My experience is solely at work where we use Splunk Cloud and it's slow as molasses.
Does the speed matter? How exactly?
I am genuinely curious: at Scalyr we _can_ be very fast but it is a balance with the cost that we want to pass on as price savings. Same with self-hosted Elastic: one can fine-tune it to be fast but minding the cost constraints gets it slower. WDYT?
Same experience. Also splunk forwarders appear to be universally unreliable.
Re:Build versus Buy
by sethammons on Monday April 13, 2020 @07:05PM
(#22861144)
we have extra monitoring for splunk forwarders, and even then we fail to notice them fail from time to time. Sigh.....
Yes same here. I actually monitor the throughput of the network interfaces on our forwarder with prometheus/statsd_exporter and if outbound is smaller than inbound it sets off alerts!
In the early days Splunk pricing was exorbitant (we evaluated Splunk 7 years ago and dismissed it), but licensing has changed in recent years and it is now priced by volume ingested (the pricing is transparent and listed on their website now). At low volumes, the pricing is similar to Sumologic, and is pretty accessible now to smaller dev shops. Open-source collectors like fluentd also help to intelligently reduce the ingest volume.
At high volumes, the TCO changes quite a bit.