Cribl, created by former splunk guys is undercutting them. Elastic's eql is finally close to comparable to SPL3 and then you have graylog improving (also by for

Cribl, created by former splunk guys is undercutting them. Elastic's eql is finally close to comparable to SPL3 and then you have graylog improving (also by former splunk guys). So it is indeed a good time to sell. Their stock is inflated because for the past 10+ yrs they were so good, it was hard to even compare them with anyone else. People who think kibana, solr (or any lucene based stack) was comparable have no idea how powerful splunk is. But they're just not coming up with competitive features anymore or adapting better pricing models. Their execs can't wrap their heads around having real competitiin and I don't think that'll change with Cisco. Cribl helps you reduce the data you ingest into splunk or even avoid splunk entirely. Really nice support for federated search as well (why isn't splunk doing this??).