Splunk sees wiki as troubleshooting systems tool

Computerworld - The idea behind the Wikipedia, a collaborative, community-built encyclopedia, is being applied by a tools vendor for untangling system problems.

Splunk Inc. has built a wiki it calls the Splunk Base for users to report and share information about systems events from any system, hardware or software. Although anyone can use the wiki and contribute to it, the San Francisco-based company is integrating the wiki’s information repository with its troubleshooting diagnostic tool.

The Splunk software uses its own algorithms to read log files, such as Apache server logs and Windows event files and other system files generated by hardware and software, to find patterns. Via a Web interface, users can search through log files from multiple systems to trace a problem.

The main issue systems administrators face is finding out what is causing a problem, said Splunk CEO Michael Baum. “It’s not fixing the problem, it’s not restarting my servers, it's finding the problem in these complex distributed systems with lots of components.”

The paid version of Splunk software was released in December, and among its users is Varadarajan Krishnaswamy, Web services manager at the American Society of Civil Engineers in Reston, Va. Krishnaswamy initially tried the free version of the tool but recently upgraded to the professional, paid version. Pricing is based on usage.

Krishnaswamy uses the tool on Apache and Sendmail servers and said it has cut his diagnostic time by about half. “I’ve been very satisfied with the project,” he said.

He noted, however, that the Splunk product, which runs on a two-CPU Sun Solaris box, can tax system resources when it's indexing. “It needs a lot of horsepower in terms of CPU and memory,” Krishnaswamy said.

Searches that users conduct will include a link to Splunk Base, which has been operating quietly, with about 3,500 people contributing so far. Splunk Base is intended to serve as a repository for hardware and software system events to help users identify problems. The person in charge of that effort is Patrick J. McGovern III, who is a former director of SourceForge.net, a open-source software development site. McGovern is the son of Patrick J. McGovern, the founder and chairman of International Data Group Inc., which publishes Computerworld.

Cameron Haight, research vice president at Gartner Inc., said he believes the wiki can be valuable because problems reported on it could actually involve multiple products. “The alternative would be to potentially visit many different technology supplier Web sites and to search their technical support pages for similar clues in regards to log messages,” Haight said.

He sees Splunk Base as an extension of what many users now do every day when they run into a problem, which is to rely on search engines to find users with similar problems in the hope of finding a solution. “The potential downside is if the quality of the information becomes potentially suspect, [as] has happened already in the broader wiki environment,” he said.