Hacker News Reader

Comment by wittekm | Hacker News Reader

Genuinely surprised anybody would acquire Splunk in 2023. Whenever you hear about Splunk from security engineers, they're actively trying to get off it (edit: yes, primarily because of cost). Better, next-gen SIEMs are either here or around the corner.

View on HN

Splunk is a great product with horrible sales and business team.

The reason why them _trying_ to get off it is because they have a bunch of stuff that is easy and works in splunk, but don't want to pay the exorbitant licensing, or pay even more to increase their use.

But getting off a good product is hard, and they will continue to use it and even pay.

The kind of thing Cisco, Oracle, and IBM love are companies with very expensive products in which no development needs to happen and customers cannot move away easily.

> with horrible sales and business team

I was in one of these meetings with like 20 engineers on how amazing this thing was. We knew that because we already used it it quite extensively. The very extremely hyper sales rep kept ducking out of the meeting every 5 mins. I recognized it for what it was. He was ducking out to do bumps of coke so he could be more pumped to sell us more stuff.

I think we had the same sales rep.

jesus, that's incredible

Yikes. The only other time I heard about the Splunk sales team in the news, it sounded pretty bad also.

https://www.theregister.com/2020/08/12/splunk_sales_discrimi...

Yeah it's easier getting rid of chlamydia than Splunk sales reps.

Chlamydia is actually quite easy to get rid of.

I was at a shop that got heavily integrated into Splunk for security use cases and then entered a split brain mode of 'well if you need observability we already have Splunk' but also 'hey stop doing so much observability, this thing is expensive!'.

So for 5 years time we used it for observability, we were only half-integrated and also trying to get off of it. Great stuff.

Pretty sure every Splunk customer has that split brain. This thing's great, what can we quit sending to it?

Worked on a piece of software which suffered from years of this split brain. It had some logging and some metrics, but the team was told to be economical about observability. This resulted in the software having many blind spots which led to production issues that had to be manually reproduced. When I become responsible for the software I personally overhauled the logging and the team had to work together to rebuild the metrics functionality.

this is an area that gets very political with architects, managers and other non-coders having too much of a say

a lot of paralysis on the app dev side as the status quo is easier than fighting for a sensible outcome

its also something that yes, benefits stakeholders... but only on a 2nd/3rd order effect of outage avoidance & remediation.. so theres not a huge reward for doing it really really well in many shops

I haven't heard a single person trying to get off of it because "there are better SIEMs" - they're universally looking at other options because of the price.

Cisco has the luxury of bundle and save that Splunk does not.

former firepower customer... I guess we'll see.

I can see them shipping a really cool-looking whitepaper detailing FTD, Amp, and Splunk... but actually operating it will feel similar to driving a 20 yr old salt state jeep wrangler on the autobahn.

Oh god those firepowers we bought were so bad. The controller webpage needed to control our pair needed something like 32GB of ram just to load.

Using fortigates now, far happier with them.

But it's not just the firewall level, they were so bad it made us reevaluate our core switches and I don't think we've bought a cisco switch for at least 2 years.

I think they’re trying to get off of it because it is so freaking expensive.

I used Splunk at a previous job and that’s one of my few/only complaints with it. Great tool but extremely expensive for what you get. Datadog is the same way as well as Pagerduty. There’s not enough competition in these spaces

Why is pagerduty hard to switch off of? It has all kinds of useless and expensive bells and whistles, while the core functionality is a commodity that several companies offer.

We moved vendors a few time and it wasn’t that painful.

Who else will call a POTS phone line when there's an alert?

Fact: I'm not going to hear my phone ping in the middle of the night. I'm much more likely to hear my phone ring.

Depending on the team, a phone tree in twilio could do the trick, with calls made down the list if people do not pick up for escalation.

What happens when Twilio is down? Same questions for your email, sms and server. Part of the difficulty is guaranteed uptime and PagerDuty is rock solid in that regards.

Pager Duty uses Twilio.

NodePing

Calling landline is table stakes for all “paging as a service” companies.

Hmm, are you referring to their Observability product or SIEM capabilities? There's a wild amount of competition in the Observability side of things, but SIEM not so much.

That's super true of PagerDuty. It's a pretty good product and cheap when you only have a few people on it. However, the jump from the basic license to the next tier is HUGE and any add-ons you might need (ie. webhook triggers) bump the price up even more. Just having a simple monitoring solution with >10 people could cost you $100's a month.

That said, every other product in this space is crap. I'm not sure why though. This seems like a pretty good market for disruption. Maybe there is some hidden "problem" that I don't know about.

what's your take on xMatters?

My take on xmatters is that it gives you some building blocks to build a decent paging system, and has a fair amount of flexibility, but many things that work out of the box, or with a little bit of configuration in PagerDuty require a non-trivial amount of work in xmatters to set up. And you will likely run into limitations.

PagerDuty is extremely expensive and I decided to disrupt the market a little bit by creating All Quiet: You might want to check it out: https://allquiet.app

I'd love to know what the security engineers you are talking to recommend because Splunk ES/SOAR are top notch products - even with the cost (which is insane).

Which ones do you recommend? Every one I have tried hasn't really given me the same flexibility as Splunk, most seem to miss the core part of what makes Splunk cool. Though I'd definitely like to see Splunk improve their design.

He's talking out of his ass. But newish competitors are Devo/Sumo Logic.

Not sure how well "new" fits Sumo Logic. I was using them ten years ago, I think?

Humio is also promising, however they've been acquired by CrowdStrike, who aren't know for low prices!

SumoLogic is also not cheap.

Graylog looks like a good competitor. Certainly won't scale as well, but I've had good experience with it.

The thing that will totally replace splunk (and elastic and snowflake and likely several other whole ecosystems) is some random thing pouring data into clickhouse.

I am nervous about how clickhouse is going to monetize, whenever they decide to turn on the revenue spigot.

I hate to shill in this thread, but that's exactly what we built at runreveal, so I completely agree! We saw the power of clickhouse when we were at segment and cloudflare, so built a company around it.

And since clickhouse is open source, we hope that people will stop giving their security data to vendors who then charge you rent for it. I think the future is writing this data to clickhouse, but also our customer's clickhouses

I used to love Graylog, but I was evaluated it for use with AWS and a) it's AWS bits seem limited and b) I found a bunch of deadlinks from their github to their site. If they can't keep their docs updated, it doesn't give me warm fuzzies about their product.

Microsoft is doing a surprisingly good job with their Sentinel SIEM. The sweetener is they give you free ingestion on most of your Office 365/Azure logs which can add up if you’re shipping out to another platform.

Makes it attractive for enterprises already on their platform and they throw in discounts for E5 license tier customers as well (gotta keep pushing the “give us everything or pay way more for single feature licenses”).

There are some players that are more established than others but check out:

https://panther.com - Built on top of Snowflake, so it scales well and they are building a more Splunk like interface.

https://runreveal.com - Still seed but shows a lot of promise

https://matando.dev - Still seed and don't have a hosted product yet but smart founders that have the right idea

https://hunters.ai - More threat hunting than SIEM but maybe that what certain folks need

https://gem.security - Still fairly early but if you are focused on cloud use cases this could be more of an option. (Disclaimer: I'm an Investor)

Founder of runreveal here, if anyone is interested let me know. The news today was big, but not necessarily too surprising.

> The news today was big, but not necessarily too surprising.

So was it you then with that one day call options trade? /s

I would add https://blumira.com to that list; it's more mature than at least a few of these (I'm a former employee)

sorry thats https://matano.dev

If you're looking for something that can handle unstructured data and has a similar query syntax to Splunk then Gravwell (https://www.gravwell.io) might be a fit.

Hey, founder of Tenzir [1] here — We are building an open-core pipeline-first engine that can massively reduce Splunk costs. Even though we go to market "mid stream" we have a few users that use us as light-weight SIEM (or more accurately, just plain log management).

We are still in early access but you can browse through our docs or swing by our Discord.

[1] https://tenzir.com | https://github.com/tenzir/tenzir

Sounds exactly like the kind of Enterprise software Cisco wants.... At that pricepoint they don't really care what the security engineers want, they sell to higher level folks.

Its a great fit for Cisco

They want so hard to be a software company, and they already have experience with highly inflated priced products.

Their real target is probably trying to offer this built in to meraki like products as a one stop shop. I could see them finally burning their monitoring product in a fire and replacing it with splunk and grafana then selling it as an all cloud solution. At least the intent, we know Cisco's track record for integrating acquisitions.

here (just made it around the corner): https://runreveal.com/

So Splunk is too expensive and there are better products and people keep paying. This doesn't really add up.

Inertia can be a strong force in organizations. In good times and without external pressures, it can be easier to keep the status quo.

Reply on news.ycombinator.com