LINUXWORLD - Splunk sees wiki as IT troubleshooting tool

The idea behind the wikipedia, a collaborative, community-built encyclopedia, is being applied by a tools vendor for untangling system problems.

Splunk has built a wiki it calls the Splunk Base for users to report and share information about systems events from any system, hardware or software. Although anyone can use the wiki and contribute to it, the San Francisco-based company is integrating the wiki's information repository with its troubleshooting diagnostic tool.

The Splunk software uses its own algorithms to read log files such as Apache server logs and Windows event files and other system files generated by hardware and software to find patterns. Via a Web interface, users can search through log files from multiple systems to trace a problem.

The main issue system administrators face is finding out what is causing a problem, said Splunk CEO Michael Baum. "It's not fixing the problem, it's not restarting my servers, its finding the problem in these complex distributed systems with lots of components."

The paid version of Splunk Base was released in December, and among its users is Varadarajan Krishnaswamy, Web services manager at American Society of Civil Engineers in Reston, Va. Krishnaswamy initially tried the free version of the tool, but recently upgraded to the professional paid version. Pricing is based on usage.

Krishnaswamy uses the tool on Apache and Sendmail servers and said it has cut his diagnostic time by about half. "I've been very satisfied with the project," he said.

He noted, however, that the Splunk product, which runs on a two-CPU Sun Solaris box, can tax system resources when it is indexing. "It needs a lot of horsepower in terms of CPU and memory," he said.

Searches that a user conducts will include a link to Splunk Base, which has been operating quietly with about 3,500 people contributing so far, and is intended to serve as a repository for hardware and software system events to help users identify problems. The person in charge of that effort is Patrick J. McGovern III, who is a former director of, a open source software development site. McGovern is the son of Patrick J. McGovern, the founder and chairman of International Data Group, which publishes Computerworld.

Cameron Haight, research vice president at Gartner Inc., believes the wiki can be valuable because problems reported on it could actually involve multiple products. "The alternative would be to potentially visit many different technology supplier Web sites and to search their technical support pages for similar clues in regards to log messages," Haight said.

He sees Splunk Base as an extension of what many users now do every day when they run into a problem, which is to rely on search engines to find users with similar problems in the hopes of finding a solution. "The potential downside is if the quality of the information becomes potentially suspect [as] has happened already in the broader wiki environment," he said.