IT systems, especially log files, collect data all day long. Finding something meaningful in a log file and then being able to do something useful with it has been beyond the means of most IT organizations.
Then along came the search engine Splunk and IT organizations found they had a cost-effective way to search all their log files. That could be handy at times for the IT department, but it didn’t make a whole lot of difference to the business. Now this week we’ve seen the release of version 4.2 of Splunk, which adds support for real-time alerts that could have some significant implications that go well beyond the IT department.
Obviously, the first application for real-time alerts has been to search for certain anomalies in files that when discovered could be passed on to a variety of security products. But after that tactical issue gets addressed, Steve Sommer, chief marketing officer for Splunk, says there are a range of other scenarios where real-time alerts based on operational IT data could be significant. For example, Splunk could be tuned to search for events that could be fed back to an analytics engine that in turn could feed any number of business intelligence or compliance applications. In fact, there’s no shortage of applications that couldn’t benefit from real-time alerts based on IT operational data. The challenge has been first finding that information and then being able to package it up in a way that makes it useful to other applications.
Unfortunately, the divide between internal IT operations and the folks who manage the applications portfolio within most companies is fairly wide. But with a little imagination and fortitude, the ability for IT to flow real-time alerts based on IT operational data could prove to be the missing link between all the data IT organizations routinely collect and the end users running applications that are generally starved for the latest most useful data they can find.
