undefined | Better HN

0 pointswenc5y ago0 comments

For an on-prem general purpose logging server, it's fast and easy to maintain. The query engine supports fairly complex queries. Did I mention it's fast? Plus it's an industry standard so it's an easier sell in the enterprise. It's also actually not that expensive at low data volumes -- prices are comparable to Sumologic.

Cheaper alternatives? You can roll your own logging server with fluentd and a database. Some folks will recommend elasticsearch, but we tried it and it was challenging to set up just right.

0 comments

9 comments · 4 top-level

mrweasel5y ago· 2 in thread

The minute you say “on-prem” a surprising number of sales people stop talking and just looks terrified.

Running and managing an ELK stack is just a hassle and a managing nightmare conpared to Splunk. Humio is a great alternative, if you need something cheaper, but you have to give up a lot of features.

user59944615y ago

I've managed a full elastic search + graylog cluster. It was very easy to setup and maintain. https://thehftguy.com/2016/09/12/250-gbday-of-logs-with-gray...

By far elasticsearch is the easiest distributed database to setup and scale.

haram_masala5y ago

Seconding this. If you want to do anything sophisticated in the ELK stack, you’ll eventually have to write some scripted indexes, and it’s a very bad joke how hard it is to do that.

gregimba5y ago· 2 in thread

At what scale is your on premise Splunk? As a member of a team maintaining very large on-prem Splunk service I haven't found maintaining Splunk to be an easy undertaking.

wencOP5y ago

1 server install of Splunk Enterprise. Less than 150mb a day ingest. We installed it over a year ago and haven’t touched it since, aside from updates.

user59944615y ago

A typical small deployment is more like 150 GB a day. No wonder you have no issues at that incredibly small scale.

1 more reply

raverbashing5y ago· 1 in thread

I feel Splunk is maybe quirky

It has lots of query processing operations, sure. But it can't do (at least not easily) some things you could do with bash/grep in "traditional" settings (example, get the context between lines that match a pattern)

CraigJPerry5y ago

The equiv of grep -Cx in splunk is just hit the show source link in an event.

Splunk has a more powerful feature though “| transaction“ - often in multithreaded logs i want the context but ignoring entries not from my thread. This feature does that

thayne5y ago

I love the power of splunks query engine, there really isn't anything comparable that I know of. But setting up forwarders and injesting logs is quite a pain.

j / k navigate · click thread line to collapse

0 comments

9 comments · 4 top-level

mrweasel5y ago· 2 in thread

The minute you say “on-prem” a surprising number of sales people stop talking and just looks terrified.

Running and managing an ELK stack is just a hassle and a managing nightmare conpared to Splunk. Humio is a great alternative, if you need something cheaper, but you have to give up a lot of features.

user59944615y ago

I've managed a full elastic search + graylog cluster. It was very easy to setup and maintain. https://thehftguy.com/2016/09/12/250-gbday-of-logs-with-gray...

By far elasticsearch is the easiest distributed database to setup and scale.

haram_masala5y ago

Seconding this. If you want to do anything sophisticated in the ELK stack, you’ll eventually have to write some scripted indexes, and it’s a very bad joke how hard it is to do that.

gregimba5y ago· 2 in thread

At what scale is your on premise Splunk? As a member of a team maintaining very large on-prem Splunk service I haven't found maintaining Splunk to be an easy undertaking.

wencOP5y ago

1 server install of Splunk Enterprise. Less than 150mb a day ingest. We installed it over a year ago and haven’t touched it since, aside from updates.

user59944615y ago

A typical small deployment is more like 150 GB a day. No wonder you have no issues at that incredibly small scale.

1 more reply

raverbashing5y ago· 1 in thread

I feel Splunk is maybe quirky

CraigJPerry5y ago

The equiv of grep -Cx in splunk is just hit the show source link in an event.

Splunk has a more powerful feature though “| transaction“ - often in multithreaded logs i want the context but ignoring entries not from my thread. This feature does that

thayne5y ago

I love the power of splunks query engine, there really isn't anything comparable that I know of. But setting up forwarders and injesting logs is quite a pain.

j / k navigate · click thread line to collapse