4 ms·

Lots of companies use SumoLogic https://www.sumologic.com/signup/ https://www.sumologic.com/signup/. The UI is very similar to Splunk. But having used both Splu

Lots of companies use SumoLogic https://www.sumologic.com/signup/ https://www.sumologic.com/signup/. The UI is very similar to Splunk. But having used both Splunk and SumoLogic, I personally think that Sumo is superior in many ways. 1. It requires very little hacking and setup to work (cough ELK cough Splunk) since Sumo is completely cloud-based. It literally takes 2 minutes to sign up, 5 minutes to download and configure some log collectors, then voila you're ready to send data and search. Also I believe you can tell Sumo Logic to grab logs directly from S3 for example if you're running everything on AWS. 2. SumoLogic is pretty easy to use (it's basically cloud-based grep/awk) and has some really cool features that makes Splunk feel clunky in comparison. Parsing and transposing data for graphing is really simple. Also little things like auto-suggesting sources/hosts while you're typing a query makes the experience much smoother than jumping around tabs copy/pasting shit. 3. If you start to generate a lot of logs, and I mean a metric fuckton of logs from 1000s of servers, Splunk Storm will most definitely not be able to help you. In-house Splunk / ELK clusters will need to be carefully sized (just google ELK sizing). As software developers, we have enough on our plates that it really pays to use tools that help rather than make you wanna throw up your fists and curse. KISS

dmourati 12y ago
SumoLogic is Splunk Jr.
troydavis 12y ago
Do you work for Sumo Logic? https://www.linkedin.com/pub/rong-hu/8/140/75 https://www.linkedin.com/pub/rong-hu/8/140/75 is a "Rong Hu" This comment seemed incredibly positive for a neutral comment, but didn't disclose a relationship to the company (here or in the HN profile, at least as of this writing). The comment seemed odd as the first-ever comment from a 5+ year old HN account.
TomFrost 12y ago
Coincidentally, I had a demo call with Sumo today. I was very impressed, except for one point that makes Splunk the clear winner at the moment: I can send structured logs to Splunk and it automatically finds the keys and allows me to query on them immediately. Meaning, I can send: 2015-02-02 01:00:00 event="Product sold" price=5 And with zero configuration in Splunk, I can now query: event="Product *" price>2 | stats sum(price) And in the next iteration of my app, I could add 30 more key/value pairs to that message and could query on the rest of them just the same, no configuration. It makes development incredibly rapid to be able to instantly report on any metric anyone on my team logs out, debug-related or otherwise, without having to maintain some master list of every key in every log message in every service we write. I was floored in my Sumo call today when I was told that wasn't the case in that product yet. It seems like such a basic feature-- and is why many products have switched entirely to JSON-based logs. Have you discovered a workaround, or find that to be as cumbersome as I'm anticipating?
- JamesHollinger 12y ago
  Sumo Logic currently has the ability to extract known fields on ingest, making them available for searches, much like the Splunk query provided above. Dynamic fields, such as new KVPs that are logged out are able to be pulled out in the query with one extra step, as follows: | kv infer "event","price" | sum(price) by event | where price >2 The kv operator refers to key value pairs. There is also a json operator which functions the same way.

dmourati 12y ago

SumoLogic is Splunk Jr.

troydavis 12y ago

Do you work for Sumo Logic? https://www.linkedin.com/pub/rong-hu/8/140/75 https://www.linkedin.com/pub/rong-hu/8/140/75 is a "Rong Hu" This comment seemed incredibly positive for a neutral comment, but didn't disclose a relationship to the company (here or in the HN profile, at least as of this writing). The comment seemed odd as the first-ever comment from a 5+ year old HN account.

TomFrost 12y ago

Coincidentally, I had a demo call with Sumo today. I was very impressed, except for one point that makes Splunk the clear winner at the moment: I can send structured logs to Splunk and it automatically finds the keys and allows me to query on them immediately. Meaning, I can send: 2015-02-02 01:00:00 event="Product sold" price=5 And with zero configuration in Splunk, I can now query: event="Product *" price>2 | stats sum(price) And in the next iteration of my app, I could add 30 more key/value pairs to that message and could query on the rest of them just the same, no configuration. It makes development incredibly rapid to be able to instantly report on any metric anyone on my team logs out, debug-related or otherwise, without having to maintain some master list of every key in every log message in every service we write. I was floored in my Sumo call today when I was told that wasn't the case in that product yet. It seems like such a basic feature-- and is why many products have switched entirely to JSON-based logs. Have you discovered a workaround, or find that to be as cumbersome as I'm anticipating?

JamesHollinger 12y ago
Sumo Logic currently has the ability to extract known fields on ingest, making them available for searches, much like the Splunk query provided above. Dynamic fields, such as new KVPs that are logged out are able to be pulled out in the query with one extra step, as follows: | kv infer "event","price" | sum(price) by event | where price >2 The kv operator refers to key value pairs. There is also a json operator which functions the same way.