[bigstrat2003]

> Splunk doesn't get that. There are no hobbyist/prosumer splunk installations. Zero. Nada.

Not true. I ran a free (legit!) Splunk instance in my homelab for years. It's been several years since I shut the homelab down, so I couldn't tell you if they still have hobbyist licensing, but they certainly had it in the past.

[baq]

I’ll call you an unicorn :)

I know they have a free license for super small deployments but haven’t heard of anyone actually using it.

[yetanotherloss]

It was at one point usable but they drove off the hobbyist/small business crowd a long time ago. We do some work setting up elasticsearch tools that aggregate and filter data later sent to central splunk purely to affect a large reduction in license costs.

[optimalquiet]

A question: where did the hobbyist/small business crowd go?

[chucky_z]

Greylog. ELK.

I think modern solutions would be any of the recent Clickhouse based solutions.

Loki exists but it seems to have a tragically small market share.

[yetanotherloss]

Kibana and Graylog on top of elastic/opensearch. Even the commerical licenses on those are usually a tiny fraction of splunk's costs, and Graylog does enough for free that it's a much easier path to stand that up and then buy the correlation functionality if you really need it.

For some organizations what Splunk does well is important but for most of them they really only need much more basic log aggregation and analysis tools.

[hdmoore]

The move to make all free instances unauthenticated (and effectively RCE-aaS) put a dent in that use.