Splunk vs ELK - Manage Production logs

Question

I'm working on a system that performs daily HPC on a computer grid. There are a lot of servers, service and applications (Windows,Linux,IIS,Apache,Websphare,SQL,Mongo,.Net,Python,C++)

It runs once every day.

I'm very familiar with ELK. I especially like the way elastic works as a DB and its features: percolator, scoring system, Rest API, etc..

I've recently heard of Splunk, I've looked into it and it seems pretty nice.

Lets put the $ cost aside

What will be a better solution for a non-cloud base solution that creates a huge amount of logs for about 4 hours a day and may have stress peeks during that time?

Lauraine

Answer 1

Let me summarise it for you:

Splunk - It's a very powerful, mainly on premises solution, expensive and, if all you want is "supergrep" then it's really too expensive for that use case.

ELK - License fees not incurred, but you'll end up spending $ on building various features, either right away if you already know you need N features or incrementally and over time as users start demanding features that ELK doesn't have.

Based on your requirement, i would suggest you to go with splunk.

P.S. If you want to look at detailed comparison, please have a look at this post.

Anatolian

Thanks for your feedback. As long as money won't be an issue I will go with your recommendation. If it will be I guess ELK is a second best. – Lauraine

With the disclaimer that my day job is to run a Splunk implementation, what I typically hear from people is ELK is cheaper initially. The problem is that in the long run it requires more servers so 3-5 years after initial deployment the cost of ELK far exceeds that of Splunk. For us Splunk is an easy choice due to the forwarders. I bring data in from 50-100 different I.T. groups and the forwarder allows us to centrally control what is collected. – Insistency