Splunk is fantastically expensive: What are the alternatives?

Posted by samsmith on Server Fault See other posts from Server Fault or by samsmith
Published on 2011-02-23T20:28:53Z Indexed on 2011/02/23 23:27 UTC
Read the original article Hit count: 287

Filed under:
|
|

This has been discussed, but it has been several months, so it may be time to revisit it:

Earlier discussion RE Splunk alternatives

For the record, Splunk rocks. But the pricing is simply beyond what we can consider (When I spoke with Splunk today, the cost for a system to index 5gb/day of data is over $30,000.)

That is more than we spend on SQL Server (by a large multiple), more than we spend on a rack of servers (by a multiple), etc. etc.

The splunk sales team is correct (that for $30K we get more value and functionality than if we spend the same building our own system), but it doesn't matter. The splunk cost is simply too high (by a multiple).

Soooooo, we are looking around!

Is anyone out there building a splunk like system?

Our basic need:

  • Able to listen for syslog messages on multiple udp ports
  • Able to index the incoming data in an async way
  • Some kind of search engine
  • Some kind of UI
  • An API to the search engine (to embed in our console)

We currently need to index 3-5gb/day, but need to be able to scale to 10gb/day or more. We do not need a lot of history (30 days is fine).

We use Windows 2008 and 2003 servers.

Thanks for your thoughts!

© Server Fault or respective owner

Related posts about filesystems

Related posts about syslog