Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cisco Acquires Splunk

splunk.com

Post reply on HN
Print view View original

271–280 of 525 posts

Re: Cisco Acquires Splunk

#271

Post by echelon »

g9yuayon wrote: post #255
bane wrote: post #108

To pile onto the Splunk "love" going on here. Splunk is one of those systems that's too "powerful" for small use-cases, but too expensive for the ones it's really designed for. Anecdote, I once worked with a client that really wanted to get Splunk, but produced so much network traffic that the discounted annual costs were more than the entire budget for the rest of the organization combined. That's staff, the buildin…

My experience back in Netflix too. Elasticsearch (we didn't use the L or K) plus query engine on S3 with a catalog was more versatile and way cheaper than Splunk. Nowadays we get a slew of performant OLAP storages that can be used for log analysis as well, which further render Splunk unnecessary.

My experience at a big fintech I won't name: we had our own highly engineered in-house metrics system staffed by a big team. Custom pipeline, integrations in multiple languages, high resolution, custom aggregation and rollups. It was nice. We also had in-house logging, exception tracing, alerting, service discovery, metrics dashboards, etc. It was all actually pretty good. All engineered by xooglers.

Someone (not to name names) got bitten by the "anti-weirdware" bug and started shifting us off of all our custom-built solutions. Every team got hit with major distractions from their roadmaps for each of these changes. None of the headcount dedicated to staffing the internal systems was freed up - they had to run the new integrations.

The decision was made one day to migrate all of our observability stuff over to SignalFx. Observability wasn't our "core competency" and our systems were "weirdware".

We had to rewrite our instrumentation, all of our reporting dashboards, and all of our alerting DSLs changed. They were not replaced 1:1 for every system and metric, so we emerged in a much worse, much less visible situation across the board. Outages happened or went unreported.

Splunk acquired SignalFx and dramatically raised prices. We scrambled to do the migration process yet again, impacting roadmaps and leading to more outages.

Leadership was changed.

There's one thing to be said about NIH, but when you write systems that are already working, inexpensive, and easy to maintain, you shouldn't throw them out because you're worried analytics isn't your "core competency". Yes - it is your core competency, because you're selling uptime to your customers.

Re: Cisco Acquires Splunk

#272

Post by bvirb »

andrewflnr wrote: post #148
dangus wrote: post #60

Earlier quoted context omitted.

Are medium-sized customers valuable to Splunk? In sales we call this "Ideal Customer Profile." Why do I want a customer with less money to spend if I have a product with enough capability for the gigantic money-is-no-object customers?

Mindshare is valuable, was the point GP was making. If midsize customers ignore you because you're too expensive, and then implement something else before they get big enough to afford you, where do you get new customers? Forget growth, how do you replace attrition as your existing customers die? Personally I can't say if that's actually happening with Splunk, but it's a very plausible scenario.

I've recently dealt with multiple companies who started using IBM Aspera (which as a vendor to them means we have to use it too) only for it to work miserably. I've also seen a couple tiny, perfectly functional MySQL databases replaced by expensive, slower Oracle databases with much higher maintenance costs.

I think once a customer with a big enough budget is recognized by sales at one of these big organizations they make the sale happen. They talk to the higher-ups and either make them happy, or feed them a lot of FUD (or both), and then they're in, regardless of what the people working with the products (many of whom might be external vendors or consultants!) think.

They're basically focused on more traditional sales & marketing instead of more grassroots sales & marketing (mindshare), but at least in my experience they definitely still get new customers.

Re: Cisco Acquires Splunk

#273

Post by baq »

Aeolun wrote: post #264
nostrebored wrote: post #227

Earlier quoted context omitted.

I've worked at companies with objectively large amounts of data. Splunk scaled to meet their workloads. At no enterprise doing this is someone able to just isolate a single log file and grep through it at scale.

Presumably you can have a cluster of grepping machines. I wonder how it scales compared to the millions you pay for Splunk.

is your business' core competency building a distributed grep or actually selling useful stuff?

Re: Cisco Acquires Splunk

#275

Post by pbreit »

bane wrote: post #108

To pile onto the Splunk "love" going on here. Splunk is one of those systems that's too "powerful" for small use-cases, but too expensive for the ones it's really designed for. Anecdote, I once worked with a client that really wanted to get Splunk, but produced so much network traffic that the discounted annual costs were more than the entire budget for the rest of the organization combined. That's staff, the buildin…

Is Splunk printing money like DataDog is?

Any lower priced alternatives? Or self-hosted?

Re: Cisco Acquires Splunk

#276

Post by AtlasBarfed »

bane wrote: post #108

To pile onto the Splunk "love" going on here. Splunk is one of those systems that's too "powerful" for small use-cases, but too expensive for the ones it's really designed for. Anecdote, I once worked with a client that really wanted to get Splunk, but produced so much network traffic that the discounted annual costs were more than the entire budget for the rest of the organization combined. That's staff, the buildin…

Yeah, and there are so many OSS projects aimed at splunk type things now.

Splunk / Datadog have the classic user interface lead of a closed source solution, but IMO that premium's days are numbered.

Re: Cisco Acquires Splunk

#277

Post by baq »

dangus wrote: post #60
liveoneggs wrote: post #46

Earlier quoted context omitted.

they price-out medium customers so mind-share decreases

Are medium-sized customers valuable to Splunk? In sales we call this "Ideal Customer Profile." Why do I want a customer with less money to spend if I have a product with enough capability for the gigantic money-is-no-object customers?

That's why companies die in the long run.

Microsoft dominated the nineties especially and the naughts less so but still because the marginal price of their OS was zero - due to piracy. Yes they didn't like business to run unlicensed but if you were a customer, nobody cared, because in 5-10-20 years you'd be a paying business or would work for a paying business.

Splunk doesn't get that. There are no hobbyist/prosumer splunk installations. Zero. Nada. That's also how Linux won in the server space - nobody set up Windows servers as a hobby and 20 years later we're here.

IOW it's medium-term short-sightedness, if it makes sense. Tactically good, strategically so-so to bad, depending on your moat and momentum.

Re: Cisco Acquires Splunk

#278

Post by mikecoles »

pbreit wrote: post #275
bane wrote: post #108

To pile onto the Splunk "love" going on here. Splunk is one of those systems that's too "powerful" for small use-cases, but too expensive for the ones it's really designed for. Anecdote, I once worked with a client that really wanted to get Splunk, but produced so much network traffic that the discounted annual costs were more than the entire budget for the rest of the organization combined. That's staff, the buildin…

Is Splunk printing money like DataDog is? Any lower priced alternatives? Or self-hosted?

Graylog. It's amazing. Elastic also has an offering.

Re: Cisco Acquires Splunk

#280

Post by baz00 »

tekla wrote: post #257
anonzzzies wrote: post #250

Earlier quoted context omitted.

But, and this is not meant as criticism or insult as I have no idea how Splunk works, it is just based on other comments; do you know what license your company has with them? It appears that if you are paying them millions, it scales fine, otherwise, it does not?

> I have no idea how Splunk works Cool > It appears that if you are paying them millions, it scales fine yes, if you pay someone for product and services, you get them. If you don't, you don't

It's difficult to control data ingress so you end up in debt and on repayment plans. Which are expensive.
Post reply on HN