Good Product; will not say the best
What do you like best about the product?
migrated to splunk within the last year from an internal inbuilt tool (don't know who made the decision to switch because i personally loved the internal one). It is definitely simple to use and a great way to look for logs for any production issues. The mobile support is a great way to keep up. Lets you customize the search strings that you specifically need and if you are developer, its a great way to pin-point to the exact trace.
What do you dislike about the product?
Quite Expensive; would prefer to have more customization especially with regard to date format. Need better dashboard facilities that can provide diverse reporting/analytics. Learning curve.
What problems is the product solving and how is that benefiting you?
centralizing the logging to one tool; we wanted something that can combine our website as well as mobile apps logging.
Recommendations to others considering the product:
check if its the right tool by using the trial version because its expensive to get; but has a lot of cool stuff that you could do with logs. Definitely a tool every dev/ops guys want
My experience with splunk
What do you like best about the product?
It is quite fast, programmable with python easy to use. It takes only 40 50 min to draw really complicated graphs with it
What do you dislike about the product?
IT is quite expensive comparing with elk stack and their business model is really weak. The second most important think is that they do not have data tables to represent information filter by fields etc.
What problems is the product solving and how is that benefiting you?
we are trying to collect all logs and alert teams with them depending on the rule we wrote.
Splunk is the de facto leader
What do you like best about the product?
* search bar and query language
* integrations / add ons
* source code access to splunk enterprise
* source code access to any splunk app
What do you dislike about the product?
* no real good support or process for app development and publishing
* app development is kind of weird and difficult
* really hard to debug configs and/or searches
* splunk doesn't have a solid identity anymore
* overly sales-heavy organisation; hard to find someone to actually help you
* documentation is written in a vacuum mostly, especially in respect to how to run / size it
* big learning curve for users slows adoption
* crap 2FA / SAML / enterprise auth support
* no publicly visible bug or feature request database
What problems is the product solving and how is that benefiting you?
* great flexibility in investigations
* decent return on investment
Recommendations to others considering the product:
come with an open mind, and open pockets
Good but not ready for Production
I liked the fact that there was a splunk AMI and you can spin up splunk really fast. I was able to build an instance and be up in a matter of minutes. The issues I have with the AMI is that there is currently no support for the new C4 instances. I wanted to build a beefy splunk server with the latest CPUs since searches are CPU heavy and I'm not able to do that now. I also noticed that the AMI does not address disabling Transparent Huge Pages which splunk recommends. This can cause a 30% performance degradation. http://docs.splunk.com/Documentation/Splunk/6.2.3/ReleaseNotes/SplunkandTHP
So, because I couldn't use the instance I wanted, I can't really use this AMI for my needs. I can use it for testing no problem though. The THP issues is not that big because you can disable it easy enough but if splunk is touting this AMI as a recommended configuration I would like to see the THP addressed since it causes performance issues.
