Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am considering implementing Splunk at my company but am leery about the financial investment. I noticed there is a free version of Splunk that seem to be good enough.

Can anyone tell me if you are using the free version at your company? Do you find the free version to be adequate, or just a springboard for the eventual purchase?

share|improve this question
add comment

2 Answers

up vote 11 down vote accepted

We use free Splunk together with OSSEC on several customers and it's perfectly usable. Of course, it has some limitations compared to the non-free version:

  • 500MB limit per day (with two or three peaks allowed per month): If you don't generate that much data, this won't affect you
  • Authentication: free Splunk does not have it. We use apache and http_auth to overcome this limitation. It's not a perfect solution but good enough. If you will be the only user, you can run it on localhost.
  • Different users: free Splunk only has one user. So you don't get personalized dashboards and customization. Again, if you are all looking for the same and don't care about sharing or you are the only one, there should be no problem.

Overall, free Splunk (particularly version 4) is a product per se and can be used in production without worries, unless you happen to need the added features of the non-free version.

share|improve this answer
    
Free splunk also won't allow scheduled searches, which, in my experience, hampers the usability of the product pretty badly. –  thepocketwade Jun 28 '10 at 20:41
    
it's 5 'licence violations' per month by the way, when the 6th one occurs it still keeps accepting and indexing events but you can't search on those events until you increase your licence. –  Chopper3 Mar 12 '11 at 14:35
add comment

Overall, free Splunk (particularly version 4) is a product per se and can be used in production without worries, unless you happen to need the added features of the non-free version.

If you have small amounts of data to index, the above is true.

What we found out was that if your data is in the range of the limit, you are in TROUBLE.

We figured: Heck, 500mb/day, that is a lot. If we exceed it, no big deal, we will only be able to search 500 mb of it.

Wrong!

According to the splunk answers site, if you hit the limits, the Splunk Search feature is disabled... for DAYS at a time.

This effectively KILLS your splunk system (if you can't search, the whole system is about as useful as a sack of sand).

"If you exceed your licensed daily volume on any one calendar day, you will get a violation warning. The message persists for 14 days. If you have 5 or more violations on an Enterprise license or 3 violations on a Free license in a rolling 30-day period, search will be disabled. Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) violations in the previous 30 days or when you apply a new license with a larger volume limit.

Note: During a license violation period, Splunk does not stop indexing your data. Splunk only blocks access while you exceed your license.

So even if you have a paid license, if you hit the limits you can effectively disable the system.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.