced by Clickhouse. It’s been excellent.

Re: Cisco Acquires Splunk

#255

Post by g9yuayon »

bane wrote: post #108

To pile onto the Splunk "love" going on here. Splunk is one of those systems that's too "powerful" for small use-cases, but too expensive for the ones it's really designed for. Anecdote, I once worked with a client that really wanted to get Splunk, but produced so much network traffic that the discounted annual costs were more than the entire budget for the rest of the organization combined. That's staff, the buildin…

My experience back in Netflix too. Elasticsearch (we didn't use the L or K) plus query engine on S3 with a catalog was more versatile and way cheaper than Splunk. Nowadays we get a slew of performant OLAP storages that can be used for log analysis as well, which further render Splunk unnecessary.

Re: Cisco Acquires Splunk

#257

Post by tekla »

anonzzzies wrote: post #250
teach wrote: post #223

Earlier quoted context omitted.

I'm gonna respectfully disagree that it fails "at a few TB". We send them 100s of terabytes a day.

But, and this is not meant as criticism or insult as I have no idea how Splunk works, it is just based on other comments; do you know what license your company has with them? It appears that if you are paying them millions, it scales fine, otherwise, it does not?

> I have no idea how Splunk works Cool

> It appears that if you are paying them millions, it scales fine

yes, if you pay someone for product and services, you get them. If you don't, you don't

Re: Cisco Acquires Splunk

#258

Post by jensensbutton »

avrionov wrote: post #195

I wonder if this segment is ready for disruption. Splunk is very expensive, ElasticSearch is still lacking many of the features of Splunk and when hosted on AWS is very expensive. SumoLogic was acquired by private equity, which means that it won't get cheaper. DataDog is also very expensive. Solution like SnowFlake for logs / telemetry where compute and storage are separated might be the future.

Snowflake... is not cheap.

Re: Cisco Acquires Splunk

#259

Post by eigenvalue »

prabhatsharma wrote: post #252
eigenvalue wrote: post #47

I hated Splunk so much that I spent a couple days a few months ago writing a single 1200 line python script that does absolutely everything I need in terms of automatic log collection, ingestion, and analysis from a fleet of cloud instances. It pulls in all the log lines, enriches them with useful metadata like the IP address of the instance, the machine name, the log source, the datetime, etc. and stores it all in S…

Why build in this age when too many open source solutions backed by opentelemetry standard are available. Use fluentbit/vector/otel-collector to capture data and send to some open source solution.

Because I find all that stuff to be even more mental overhead to learn and work with, and super annoying to deploy and manage. It would literally take me longer to get one of those kinds of tools to work on my data the way I want it than it took me to make my own tool that does exactly what I want, exactly the way I want it, where it's incredibly trivial for me to add new kinds of logs or anything else.

When you have a hugely complex, made by committee, enterprise-grade generic system/protocol like opentelemetry that does anything and everything, at any scale, it's always going to have huge amount of excess complexity when you are trying to do a specific simple thing well and quickly. It would be harder to figure out the config files for that stuff than it was to just make my own system.

Re: Cisco Acquires Splunk

#260

Post by networkchad »

zackmorris wrote: post #173
ShrigmaMale wrote: post #143

Earlier quoted context omitted.

stripe, cloudflare (ish), github

Cloudflare's verify human challenge screen is so intrusive and frustrating that it will cost them their credibility IMHO, if it hasn't already. Some part of me feels that a properly designed cache should be able to handle any level of abusive traffic like a p2p cache would, and if it can't, then what are we all doing?

[dead]
Post reply on HN