11 ms·

Wow - I guess I'm both surprised and completely unsurprised. Surprised because Splunk is a pretty big pill to swallow. Unsurprised because they've obviously b

• bugsense 3y ago
  Splunk is a dead player too. It's a great match.
  • akulbe 3y ago
    What makes you say Splunk is a dead player? Not arguing with you, it's genuine curiosity on my part.
    • liveoneggs 3y ago
      they price-out medium customers so mind-share decreases
      • dangus 3y ago
        Are medium-sized customers valuable to Splunk? In sales we call this "Ideal Customer Profile." Why do I want a customer with less money to spend if I have a product with enough capability for the gigantic money-is-no-object customers?
        • tyingq 3y ago
          I believe the idea is that the big customers are interested because everyone is raving about it. If you price out the smaller customers, there's nobody to rave about it. Consider, for example, that Akamai's revenues are sitting in a plateau over the last 5 years, while Cloudflare is moving up.
          • alephnerd 3y ago
            > I believe the idea is that the big customers are interested because everyone is raving about it. If you price out the smaller customers, there's nobody to rave about it. That's not how enterprise procurement works, which is what makes the big bucks for companies like Akamai and Splunk. Cloudflare traditionally targeted mid-market and is in the process of building out an upper market/enterprise motion (I worked with the guy they hired to lead that in a previous role). I can dig deeper into ICP, Market Segmentation, and Enterprise sales if interested. There is too much FUD on HN
            • mardifoufs 3y ago
              I am super interested! Enterprise is like a rabbit hole to me
            • tyingq 3y ago
              How is what I said "FUD"? I know what it stands for. I don't see where I went with any of those three themes. Akamai has certainly done well over their lifetime, but their revenue for the last 5 years is very flat. That's not "FUD".
              • alephnerd 3y ago
                That wasn't aimed at you. I meant the general discourse of Enterprise Sales and GTM on HN is filled with FUD
                • hexo 3y ago
                  Probably deserved. GTM is what, google tag manager?
                  • tyingq 3y ago
                    I imagine "go to market".
          • nemo 3y ago
        • xwolfi 3y ago
          I work in a 100+ year old giga bank, systemic in the country it comes from, in their Hong Kong investment bank branch. We loved Splunk, we invested quite a bit in it both for technical monitoring and business intelligence. After a while the price went so high we cut it all, moved to kdb/tableau/elk/whatever crappier system that cost less. Money is ALWAYS an object and Splunk makes sure to dig a hole deep enough for even the deepest pockets. I too prefer my shareholders to collect the fruit of my labor rather than... Splunk. At least they can reinvest some profit in us. Not Splunk, nope, they keep digging that hole in our pockets.
          • cityofdelusion 3y ago
            Spot on. I also work in a 100+ year old gigantic corporation with big money and we are also moving off Splunk due to rising costs. Enterprise customers do not just pay whatever the sales folks ask for. Splunk is dead growth wise if they don’t fix their pricing.
          • singingfish 3y ago
            We moved a business from splunk to ELK a couple of years ago. The actual work of doing so took less than a day. The maintenance processes changed, and some things are not as good. But aside from the beefy machine we run ELK on it costs next to nothing, and is very reliable.
        • moneywoes 3y ago
          do they not want to onboard these customers and then grow with them
        • andrewflnr 3y ago
          Mindshare is valuable, was the point GP was making. If midsize customers ignore you because you're too expensive, and then implement something else before they get big enough to afford you, where do you get new customers? Forget growth, how do you replace attrition as your existing customers die? Personally I can't say if that's actually happening with Splunk, but it's a very plausible scenario.
          • frankchn 3y ago
            > Mindshare is valuable, was the point GP was making. If midsize customers ignore you because you're too expensive, and then implement something else before they get big enough to afford you, where do you get new customers? Forget growth, how do you replace attrition as your existing customers die? Somehow companies manage to make it work extracting money from your existing money-is-no-object customers. Oracle and IBM have basically zero mind-share amongst HN reading folks, but yet there they are.
            • jamiek88 3y ago
              Yes but Oracle and IBM have much mind share amongst executives and all these mega corps are top down. We would routinely switch vendors and it would be an fyi to the end users if that. It’s one of the reasons myself and huge corps don’t mix!
          • bvirb 3y ago
            I've recently dealt with multiple companies who started using IBM Aspera (which as a vendor to them means we have to use it too) only for it to work miserably. I've also seen a couple tiny, perfectly functional MySQL databases replaced by expensive, slower Oracle databases with much higher maintenance costs. I think once a customer with a big enough budget is recognized by sales at one of these big organizations they make the sale happen. They talk to the higher-ups and either make them happy, or feed them a lot of FUD (or both), and then they're in, regardless of what the people working with the products (many of whom might be external vendors or consultants!) think. They're basically focused on more traditional sales & marketing instead of more grassroots sales & marketing (mindshare), but at least in my experience they definitely still get new customers.
        • baq 3y ago
          That's why companies die in the long run. Microsoft dominated the nineties especially and the naughts less so but still because the marginal price of their OS was zero - due to piracy. Yes they didn't like business to run unlicensed but if you were a customer, nobody cared, because in 5-10-20 years you'd be a paying business or would work for a paying business. Splunk doesn't get that. There are no hobbyist/prosumer splunk installations. Zero. Nada. That's also how Linux won in the server space - nobody set up Windows servers as a hobby and 20 years later we're here. IOW it's medium-term short-sightedness, if it makes sense. Tactically good, strategically so-so to bad, depending on your moat and momentum.
          • bigstrat2003 3y ago
            > Splunk doesn't get that. There are no hobbyist/prosumer splunk installations. Zero. Nada. Not true. I ran a free (legit!) Splunk instance in my homelab for years. It's been several years since I shut the homelab down, so I couldn't tell you if they still have hobbyist licensing, but they certainly had it in the past.
            • baq 3y ago
              I’ll call you an unicorn :) I know they have a free license for super small deployments but haven’t heard of anyone actually using it.
              • yetanotherloss 3y ago
                It was at one point usable but they drove off the hobbyist/small business crowd a long time ago. We do some work setting up elasticsearch tools that aggregate and filter data later sent to central splunk purely to affect a large reduction in license costs.
                • optimalquiet 3y ago
                  A question: where did the hobbyist/small business crowd go?
        • manicennui 3y ago
          I doubt that the parent has any idea what "medium-sized" means. A few million in revenue is not medium sized.
          • liveoneggs 3y ago
            I mean 50 - 500 person companies
        • adrr 3y ago
          Because those medium-sized customer become large customers and getting more people to use your product builds up skill set in people. Switching cost is very expensive. This is why we'll probably see DataDog and Newrelic dominate the logging space because of their no contract plans that you can scale up to negotiated rates when you become larger. Even getting a POC of splunk is expensive and sales team will push for a contract. What splunk has going for it now is that they have lot invested in compliance and security but its only matter of time before other providers start offering the same. Only use case i would consider them for is a SIEM. Datadog logging is so cheap and works and gives me more money to spend on other things.
      • pantulis 3y ago
        It's better -because it's easier to scale- to sell a single 1M$ license than selling a thousand 1000$ licenses.
        • toomuchtodo 3y ago
          More efficient considering the typically long and drawn out enterprise sales cycle efforts as well.
        • makeitdouble 3y ago
          That's fine as long as your product stays competitive. But as you lose the smaller and middle-range customers, you're also missing on the trends of the market, while getting shaken up by the big players you can't afford to say no to. If one of your whales needs feature Y, no matter how exotic you think it could be, you'll have to implement Y, bloating your product for the rest of your clients. And while you're doing that, smaller competitors slowly creep up, eating up the bottom of you market, until you're stuck in a niche.
          • mschuster91 3y ago
            > And while you're doing that, smaller competitors slowly creep up, eating up the bottom of you market, until you're stuck in a niche. So what, milking mega enterprise for ossified products is a decently profitable niche. IBM, SAP, that huge American company powering a lot of hospital IT, Cisco itself...
            • hermanradtke 3y ago
              > that huge American company powering a lot of hospital IT Epic
              • vdqtp3 3y ago
                Cerner? BD? McKesson? AllScripts? There's a few contenders for sure.
            • 3y ago
      • manicennui 3y ago
        Their revenue is increasing and their losses are decreasing. They are fairly close to profitability. This is just nonsense.
        • liveoneggs 3y ago
          idk it's just my anecdote
        • ckdarby 3y ago
          They're profitable now with Cisco acquiring them. They'll trim the company by at least 20% through restructuring either out or to other places of Cisco. They'll pick up another 10-20% capex/open/cogs on private pricing that Cisco gets. Great M&A if Cisco manages to maintain Splunk's customer base. I look at Splunk as the Oracle DB of the world now, does anything a giant enterprise can imagine, but is old and costs a leg & arm.
      • ransom1538 3y ago
        I have never. Once. worked somewhere that could afford splunk. But I have used it on trail many times, very cool.
    • markstos 3y ago
      Splunk bought VictorOps and the product has been stagnant or even worse since then. PagerDuty is significantly better for about the same price and demonstrates ways in which the product could have kept improving.
    • pbjtime 3y ago
      The software seems very lazy. The interface belongs in the 90s. They've been resting on their laurels for eons. The fuckin basic ass PowerShell IDE that comes with windows is about seventeen trillion times more well designed and user-friendly.
      • everdrive 3y ago
        >The interface belongs in the 90s Maybe this is why I actually like Splunk. Everything is simple an intuitive. Modern UIs seem to be universally terrible.
      • threeseed 3y ago
        The companies that buy Splunk don't care about its interface. They care about its capabilities and its on a different level than Datadog, Elastic etc
      • cliffcrosland 3y ago
        Yeah I think this is where Datadog excelled and Splunk struggled. Design is clearly better at Datadog, especially the onboarding UX and workflow.
      • kortilla 3y ago
        > The interface belongs in the 90s That’s… a compliment? There have been very few positive interface developments in the last 2 decades for power users. If you want to rip out 95% of the functionality and 99% of the usefulness so morons with iPads can navigate it, then it probably needs adjustments.
        • KptMarchewa 3y ago
          Think US airlines UI rather than good examples of 90s design.
  • Covzire 3y ago
    This might be why Cisco bought them: OMB Memorandum M-21-31[0], “Improving the Federal Government's Investigative and Remediation Capabilities Related to Cybersecurity Incidents” which includes directives to ensure event logging goes well beyond the current norms. By all accounts I've heard it's going to enrich the fortunes of every single SIEM/Log aggregation company out there, pretty much every govt contractor is going to need larger licenses in the next few years as contracts get rewritten with this EO in mind. [0] https://www.fedramp.gov/2023-07-14-fedramp-guidance-for-m-21-31-and-m-22-09/ https://www.fedramp.gov/2023-07-14-fedramp-guidance-for-m-21...
    • alephnerd 3y ago
      Partially, but Splunk has been on the market for sometime actually. Also, large companies that compete with Cisco like CRWD, PAN, etc have been building out SIEM capabilities, as has Cisco, though Cisco being Cisco it didn't get the attention needed.
  • jitl 3y ago
    We [Notion] switched to Splunk Cloud a year or so ago, and it's vastly better than the other logging systems we've used. Much, much better than Kibana/Elasticsearch. We don't need to worry about indexed property limits anymore, yay. I'm a happy user.
    • notsureanymor99 3y ago
      Same for us [Obsidian Sync] although we've not had to worry about property limits, yet - although seems like we won't have to either. For us it was having a lot of in house experience with splunk already that gave us a reason to consider and in the end settle on it.
  • sethammons 3y ago
    Splunk is hands down the best log analysis tooling I've used. If not for the hefty price tag, I'd use it for my personal stuff and every workplace I've been. Structured logs and Splunk are the stuff dreams are made of if you care about monitoring the quality of software. The logs into metrics abilities along with the ability to unlock finding relationships in data is amazing. Mouse over the fields found in logs matching your search and see the top N values for other these keys. Imagine getting an alert and being able to search your logs for that error message and immediately being able to see it affects these N users disproportionally, that it is split 50/50 in two of your seven regions, only affects version X of your service. A couple more searches to dig in and you can see it is only feature Y with setting Z that is the problem. You switch to a timechart view and can see the moment the error started and the affected user counts. A few more minutes and your support team has a list of known affected users. You decide to monitor this new feature so you quickly create a new dashboard (or panel on an existing dashboard) and a new alert. At no time did you have to declare a field of your structured logs as an index or as searchable or aggregatable.
    • 0xEFF 3y ago
      Splunk has delivered this level of innovation and quality since 2007 when I first used it. We used Splunk to associate a change request ticket number all the way through the change control process to the Puppet log output tagging each change to the original business purpose. It was like magic for auditors back then and I rarely see that depth of tracing automated changes to business purpose in the field today, though we get close with gitops.
    • ckdarby 3y ago
      The entire moat is gone. The biggest value driver they had was integrations to get the data there, but now ebpf, telegraf and Vector have destroyed that moat. With Vector you can even source from Splunk and move elsewhere.
  • cliffcrosland 3y ago
    Maybe, but the Splunk query language is reasonably well liked by its users, at least in the security space. Much more approachable than SQL, which seems to be what all new tools these days are forcing users to use due to their dependence on Snowflake and Presto/Trino. In Splunk, you can type free text queries, and you can also add structure. Fairly flexible. We’ve been asked many times to make Scanner’s query lang more like Splunk’s.
• yanellena 3y ago
  > Cisco isn't exactly known for their software innovation in the upper stacks I spend most of my day managing Meraki networks and some of that is seriously powerful and innovative.
  • nosequel 3y ago
    They bought Meraki.
    • marcus0x62 3y ago
      Most of Cisco's current product suite came via acquisitions[0]. The difference with Meraki, compared to the typical Cisco acquisition, is how independently they were allowed to operate. WebEx was a similar story. Cisco would tell you that acquisition is a core competency of theirs[1], but having worked there for 8 years (including during the WebEx and Meraki acquisitions,) I'd say their track record is far more spotty. A few successes like Meraki, a bunch of mediocre examples and a few really bad ones, like Scientific Atlanta. 0 - Even switching originally came to Cisco via a whole series of acquisitions in the 90s. You could argue -- and Stanford certainly did -- that routing was an acquisition of sorts, as well. 1 - Their M&A guy even wrote a book about it, called Doing Both, which purported to explain how Cisco achieved so many of their goals by refusing to make false "either/or" decisions. Ironically, almost every example in the book was something that Cisco is spectacularly bad at.
      • TylerE 3y ago
        Scientific Atlanta… there’s a name I haven’t heard in a long time. Didn’t they use to make crappy cable boxes, back when cable TV meant a box that connected to the antenna input via coax.
        • marcus0x62 3y ago
          SA made set top boxes along with a bunch of back-end infrastructure to make them work. It was an acquisition that made sense on paper -- Cisco did (does) a lot of business with service providers, they make cable modem termination systems (the headend devices that handle cable modem connectivity,) had dabbled in IP video, so it was a natural evolution to make and sell the rest of the gear you'd need to operate a cable-based service provider. I don't think they were counting on how rapidly Internet streaming would take over, but in any case, the acquisition didn't work out so well and last I heard they had divested it. One other thing that I think feeds into these acquisition mishaps is that Cisco has, in my opinion, consistently over-estimated how much intelligence would be needed (or wanted) in the core network. In their view, intelligent network services = expensive network devices = revenue for Cisco. I think what the Internet specifically and IP in general, as well as the evolution of LAN technologies over time have proven is that when it comes to the core network, simple is almost always better and intelligence should move to the edge, where innovation can happen quicker and where services can be implemented in software. As an example, at one point they had what was, essentially, a middleware system (like Websphere,) which they called Application Oriented Networking. The idea was you would deploy these on your network gear, throughout your network, and it would provide message routing and translation services. They had a whole "architecture" built for it, called Services Oriented Network Architecture[0]. I don't think the people who built it really understood that it provided no real advantage over a cluster of middleware/ESB/MQ servers in a data center and that nobody was going to pay a huge premium to build that capability in their IP routers. 0 - https://www.cisco.com/c/dam/global/it_it/solutions/ent/tecnologie/routing/pdf/sona.pdf https://www.cisco.com/c/dam/global/it_it/solutions/ent/tecno...
• nathancahill 3y ago
  Someone wasn't surprised: https://x.com/unusual_whales/status/1704870849831125446?s=20 https://x.com/unusual_whales/status/1704870849831125446?s=20
  • smilbandit 3y ago
    My depth of stock trading stops at the buy low sell high level. Can someone explain a little more if you have time? What would have happened to those trades if splunk had went down 20%?
    • DSingularity 3y ago
      They lose 22,000$ This was insider trading.
      • qeternity 3y ago
        This is an overly simplistic view of options trading. Let’s say I had a view that the stock was going to be volatile, more so than options implied, but didn’t have a directional view. I could buy the calls and short the stock and scalp my gamma during the move. Or let’s say I was short the stock and wanted to hedge during a volatile FOMC period.
        • nameistaken 3y ago
          You and I have vastly different definitions of 'overly simplistic'. Scalping your gamma? Feels like the stock market is just a bunch of jargon, subterfuge and financial sleight of hand. Like we learned nothing from 2008, and just created financial 'products' mechanisms and gambits out of thin air. Stock shorting has got to be one of the most pants-on-head stupid things I've ever heard. Well, next to gamma scalping.
          • mlyle 3y ago
            > Feels like the stock market is just a bunch of jargon, subterfuge and financial sleight of hand. Here, what they're doing is establishing a position which will make money if the stock moves either direction out of a narrow band. If you believe there's going to be a big industry upset, but don't know whether it will hurt or harm a specific player, you might enter this position. In turn, the overall market volatility is reduced and liquidity is added by your information being added to the market. > Stock shorting has got to be one of the most pants-on-head stupid things I've ever heard. All kinds of simple, legitimate reasons to short stocks. E.g. you are excessively exposed to that company's welfare for some reason (stock options, they're an important vendor, they're a big component in a mutual fund you own but you'd rather not own their stock, etc)-- you can take an opposite position by shorting. Or, here, you can use it to offset an option that moves in the opposite direction. > Like we learned nothing from 2008, and just created financial 'products' mechanisms and gambits out of thin air. This isn't too much like the house of cards from 2008. These types of strategies are not new; offsetting short positions by writing or buying options was in frequent use in the 1970s, if not before. Option use to profit from volatility (or hedge volatility) dates back more than 2000 years. I'm not a big fan of esoteric, complicated financial schemes, or in creating options and financialized products for everything (e.g. cap and trade)... or situations where market players profit from privileged access to marketplaces (e.g. HFT). But the things you name are not any of these.
• ransom1538 3y ago
  rsyslogd strikes again.
• cliffcrosland 3y ago
  I worked at Cisco following an acquisition. I tend to agree with this comment about the upper stacks :) However, AppDynamics and Duo seem to be doing well at Cisco from what I can tell. I think observability and security tools are a good match for Cisco and bundle well with hardware. For this reason, I’ll bet Splunk does reasonably well under Cisco too.