3 ms·
After being at, oh, 5-6 Splunk shops I have yet to see one not fall into what I call the "Splunk Death Spiral". 1) Have a massive logging problem. 2) Get s
by kjs3 2y ago
After being at, oh, 5-6 Splunk shops I have yet to see one not fall into what I call the "Splunk Death Spiral".
1) Have a massive logging problem.
2) Get sold on Splunk.
3) Implement Splunk and pour all your data into it.
4) High-fives all around at the amazing insights you're getting.
5) Get the bill.
6) Start rapidly paring down the amount of data going to Splunk to get under budget.
7) Find you're not getting very good insights any more.
8) Have a massive logging problem.
- smcnally 2y agoWithout steps 2) - 7), the shops still have massive logging problems. Doing those steps has the shops closer to defining the problem and showing insights and possibilities. Step 5) quantifies costs for a solution that works. > 6) Start rapidly paring down the amount of data going to Splunk to get under budget. Step 6a) is often “build it ourselves” or “find a less-expensive alternative” — did any of your shops do that with success?
- kjs3 2y agoYou completely missed the point, it seems.