Sort through the junk with Splunk

By David Swan
Tuesday, 01 September 2009 09:55

Development

Splunk may have a weird sounding name, but don't be fooled. The software has hundreds of thousands of users, each a testament to its ease of use and the time it saves IT administrators, who used to spend many hours troubleshooting.

The name comes from the term spelunking, which in this case alludes to data mining. Splunk aims to cut  down time that would be spent  sorting through useless data, and allows a system administrator to search for keywords in any errors, trace the route of any problem in seconds, or even create custom apps for the software.

Splunk's customers include corporations such as Dreamworks, Myspace, EA and Vodafone among others. Splunk users in Australia include Telstra, Monash University, Ericsson and Alphawest.

Splunk allows a free download of the software from its website.

"With this model, you're a whole lot less about big enterprise sales and a whole lot more about consultative customer engagement, because they've already sampled your product to a pretty significant extent, through the free download, and they often have a lot of questions and we can answer them," co-founder and chief corporate and business development officer Michael Baum told iTWire.
Baum, who worked at Yahoo before co-founding Splunk, said IT departments are "currently spending roughly 70 cents of every dollar just maintaining their systems, and that leaves 30 cents to improve functionality and scale out their infrastructure. It's a pretty dismal equation.

"The idea is for Splunk to become the 'IT brain', the place where people are going not only to search raw data but to add their own knowledge as well."

Dan Yarrow, a system administrator at Queensland University, outlined some of Splunk's advantages: "We tried Cisco's Mars [Security Monitoring, Analysis and Response System], which took half an hour to perform a standard query, and that's pitiful. We ran the same query on Splunk and it took just a few seconds."

Yarrow continued, "during the pilot we had some operational issues which were solved within seconds, compared to without Splunk where we'd have to talk to the networking team, check firewall logs, etc. Everything's just a lot quicker and easier."

Splunk is available for free download  at  http://www.splunk.com.