Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Splunk IP suit against Cribl

splunk.com

Post reply on HN
Print view View original

81–90 of 107 posts

Re: Splunk IP suit against Cribl

#81

Post by achillean »

_8j50 wrote: post #4

Splunk is the best at what it does with no close competition. I've been looking into Cribl and it seems their product has surpassed their competition as well but not in search, more in data summarization and log reduction, possibly before you ship it off to a more proper place like Splunk. Splunk's cost makes it inaccessible to most people or companies. I mean, I work in infosec and I highly caution against Splunk be…

There's also Gravwell (https://www.gravwell.io) that competes head-on with Splunk and doesn't punish you for storing/ indexing more data. I'm on their board and knew the founders before I joined so I'm a bit biased but it's basically what if you wrote Splunk from scratch using modern tech.

Re: Splunk IP suit against Cribl

#82

Post by mring33621 »

PanosJee wrote: post #63
keyle wrote: post #48

Earlier quoted context omitted.

Sounds like a good move... From their about page: Splunkers have received over 1,020 patents to date that tells me everything I need to know.

I am one of those people. There was a bonus for every patent granted. They were telling us that we need to big patent arsenal to fend off against IBM. It turned out that Splunk is IBM now.

I am against software patents and choose to ignore all pleadings from my employers regarding patent filings. IMO, the bonuses (~$1-2K) are not worth going against my views.

You could have made the same choice, but did not.

Re: Splunk IP suit against Cribl

#83

Post by [deleted] »

_8j50 wrote: post #4

Splunk is the best at what it does with no close competition. I've been looking into Cribl and it seems their product has surpassed their competition as well but not in search, more in data summarization and log reduction, possibly before you ship it off to a more proper place like Splunk. Splunk's cost makes it inaccessible to most people or companies. I mean, I work in infosec and I highly caution against Splunk be…

[deleted]

Re: Splunk IP suit against Cribl

#84

Post by bak3y »

kennend3 wrote: post #80
sandy_coyote wrote: post #78

Earlier quoted context omitted.

Yes BUT it needs tuning. Splunk is complicated and takes continuous maintenance to optimize speed. I work as a Splunk integrator and here's what I often see: 1. Customer installs Splunk with a qualified Splunk or third-party architect team. The deployment works well. 2. Customer adds infrastructure to the deployment. Splunk slows down. License costs go up. 3. Customer chooses between outside help or DIY. DIY rarely w…

So basically what you are saying is this. A firm with a competent IT team is unable to get splunk to work and only "outside help" can make the product work? Given splunks license costs are tied to data ingested, how do you integrate new infrastructure to the deployment and not have license costs go up? Way to sell us on Splunk?

Anecdotal - I took over a small, ill maintained Splunk installation at $JOB-2 and reworked it following Splunks current best-practices and it ran like a top as of when I left that place. Having done that process I'm fully convinced that if you're going to run Splunk on-prem you need a dedicated sysadmin for it that knows Splunk's stack. And that kind of person isn't cheap to hire or keep in that role.

Re: Splunk IP suit against Cribl

#86

Post by kennend3 »

bak3y wrote: post #84
kennend3 wrote: post #80

Earlier quoted context omitted.

So basically what you are saying is this. A firm with a competent IT team is unable to get splunk to work and only "outside help" can make the product work? Given splunks license costs are tied to data ingested, how do you integrate new infrastructure to the deployment and not have license costs go up? Way to sell us on Splunk?

Anecdotal - I took over a small, ill maintained Splunk installation at $JOB-2 and reworked it following Splunks current best-practices and it ran like a top as of when I left that place. Having done that process I'm fully convinced that if you're going to run Splunk on-prem you need a dedicated sysadmin for it that knows Splunk's stack. And that kind of person isn't cheap to hire or keep in that role.

we had an on-prem splunk implementation and it was SOO SLOW.. it was built/managed by splunk and its consultants.

We finally got rid of it a few years later, but for the entire time we had it, it was a constant "round hole square peg" problems. Each time the consultants assured us Splunk could do what we needed, each time it could not.

Re: Splunk IP suit against Cribl

#87

Post by david38 »

flounder3 wrote: post #16
ec109685 wrote: post #12

Earlier quoted context omitted.

What are you planning to move to?

Sounds crazy, but Datadog. I’ve been hammering their product teams for years with specific use cases for the sole purpose of replacing Splunk. They recently migrated search technologies and are rapidly closing the gap. Plus, their exclusion features are instant and fantastic, and their C-suite replies to me when I escalate. Elasticsearch simply couldn’t handle key collisions. We have hundreds of various apps across 5…

Sounds crazy indeed. I worked at Splunk for many years and was a DataDog customer later. The costs of either are not something I care to deal with.

Re: Splunk IP suit against Cribl

#88

Post by fillskills »

flounder3 wrote: post #16
ec109685 wrote: post #12

Earlier quoted context omitted.

What are you planning to move to?

Sounds crazy, but Datadog. I’ve been hammering their product teams for years with specific use cases for the sole purpose of replacing Splunk. They recently migrated search technologies and are rapidly closing the gap. Plus, their exclusion features are instant and fantastic, and their C-suite replies to me when I escalate. Elasticsearch simply couldn’t handle key collisions. We have hundreds of various apps across 5…

You might also want to review NewRelic. Their new plans allow for lots of data ingestion at low price including logs.

Re: Splunk IP suit against Cribl

#89

Post by jarym »

jollofricepeas wrote: post #19
ec109685 wrote: post #12

Earlier quoted context omitted.

What are you planning to move to?

Exactly. This is the question. If you’re looking for APM well you’ve got great options but for those using Splunk in the security space (SIEM & SOAR) you’re screwed. There’s no better SIEM alternative that deals with logs at scale. Splunk recently screwed a friends Fortune 50 company. They didn't pay a bill on time (renewal negotiations) and Splunk without even contacting them just left all the logs from one of their…

> They didn't pay a bill on time (renewal negotiations)

I don't side with Splunk on their actions but I can't stand customers who withhold payment as a renewal tactic and think that it's equally wrong.

Re: Splunk IP suit against Cribl

#90

Post by doorsopen »

ZephyrBlu wrote: post #62
doorsopen wrote: post #45

From the lawsuit looks like the most clear cut evidence they have is: - Founder publishing a private protocol definition to help in building for it - Sales staff sending account and prospect info to their new cribl email addresses before leaving Splunk - Engineers leaving Splunk with technical specifications, such as their newer S2S protocol versions The patent stuff is kind of whatever, but all three of those items…

Honest question, where is the line here? Obviously we all retain knowledge from previous jobs so what's the line between that and exactly copying a spec?

I think the line is drawn at actual stealing. In this case, they're not redesigning the protocol from memory or black box testing. Allegedly they took several specs of the protocol from former employees. Even then, apparently the founders were involved in some of the Patent filings from splunk that they are accused of violating. You cant claim IP for a company in the form of a patent and then turn around and re-implement that IP. You clearly believed it was patent-able since you patented it. There's ways of doing this (clean room dev) if you wanted to do that without infringement. (I do feel a lot of the patent claims in the lawsuit are typical generic weak software patents)

Really egregious is taking the sales data. Business analytics around leads, customer satisfaction, pricing, etc are not the same as retaining general knowledge. If you left and remember the point of contact you had at a customer, that's allowed (barring non-solicitation agreements). If you leave and you take a list of customers, data that the business has generated about them, etc, that was never yours and it's not your knowledge. It's clearly the business's and there's usually dozens of people involved in the creation. That's clearly theft, especially since it was never yours to begin with.

Post reply on HN