Apache Flume vs Splunk Enterprise

• Multiple sources of data (sources) and destinations (sinks) that allows you to move data form and to any relevant data storage
• It is very easy to setup and run
• Very open to personalization, you can create filters, enrichment, new sources and destinations

Read full review

• It gathers logs very well from almost all machine types - most SIEM related products don't do this quite as well.
• It provides visuals to the user, giving you the ability to transform logs into visual charts (e.g. pie charts, graphs, tables, etc.).
• Splunk is very quick in reporting and alerting on anomalies. There is little delay.

Read full review

• Apache Flume develops new functionality at a slower pace than other OpenSource projects, it is well behing Kafka and has some compatibiliy issues with latest releases
• It lack HA or FT, it relies on third party management software like Hortonworks or Cloudera

Read full review

• Splunk's search language goes very deep. To do some of the more advanced formatting or statistical analysis, there's a bit of a learning curve. Splunk training for learning the search language and manipulating your data can cost anywhere from $500.00 to $1500.00 (although a good number of free training exists).
• Splunk's dashboard capabilities are pretty decent but to do more exciting visualizations requires a bit of development using simple XML, Java script, and CSS.
• Splunk releases minor revisions very quickly but because of the sheer number of bugs we've run into, we've upgraded our environment four times in nine months.

Read full review

• Flume has simplified a lot many of our ingest procedures, easier to deploy and integrate than a classical EAI, reducing the time to market
• But opposed to EAIs if the project starts to grow in complexity Apache Flume project may not be as suitable

Read full review

• Increased efficiency in the NOC.
• Reduction on app/dev lifecycles
• Reduction on MTTR on most outage scenarios

Read full review