31–40 of 107 posts
Earlier quoted context omitted.
Is Splunk fast now? Last time I used it was almost a decade ago and it was rubbish, queries took 10-40 minutes to complete.
No offence, but that sounds like lazy query design, poor architecture, or both.
Splunk, as a company, is a shell of its former self. All they care about is pimping themselves out to maximize profits to an extreme that only Dilbert can relate to, even at the expense of destroying a long term professional relationship over trivial matters. They are more than happy to kill a deal over a 5% disagreement rather than understand the needs of a Fortune 500 customer and negotiate. They are mad because Cr…
No comment about the company, but want to make clear as a buyer you understand the procurement and legal parts i.e. MFN or MFC. If they do discount, even 5%, then it ripples across their accounts as a legal matter, esp at your scale. I was a buyer for some big companies, 8 digit, and the procurement office would only do a deal with MFN/MFC clause. They would also audit the supplier from time to time.
Splunk, as a company, is a shell of its former self. All they care about is pimping themselves out to maximize profits to an extreme that only Dilbert can relate to, even at the expense of destroying a long term professional relationship over trivial matters. They are more than happy to kill a deal over a 5% disagreement rather than understand the needs of a Fortune 500 customer and negotiate. They are mad because Cr…
No comment about the company, but want to make clear as a buyer you understand the procurement and legal parts i.e. MFN or MFC. If they do discount, even 5%, then it ripples across their accounts as a legal matter, esp at your scale. I was a buyer for some big companies, 8 digit, and the procurement office would only do a deal with MFN/MFC clause. They would also audit the supplier from time to time.
Earlier quoted context omitted.
Is Splunk fast now? Last time I used it was almost a decade ago and it was rubbish, queries took 10-40 minutes to complete.
Very very fast, I can do an all time search on terabytes of data in seconds. But you have to learn to use it, if you don't give it an index and a sourcetype that will slow it down, and like ES leading wildcards slow things down. The fastest searches are simple terms like a word or an IP.
From the general responses it sounds like we got unlucky with a dud implementation.
Splunk is a great tool but expensive. I like splunk's aggregation feature very much. If it is server logs, it can aggregate and tell me how many http 500 errors I have, how many requests resulted in 404 etc. It can tell me top IP addresses where I am getting requests from, etc. I want to take a CSV file and provide same functionality. Eg. Give user information on how many times each field occurs. For example, if it i…
> Is there an open source version of splunk I can modify? https://github.com/grafana/loki might work for you. It’s not a drop in replacement for Splunk, FWIW.
Earlier quoted context omitted.
It has always been the Cadillac of search, and moreso with unstructured indexing (e.g. key collisions with different data structures. Foo = string vs foo = integer vs foo = array). Your queries or infrastructure were not optimized. It’s very fast when optimized.
Interesting, It was Splunk managed and configured, so I would have thought it optimized, but I guess they made more money from it not being optimized. If I remember right then we were throwing about 200+ GB at it a day.
Earlier quoted context omitted.
We recently transitioned to it at Notion and it’s been very fast, outperforming the previous log vendor substantially while offering better search and UX. If you used the on-prem version, the cloud version is quite a different experience.
I don't know which version we used, just that it was managed and configured by Splunk. We were only sending a small subset of our logs to it so about 200+ GB a day. Our Linux box with spinning disks could grep the full set of logs much faster than querying Splunk, so I don't think anyone really used it.
Earlier quoted context omitted.
40 minutes sounds exceptionally bad, but 5-10 minutes with splunk was totally common when I worked at Apple almost a decade ago, and I could never figure out why because I only ever used it for O(grep on a log file on disk) level operations. I was probably holding it wrong or maybe the infra team had misconfigured it, idk.
I personally brought Splunk to Apple in 2010 alongside a small handful of people (Hi, Sean and Ariel!). There is a massive difference between real-time searches where latency beyond a few seconds is unacceptable, and historical searches which can take a bit longer. I can assure you that it did its job spectacularly, much to my chagrin that there are few competitors to this day.
Earlier quoted context omitted.
Interesting, It was Splunk managed and configured, so I would have thought it optimized, but I guess they made more money from it not being optimized. If I remember right then we were throwing about 200+ GB at it a day.
Splunk worked with us to optimize our configs but we always managed it ourselves.