[falcolas]

I see this exact same thing. Let’s take Splunk into consideration. Administrating splunk, all of our feeds into splunk, and trying to keep us from overrunning our quotas is about 1 full time person, and half a full-time person worth of DevOps work yearly. That’s in addition to the subscription costs we pay to Splunk directly.

Every piece of software requires in-house support; even pagerduty and their ilk require management time to set up schedules, adding and removing people. It’s not a lot of time, about .1 to .2 of a person’s time for all of our pageable employees, but a manager’s or leader’s time is not cheap.

[hedora]

Also, splunk is considerably more difficult to use (no CLI, loses jobs, etc) and less powerful (no joins, incomplete results) than a farm of Linux log servers and some ssh tooling, such as cluster ssh, or whatever.

There’s also the question of whether the splunk log agents are more or less of a pain to administer than whatever log management they replace.

Finally, there’s the question of how the resulting reports shape people’s behavior and productivity.

If you add that all up, learning it is a waste of time for people that can code up a join in perl from muscle memory, but it saves training time for people that can’t.

In the end, every one less productive than they would be with some other tool.