Introduction
Splunk and ELK Stack (Elasticsearch, Logstash, and Kibana) are the “big 2” log analytic engines on the market. They have a lot in common and it’s pretty tricky to find which one suits your needs. They capture, index, and correlate real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards, and visualizations.
In this article, I will try to compare them and help you to find out what’s the best for you.
Data Collection
Splunk and ELK use an Agent to collect log file data from the target devices. In Splunk the Agent is called Splunk Universal Forwarder. In ELK, the agent is Beats.
While Splunk uses a proprietary technology (primarily developed in C++) for their indexing, Elastic Search is based on Apache Lucene, an open source technology written fully in Java.
Shipping data to Splunk may be easier. After installation, agents are preconfigured for a wide selection of data sources (network sources, windows sources, applications logs etc.) and they are used to import data into Splunk
In the ELK Stack, Logstash needs to be configured so that each field is identified before shipping data. The main difficulty in Logstash is the longtime requirement for startup and difficulty in debugging errors as non-standard configuration languages are being used in this tool.
Features
Both solutions have a lot of plugins and are really closed in terms of features.
So if you have a really particular need, you may check if an app or a plugin exists for your need. But most of the time, you will find it on both side .
- https://www.elastic.co/guide/en/elasticsearch/plugins/current/index.html
- https://splunkbase.splunk.com/
Cost
- Splunk’s license fee is based on Daily Log Volume that is being indexed.
- ELK’s license is based on the number of nodes
- Both solutions will require similar hardware infrastructure.
- You can setup a free ELK Stack environment but with limited features (i.e if you want user management).
- Both solutions will require similar hardware infrastructure.
- Both solutions have free and paying plugins.
- You can purchase consulting hours with Splunk
Support
Both solutions have support. However, the Splunk community may be a little bigger and support is included in Licenses.
Conclusion
In my opinion both products are more similar than different in terms of features. And they are currently on the same level of popularity (Splunk may be a very close second)
However, I would suggest to go for ELK if you have a small or medium enterprise with low budget because some features are free and it may be more flexible than Splunk. Large enterprise may choose Splunk over ELK because it may be more mature.
