[baq]

That's why companies die in the long run.

Microsoft dominated the nineties especially and the naughts less so but still because the marginal price of their OS was zero - due to piracy. Yes they didn't like business to run unlicensed but if you were a customer, nobody cared, because in 5-10-20 years you'd be a paying business or would work for a paying business.

Splunk doesn't get that. There are no hobbyist/prosumer splunk installations. Zero. Nada. That's also how Linux won in the server space - nobody set up Windows servers as a hobby and 20 years later we're here.

IOW it's medium-term short-sightedness, if it makes sense. Tactically good, strategically so-so to bad, depending on your moat and momentum.

[bigstrat2003]

> Splunk doesn't get that. There are no hobbyist/prosumer splunk installations. Zero. Nada.

Not true. I ran a free (legit!) Splunk instance in my homelab for years. It's been several years since I shut the homelab down, so I couldn't tell you if they still have hobbyist licensing, but they certainly had it in the past.

[baq]

I’ll call you an unicorn :)

I know they have a free license for super small deployments but haven’t heard of anyone actually using it.

[yetanotherloss]

It was at one point usable but they drove off the hobbyist/small business crowd a long time ago. We do some work setting up elasticsearch tools that aggregate and filter data later sent to central splunk purely to affect a large reduction in license costs.

[optimalquiet]

A question: where did the hobbyist/small business crowd go?

[chucky_z]

Greylog. ELK.

I think modern solutions would be any of the recent Clickhouse based solutions.

Loki exists but it seems to have a tragically small market share.

[yetanotherloss]

Kibana and Graylog on top of elastic/opensearch. Even the commerical licenses on those are usually a tiny fraction of splunk's costs, and Graylog does enough for free that it's a much easier path to stand that up and then buy the correlation functionality if you really need it.

For some organizations what Splunk does well is important but for most of them they really only need much more basic log aggregation and analysis tools.

[hdmoore]

The move to make all free instances unauthenticated (and effectively RCE-aaS) put a dent in that use.