Splunk vs ELK - Manage Production logs

Question

I'm working on a system that performs daily HPC on a computer grid. There are a lot of servers, service and applications (Windows,Linux,IIS,Apache,Websphare,SQL,Mongo,.Net,Python,C++)

It runs once every day.

I'm very familiar with ELK. I especially like the way elastic works as a DB and its features: percolator, scoring system, Rest API, etc..

I've recently heard of Splunk, I've looked into it and it seems pretty nice.

Lets put the $ cost aside

What will be a better solution for a non-cloud base solution that creates a huge amount of logs for about 4 hours a day and may have stress peeks during that time?

Answer 1

Let me summarise it for you:

Splunk - It's a very powerful, mainly on premises solution, expensive and, if all you want is "supergrep" then it's really too expensive for that use case.

ELK - License fees not incurred, but you'll end up spending $ on building various features, either right away if you already know you need N features or incrementally and over time as users start demanding features that ELK doesn't have.

Based on your requirement, i would suggest you to go with splunk.

PS If you want to look at detailed comparison, please have a look at this post .