My Dive into using Splunk
December 01, 2017
My Dive into using Splunk
Score 8 out of 10
Vetted Review
Verified User
Overall Satisfaction with Splunk Enterprise
Splunk is being used across our whole organization. We try to have all/most of our logs get pulled into splunk to be able to use the splunk UI to search across information. We are able to give employees access to splunk and allow them to diagnose issues without giving them explicit access to production servers or other production locations.
- Allow for separation of control where we don't let some employees have access to production but still can diagnose issues.
- Common location to go for all logs even if the logs themselves aren't in the same place.
- Ability to ingest logs from different locations without having to change the code to put logs in a certain place (pro and con).
- At times some queries can run slowly if indices are not on a portion of the query you use.
- Setup time initially can be difficult if your logs aren't stored in common locations or in a common way to write the log.
- Ability to ingest logs from different locations without having to change code to put logs in a certain place (pro and con).
- Searches can be a bit more difficult to look through if your log isn't pulled in a manner that is easy to read through splunk.
- Splunk has allowed developers to diagnose production issues when access of control was taken away from them to be allowed to view items in production environments and I believe that is invaluable.
- At times some developers weren't super happy about using it, but it was more of the fact that they were used to having production access and not creating their splunk queries to get information.
- Going one place to view logs was very beneficial to have.
I didn't get to fully evaluate Logstash as our corporation was already using Logstash, but both seemed like viable solutions to the problem that we were having. I wanted to evaluate Logstash some more, both did seem like they would work for the business needs that we had, we went with splunk as many teams were already using it.