Splunk

Splunk is a database system designed for extracting structure and analyzing machine-generated data. It takes in data from other databases, web servers, networks, sensors, etc. and then offers services to analyze the data, and produce dashboards, graphs, reports, alerts, and other visualizations. All this data is captured in a searchable repository and served via a web interface called Splunk Web.

Splunk is a horizontal application and is used by a large and diverse set of users with different knowledge bases in an organization to monitor IT operations, security, and business analytics. It is also possible to extend the Splunk environment by installing or developing an app. An app runs on the Splunk platform and includes inputs, lookups, and reports to display information about the data to add specific functionality. Over 90 of the Fortune 100 companies use Splunk.

History

Splunk was founded by Erik Swan, Michael Baum, and Rob Das in 2002. Prior to founding Splunk, all three founders were dealing with large-scale search infrastructures and were unhappy about the tools available for analyzing log files at the time. Early customers of Splunk reported their experience of debugging their environments as ‘digging through caves’ and ‘crawling through the muck to find the problems’, which inspired the founders to name the company after the word for exploration of caves, spelunking.

Splunk raised a $5 million Series A in 2004 led by August Capital and reached profitability by 2009. Splunk went public on NASDAQ under the ticker name SPLK at a price of $17 a share in 2012. Splunk acquired SignalFx, a cloud monitoring platform for infrastructure, microservices, and applications, in August 2019 for $1.1 billion.

Data Model

Array / Matrix

Splunk uses a flat file database model.

Indexes

Not Supported

Splunk indexes data by breaking them into events, based on the timestamp of the data. After breaking the data up into events, the events are passed through the indexing pipeline where additional steps are taken such as: breaking the events into segments so indexing and searching can be done efficiently, building data structures for the indexes, and writing the events out to disk.

Checkpoints

Not Supported

Splunk supports the notion of checkpoints. When reading data and indexing, a checkpoint can be created to mark the data as being read or indexed.

Joins

Not Supported

Splunk supports inner join, and outer join, but inner join is the default.

Splunk Logo
Website

http://www.splunk.com/

Tech Docs

https://docs.splunk.com/Documentation/Splunk

Developer

Splunk

Country of Origin

US

Start Year

2002

Project Type

Commercial

Written in

C++

Licenses

Proprietary

Wikipedia

https://en.wikipedia.org/wiki/Splunk