Ive been hearing alot of “splunk this” and “splunk that” from a colleague of mine, so i finally decided to check it out myself. Though it is a neat tool that make syslog log-analysis easier, it does come at a price in more than one way.
First of, its extremely expensive. Second of, you sign away your soul in their EULA.
Heres a few things i find horrific (a few copy&paste from their EULA, emphasis added by me):
“You agree not to (i) use the Software except as expressly authorized in this Agreement and your Order Confirmation;”
Right, so if its not expressively authorized in the agreement to, say, have splunk analyze your calendar instead of a log, youre in violation? Dont be creative, is the message. Dont worry, it gets worse:
“[You agree not to] (vi) disclose to any third party the results of any benchmark tests or other evaluation of the Software,..”
You are not allowed to publish a benchmark!?? How f*cking DARE they?? Even worse, you’re not allowed tell ANYBODY what you think of (or how you “evaluate”) the software. Microsoft had the same benchmark clause many many years ago for their SQL-Server product, but grew up.
“At Splunk’s written request, you will furnish Splunk with a certification signed by an officer of your company verifying that the Software is being used in accordance with the terms and conditions of this Agreement and the applicable Order Confirmations.”
A bit excessive, but all good and well. If they ask if youre cheating, you should at least give them the guarantee that you’re not. But hold on to your horses:
Upon at least ten (10) days prior written notice, Splunk may audit your use” …. ” Any such audit will be conducted during regular business hours at your facilities“ … “You will provide Splunk with access to the relevant records and facilities“
Riiight. So all Gestapo like, they’ll show up at your door, demanding access to “records and facilities”. And according to the agreement, you MUST find time for them and they dont have to pay for all the time they waste. This is very extreme and not something you’d expect be possible anywhere in the western world, but here it is.
“You agree that Splunk may identify you as a Splunk customer on Splunk websites, client lists, press releases, and/or other marketing. You also agrees that Splunk may publish a brief description highlighting your deployment of the Software.”
Lastly, once you give them all your money for their tool, they can use your name, for free, in commercials and on their website.
They can even tell the world the exact details of your installation. So no confidentiality agreement there. And if youre running a sensitive facility, like a bank or like me, internet payments (adhering to the PCI standard), you may actually be prohibited from disclosing details of your setup publicly.
So you cannot agree to this (piece of garbage) EULA.
Shame on you Splunk! This is the WORST EULA i’ve EVER read, and i’ve read a few in my life time. Any Linux/Unix/Freedom lover should reject this promptly!. And if you’ve already bought Splunk, write them, demanding an explanation for these digital-rights atrocities. (even better; ask for your money back or sue them ;))
- Dan
Comments
Incredible!. Glad i found your site while searching for info about this product. Theres no way we will buy Splunk with a license like that one.
Hahaha… No benchmarks.. Now that says something about the product :)
I can swear Splunk is not the fastest guy in the class. Besides that, prices are incredibly high. And besides that, this EULA. The two last reasons should keep you out of the commercial license. You can try the free version instead and check if it fits your needs or not.
Thank you for the post!
As of 2009 “prices start at $7500″
I asked for a quote for our company and estimated 2GB logs per day. $25k / year. I flat out told him that it was WAY more than we would ever save by using Splunk. It’s cheaper to have staff (engineers even) go through logs everywhere than to pay for Splunk.
For what it’s worth though, I’ve never worked at a company that doesn’t negotiate their own SLA and just accepts their EULA as written or pays anywhere near their original list price. This is the point of negotiating pricing.
Eneko: If Splunk isn’t the fastest, then who is? What’s the basis of your comparison?
I attended Splunk’s .conf event this year and saw presentations given by Splunk customers that showed how Splunk paid for itself many times over in improving uptime, identifying places where resources were being wasted or over-scoped, and better understanding the behavior of their customers. I also use the free version at home on my personal ESXi environment that supports a personal messaging and web domain, and I can’t say enough good things about the product.
Regardling the EULA, Robert is correct and if you’ve purchased enterprise software before you would know that many things are negotiable - for example if you don’t want Splunk publishing details about your implementation, then raise it as a problem and see what happens.
@Jesse:
Regarding the EULA. Why should you have to negotiate something that is completely unreasonable to begin with? First off, it says something about the company you’re about to make yourself depended on, secondly its hard to negotiate a good deal, when your starting point is a lousy deal.