Splunk - I love it!

veritas_libertas

How many others love using Splunk? Custom queries and Splunk Alerts is what I use it for mostly.

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

JeanM

Used at my old job, and have a free license that I use at home from time to time.

Do you have forwarders etc?

Cert Poor

I want some of this Splunk action. Is it just some awesome log file tool that can make sense out of logs from a million systems and sources?

wes allen

In the middle of a POC with Splunk and love it so far. Super powerful, but stays out of your way much better then the other SIEM's I have used. Plenty of really good documentation out there as well, which is also a change.

veritas_libertas

Powerful indeed and the apps (some of them you have to pay for) are great. You can pretty much "eat" anything that logs to a text file.

DevilWAH

Looked at Splunk but decided that it did not quite do what we needed with out a bit of work, I am not the monitor guy so wiped my hands of it. Very powerful, and used it at home a bit, but the monitor guy is going "trustwave" which is aimed more at security and deal with more stuff out of the box.

the_Grinch

One of our vendors uses it and from what I saw it seemed pretty good.

pitviper

I've used it for call reporting in a Cisco CM environment with some 3rd party add-ons - they we're pretty cheap compared to the alternatives.

PurpleIT

Cert Poor wrote: »

I want some of this Splunk action. Is it just some awesome log file tool that can make sense out of logs from a million systems and sources?

More or less - throw data at it and you will be able to quickly search and analyze it. It is really fairly simple especially given how powerful it is.

phoeneous wrote: »

I setup rsyslog and loganalyzer recently, good stuff. Never tried splunk, how far does the free license get you?

This is where they get ya - 500 MB/day of indexing. If you can stay below that limit you are golden, if you go over, get your checkbook out.

UnixGuy

Can you use it as a replacement for Nagios?

is it better at alerting?

lsud00d

UnixGuy wrote: »

Can you use it as a replacement for Nagios?

is it better at alerting?

No. At the core of it, Nagios does proactive checks and Splunk parses logs. You can attach actions to alerts in Splunk to do notifications but it is not an infrastructure monitoring solution like Nagios is.

pram

If you're looking for a free alternative to splunk check out Logstash with Elasticsearch.

Elasticsearch.org Logstash | Overview | Elasticsearch