Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Rollout: Splunk 3.0: Page 4 of 4

Copying files around like this is a somewhat archaic process, so ensure that your scripts are up to snuff and have error-control built in so that archived data is not lost. Log management products from vendors such as ArcSight, LogLogic and LogRhythm offer more extensive archiving capabilities, often with integration into SAN systems. This may make them more appropriate for regulated industries that are required to store logs for certain periods.

And because Splunk is software, you need to plan for adequate server resources. Splunk runs on Linux, but the company is working on a Windows version. You will also need a browser with Adobe's Flash player installed. The right hardware depends on specifications such as events per second, the amount of data collected and your archive needs. Here's where an appliance approach, offered by companies like LogLogic, have an advantage—the vendor specs out the machine and provides support for the hardware and software.

You can try Splunk for free with a 30 day enterprise license, and a freeware version is also available, though it doesn't support searching, distributed Splunk servers or multiple user accounts. The freeware version also has a 500 MB per day limit on indexing and storage.

Mike Fratto is managing editor for labs, NAC and infrastructure. Write to him at [email protected].