Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cisco Acquires Splunk

splunk.com

Post reply on HN
Print view View original

441–450 of 525 posts

Re: Cisco Acquires Splunk

#441

Post by arcticbull »

mmahemoff wrote: post #439
smilbandit wrote: post #389

Earlier quoted context omitted.

My depth of stock trading stops at the buy low sell high level. Can someone explain a little more if you have time? What would have happened to those trades if splunk had went down 20%?

They bought $127 call options (the right to buy Splunk at $127) while Splunk was valued at $119 and the options were due to expire in one day. That's a cheap option to buy, given the improbability of a sudden jump like that. The only way the buyer could make a profit would be for Splunk to go higher than $127 and if it went significantly higher, they'd stand to make an eye-watering return-on-investment multiple in on…

> the right to sell Splunk at $127

Calls are the right to buy at $127 - the shares received can then be sold at market price.

Puts are the right to sell at $127 - the short position can then be closed by buying at market price.

Re: Cisco Acquires Splunk

#442

Post by jamiek88 »

frankchn wrote: post #249
andrewflnr wrote: post #148

Earlier quoted context omitted.

Mindshare is valuable, was the point GP was making. If midsize customers ignore you because you're too expensive, and then implement something else before they get big enough to afford you, where do you get new customers? Forget growth, how do you replace attrition as your existing customers die? Personally I can't say if that's actually happening with Splunk, but it's a very plausible scenario.

> Mindshare is valuable, was the point GP was making. If midsize customers ignore you because you're too expensive, and then implement something else before they get big enough to afford you, where do you get new customers? Forget growth, how do you replace attrition as your existing customers die? Somehow companies manage to make it work extracting money from your existing money-is-no-object customers. Oracle and IB…

Yes but Oracle and IBM have much mind share amongst executives and all these mega corps are top down.

We would routinely switch vendors and it would be an fyi to the end users if that.

It’s one of the reasons myself and huge corps don’t mix!

Re: Cisco Acquires Splunk

#443

Post by nervlord »

illiac786 wrote: post #287
selectodude wrote: post #193

Earlier quoted context omitted.

There are ~4bn Cisco shares outstanding. CSCO is down $2. So the market thinks that Cisco is overpaying by $8bn, or a 33 percent premium. Seems pretty bang on to me. Score one for the efficient market hypothesis.

“the market thinks” is an expression that makes me cringe. The market does not think, it’s the result of multiple actions, which many many people pretend they can explain or even predict when really they cannot. "the market thinks” gives the stock trade market an aura of reason and intelligence which it absolutely does not deserve for many historical reasons. Trading as it exists today is unhinged capitalism, it’s a…

Couldn't you say the same thing about evolution?

Re: Cisco Acquires Splunk

#444

Post by cliffcrosland »

g9yuayon wrote: post #255
bane wrote: post #108

To pile onto the Splunk "love" going on here. Splunk is one of those systems that's too "powerful" for small use-cases, but too expensive for the ones it's really designed for. Anecdote, I once worked with a client that really wanted to get Splunk, but produced so much network traffic that the discounted annual costs were more than the entire budget for the rest of the organization combined. That's staff, the buildin…

My experience back in Netflix too. Elasticsearch (we didn't use the L or K) plus query engine on S3 with a catalog was more versatile and way cheaper than Splunk. Nowadays we get a slew of performant OLAP storages that can be used for log analysis as well, which further render Splunk unnecessary.

Agreed. Costs plummet when you use S3 as the storage medium for these massive log data sets. I think S3 is much faster to query than most people realize. Just have to be smart about how you organize things.

Re: Cisco Acquires Splunk

#445

Post by vdqtp3 »

hermanradtke wrote: post #155
mschuster91 wrote: post #140

Earlier quoted context omitted.

> And while you're doing that, smaller competitors slowly creep up, eating up the bottom of you market, until you're stuck in a niche. So what, milking mega enterprise for ossified products is a decently profitable niche. IBM, SAP, that huge American company powering a lot of hospital IT, Cisco itself...

> that huge American company powering a lot of hospital IT Epic

Cerner? BD? McKesson? AllScripts?

There's a few contenders for sure.

Re: Cisco Acquires Splunk

#446

Post by cliffcrosland »

debarshri wrote: post #94

Building splunk has become very democratised in today's day and age. Back in the day, logging, metrics, event collection etc. was a hard problem that they solved. Esp. when there weren't any simple distributed storage operators. They have been a cockroach in the orgs, surviving every downturn. As a dev, you might hate it, CISO and CIOs love it. Orgs, often mandate it. The way they dominated the market is via creating…

How do you think Splunk will fare as more companies move to public clouds? Seems unbeatable on-prem, which probably means that the company is a good match for Cisco.

Re: Cisco Acquires Splunk

#447

Post by achillean »

aeonik wrote: post #9
wittekm wrote: post #4

Genuinely surprised anybody would acquire Splunk in 2023. Whenever you hear about Splunk from security engineers, they're actively trying to get off it (edit: yes, primarily because of cost). Better, next-gen SIEMs are either here or around the corner.

Which ones do you recommend? Every one I have tried hasn't really given me the same flexibility as Splunk, most seem to miss the core part of what makes Splunk cool. Though I'd definitely like to see Splunk improve their design.

If you're looking for something that can handle unstructured data and has a similar query syntax to Splunk then Gravwell (https://www.gravwell.io) might be a fit.

Re: Cisco Acquires Splunk

#448

Post by achillean »

pbreit wrote: post #275
bane wrote: post #108

To pile onto the Splunk "love" going on here. Splunk is one of those systems that's too "powerful" for small use-cases, but too expensive for the ones it's really designed for. Anecdote, I once worked with a client that really wanted to get Splunk, but produced so much network traffic that the discounted annual costs were more than the entire budget for the rest of the organization combined. That's staff, the buildin…

Is Splunk printing money like DataDog is? Any lower priced alternatives? Or self-hosted?

Gravwell (https://www.gravwell.io) has a community edition that's free to use and runs locally.

Re: Cisco Acquires Splunk

#449

Post by [deleted] »

Aeolun wrote: post #264
nostrebored wrote: post #227

Earlier quoted context omitted.

I've worked at companies with objectively large amounts of data. Splunk scaled to meet their workloads. At no enterprise doing this is someone able to just isolate a single log file and grep through it at scale.

Presumably you can have a cluster of grepping machines. I wonder how it scales compared to the millions you pay for Splunk.

[deleted]

Re: Cisco Acquires Splunk

#450

Post by cliffcrosland »

avrionov wrote: post #195

I wonder if this segment is ready for disruption. Splunk is very expensive, ElasticSearch is still lacking many of the features of Splunk and when hosted on AWS is very expensive. SumoLogic was acquired by private equity, which means that it won't get cheaper. DataDog is also very expensive. Solution like SnowFlake for logs / telemetry where compute and storage are separated might be the future.

We’re also giving this a shot. The annual Splunk bill at our last startup exploded from $10k to $1M when we reached 1TB of logs generated per day, which is actually an easy threshold to hit when you have decent traction and aren’t proactively reducing logs. So we built Scanner.dev to drop these costs by 10x.

Decoupling compute and storage is definitely the way to go. We’re using Lambda functions and ECS Fargate containers for compute that scales up and down rapidly, and S3 for storage. Getting ~1TB/sec log scan speeds, which feels fairly good. We keep sparse indices in S3 to narrow down regions of logs to scan. Eg. if you’re searching for an IP address that appears 10 times in a 25TB log set, the indices reduce the search space to around 300MB. Takes a few seconds to complete that query, whereas Athena and CloudWatch take like 20 minutes.

We’re also using Rust to maximize memory efficiency and speed - there are lots of great SIMD optimized string search and regex libraries on crates.io.

We’re early, so there are a lot of SIEM features like detection rules that we are still building. But Splunk/DataDog users might find it useful if costs are a problem and they use mostly log search:

https://scanner.dev

Post reply on HN