🔍

Splunk

Splunk is enterprise log search and analysis software, now owned by Cisco after its 2024 acquisition of Splunk Inc. It's the #39 most-used dev/ops tool in developer surveys at roughly 4.5% usage share. For years it's been the dominant choice for large-scale log aggregation and security monitoring (SIEM), letting teams search, alert, and build dashboards across massive volumes of machine-generated data from servers, apps, and network devices.

Quick facts
Type: Log analysis / SIEM (security information and event management) platform
Made by: Splunk Inc. (a Cisco company)
License: Proprietary/paid, with a free tier for limited data volume
Platforms/Hosting: Self-hosted (Splunk Enterprise) or cloud (Splunk Cloud Platform)
Primary use case: Aggregating and searching machine log data at scale for troubleshooting and security monitoring

Jump to: Example Getting started Best for

Example

Splunk's search language, SPL (Search Processing Language), pipes data through commands the same way a Unix shell pipes text.

// find failed login events in the last 24h, grouped by source IP,
// and flag any IP with more than 10 failures
index=security sourcetype=auth_log "login failed"
| stats count by src_ip
| where count > 10
| sort -count

Getting started

Splunk offers a free download (Splunk Enterprise, capped ingestion) for local evaluation, or a hosted Splunk Cloud trial.

# download and run Splunk Enterprise locally (Linux example)
wget -O splunk.tgz "https://download.splunk.com/products/splunk/releases/latest/linux/splunk-linux.tgz"
tar xvzf splunk.tgz -C /opt

# start it and accept the license
/opt/splunk/bin/splunk start --accept-license

Best for: Larger organizations, especially those with security/compliance requirements, that need to centralize and search huge volumes of logs across many systems in real time — smaller teams often outgrow the free tier quickly given Splunk's data-volume-based pricing.