So... I love, love, love Splunk, but it's really freakin' expensive. I think it's time to start looking for a free and open replacement.
Near as I can tell, we'd count as a major/large installation, size-wise. We're talking about at least a 7-digit number of nodes contributing log events, all in active use, each generating Megabytes of data a day. Hold on a second, lemme do some math...
<thinking/>
Holy Schnikeys! If I'm not wrong in my volume estimates, I need to collect, store and index more than a Petabyte/Day if I want complete visibility into the system. That can't be right...
In any event, for anyone following along, there's a new meme in town. Previously I used this blog as a place to dump links for the Cassandra and DevOps work we were doing, now I'll do the same thing for the upcoming Splunk work.
Happy Reading.
Near as I can tell, we'd count as a major/large installation, size-wise. We're talking about at least a 7-digit number of nodes contributing log events, all in active use, each generating Megabytes of data a day. Hold on a second, lemme do some math...
<thinking/>
Holy Schnikeys! If I'm not wrong in my volume estimates, I need to collect, store and index more than a Petabyte/Day if I want complete visibility into the system. That can't be right...
In any event, for anyone following along, there's a new meme in town. Previously I used this blog as a place to dump links for the Cassandra and DevOps work we were doing, now I'll do the same thing for the upcoming Splunk work.
Happy Reading.
