Cisco Acquires Splunk

[tw04]

Wow - I guess I'm both surprised and completely unsurprised. Surprised because Splunk is a pretty big pill to swallow. Unsurprised because they've obviously been interested in the space for a long time (they attempted to acquire Datadog and got shot down).

https://realmoney.thestreet.com/investing/technology/cisco-r...

Good luck Splunk folks - Cisco isn't exactly known for their software innovation in the upper stacks (they still do pretty incredible things at the network OS layer).

[bastard_op]

That's really a shame, Cisco buying anyone is often a death knell for the product. Look at their acquisition of security companies like Protego, Stealthwatch, ThousandEyes, and others that languish there, bled into watered down features for other dubious Cisco products and disappear into the ocean. Customers then abandon the products to again escape Cisco for other non-stagnant and overpriced products.

Already a customer/friend at a $6B retail customer of mine sent me the link first thing as a Splunk owner there. Just last week I asked if they'd looked at Datadog much yet, and said they'd rip Splunk from their cold dead hands. The follow up to the link for buyout news as that they were going to start looking at Datadog now. Splunk was already expensive, but not Cisco expensive.

[LaLaLand122]

What's the problem with ThousandEyes? They got their agent into Cisco equipment, and just recently gave them SamKnows.

[wittekm]

Genuinely surprised anybody would acquire Splunk in 2023. Whenever you hear about Splunk from security engineers, they're actively trying to get off it (edit: yes, primarily because of cost). Better, next-gen SIEMs are either here or around the corner.

[bane]

To pile onto the Splunk "love" going on here. Splunk is one of those systems that's too "powerful" for small use-cases, but too expensive for the ones it's really designed for.

Anecdote, I once worked with a client that really wanted to get Splunk, but produced so much network traffic that the discounted annual costs were more than the entire budget for the rest of the organization combined. That's staff, the building, equipment, power, water, everything...the estimated Splunk cost was more than that.

They went with a combination of ELK and a small team of dedicated developers writing automation and analytics against Spark and some enterprise SQL database. Still expensive, still cheaper than Splunk.

[euph0ria]

I've always found the first 30 seconds of this clip very funny when it comes to Splunk: https://www.youtube.com/watch?v=o_zonaHyd_g&t=5s

[Thev00d00]

$28 billion - $157 a share

Splunk shares were trading at $119.59, so ~31% premium.

Cisco lost 4% in premarket trading.

[rozenmd]

An average acquisition then:

acquirer pays a premium to nudge the acquiree's board to approve

acquirer's shareholders that disagree with the deal sell, in anticipation of value destruction

[airstrike]

Cisco cash is flowing out to Splunk shareholders so it makes sense that its equity value is X% lower after announcement

[johnyzee]

All cash, too. Splunk was like, Cisco equity? Nah.

[swozey]

$28 BILLION? Splunk???? my god

[dang]

Related ongoing threads:

Insider trade on Splunk acquisition? - https://news.ycombinator.com/item?id=37599587

Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup - https://news.ycombinator.com/item?id=37600019

[SushiHippie]

And

Cisco pulled out of SentinelOne acquisition after due diligence - https://news.ycombinator.com/item?id=37598299

[debarshri]

Building splunk has become very democratised in today's day and age.

Back in the day, logging, metrics, event collection etc. was a hard problem that they solved. Esp. when there weren't any simple distributed storage operators.

They have been a cockroach in the orgs, surviving every downturn. As a dev, you might hate it, CISO and CIOs love it. Orgs, often mandate it. The way they dominated the market is via creating CEF formats, integrations. It is more than a logging solution right now. It is an XDR, threat analysis platform etc.

This acquisition is going to be interesting with app dynamics+splunk and others, it feels like there is a larger play here for Cisco.

I don't think the value that splunk have is transitive to ES or grafana. It is, its own thing.

[kabdib]

Yeah, we went ElasticSearch and some bespoke code after Splunk decided to raise its prices. Wasn't even a difficult decision, don't regret it.

If you can afford Splunk, just wait a couple of years until they figure that out.

[surfingdino]

Congrats to the leadership team; thoughts and prayers to the engineering team.

[grecy]

Somebody had a 45,650% gain in one overnight trade on $SPLK calls. Amazing luck. [1]

Someone opened 127 calls for $22,000, and closed them today after the buy-out announcement.

A cool way to turn $22,000 into $10,043,000

[1] https://www.reddit.com/r/wallstreetbets/comments/16oi9an/som...

[bufferoverflow]

99.99% that's insider trading.

[leoc]

It's a strong effort, but not as cerebral as the classics, "Twitter Acquires Magic Pony" https://news.ycombinator.com/item?id=11937756 and "Salesforce Signs Definitive Agreement to Acquire Slack" https://www.youtube.com/watch?v=Qt9MP70ODNw .

[joncrane]

Perhaps it's a bit premature. There's no price point in the announcement so there may be some details that drag out...

[apricot]

"Accelerate digital resilience". Huh. Wonder what that means in English.

[ingen0s]

Someone made over 40,000% return this morning from a trade placed on this news yesterday (before it came out). Strange.

[projectileboy]

Does anyone have an example of an acquisition where the products of the acquired company then became better?

[davidu]

Meraki and OpenDNS both became better post acquisition, and in both cases I’d say it was because Cisco let them continue to maintain a lot of control, the leaders stayed around, and the majority of the engineering teams did, too. Cisco has a long list of successful acquisitions. The release says Gary will report to Chuck directly, which is a strong sign Chuck will make sure Splunk succeeds. (nb, I was CEO of OpenDNS)

[jve]

GitHub

I'm sure there are tons of other, lesser known acquisitions... looking at what Apple acquires - seems relevant to be integrated into their products: https://en.wikipedia.org/wiki/List_of_mergers_and_acquisitio...

Oh, wow, they even acquired Intel smartphone modem business at 2019 and other Semiconductor businesses.

[troupe]

Webex is much better under Cisco than it was on it's own. Cisco's expertise in hardware made for a great combination and has kept the product aligned with interoperable standards more than Zoom and some of the others.

[projectileboy]

The responses here are giving me some hope. I’ve just had many experiences as a customer where products I’ve used became worse (or were shut down) after their companies were acquired

[missedthecue]

There are exception, but Microsoft seems pretty good at this. GitHub, Minecraft... Skype got a lot better for me in terms of reliability after the acquisition too, of course they've been competed away by other voips like Facetime and Whatsapp these days.

LinkedIn is better than ever for finding a job, or advertising a job, even though lots of people here don't like it because of the LinkedIn poasting culture.

[sokoloff]

Android

[jojobas]

Companies rarely buy other companies in order to make buyee's product better, they buy them to boost the buyer's business or at least remove competition.

[revskill]

Youtube, Instagram.

[mrits]

T-Mobile buying Sprint was a huge improvement for me.

[dhaulagiri]

Heroku. Better until it wasn't...

[avrionov]

I wonder if this segment is ready for disruption. Splunk is very expensive, ElasticSearch is still lacking many of the features of Splunk and when hosted on AWS is very expensive. SumoLogic was acquired by private equity, which means that it won't get cheaper. DataDog is also very expensive.

Solution like SnowFlake for logs / telemetry where compute and storage are separated might be the future.

[mikeshi42]

We're[1] building the OSS equivalent when it comes to the observability side of Splunk/DD, on Clickhouse naturally of course but believe in the same end goal of lowering cost via separation of compute and storage.

[1] https://github.com/hyperdxio/hyperdx

[cliffcrosland]

We’re also giving this a shot. The annual Splunk bill at our last startup exploded from $10k to $1M when we reached 1TB of logs generated per day, which is actually an easy threshold to hit when you have decent traction and aren’t proactively reducing logs. So we built Scanner.dev to drop these costs by 10x.

Decoupling compute and storage is definitely the way to go. We’re using Lambda functions and ECS Fargate containers for compute that scales up and down rapidly, and S3 for storage. Getting ~1TB/sec log scan speeds, which feels fairly good. We keep sparse indices in S3 to narrow down regions of logs to scan. Eg. if you’re searching for an IP address that appears 10 times in a 25TB log set, the indices reduce the search space to around 300MB. Takes a few seconds to complete that query, whereas Athena and CloudWatch take like 20 minutes.

We’re also using Rust to maximize memory efficiency and speed - there are lots of great SIMD optimized string search and regex libraries on crates.io.

We’re early, so there are a lot of SIEM features like detection rules that we are still building. But Splunk/DataDog users might find it useful if costs are a problem and they use mostly log search:

https://scanner.dev

[dogman144]

A stack we’ll see:

- panther siem (python alerts, thank the lord) and then pandas + databricks + s3 data lakes for deep analysis and IR

- maybe swap in panther SIEM for XDRs, if they get better out of the box

[danielodievich]

Observe Inc. is disrupting this just in that kind of way already. https://www.observeinc.com/blog/how-observe-uses-snowflake-t... describes how.

[manicennui]

ElasticSearch by itself is not a Splunk replacement except in very simple use cases.

[jensensbutton]

Snowflake... is not cheap.

[pmcf]

Everyone complains about how expensive Splunk is but the amount of compute and storage consumed by processing logs is ridiculous.

I feel like we should be talking about the sad state of logging where we think it’s perfectly ok to dump millions of 10k stack trace dumps and think that should be cheap.

[AlbertCory]

There's a term for these big, expensive, hard-to-get-rid-of software packages:

"RansomWare"

My leading example is SAP. Actually, most of the big ERP packages are ransomware.

[stuff4ben]

I guess Cisco's AppDynamic acquisition from a few years ago isn't panning out. Or maybe they're complimentary, who knows?

[dangus]

AppDynamics is primarily an APM product, not a SEIM.

Also, from a business perspective, Cisco basically removed a competitor from the field.

[MDGeist]

I bet they will just try to upsell all the AppD customers with Splunk ES/SIEM. If the Thousand Eyes and AppD integration is any indicator they will add a button in AppD that opens up Splunk...

[bugsense]

Thoughts and prayers to the people who will be tasked to consolidate the portfolio.

[ak217]

I haven't used Splunk in a number of years due to its cost. Splunk seems like a good pairing for Cisco - it's complementary to its other offerings to less price sensitive orgs, like Meraki.

I've used several Splunk competitors (Sumo Logic, Datadog, etc.) that all have various strengths but suffer from a lesser version of Splunk's problem (once you're locked in and up for renewal, watch out). I also tried some ELK-based stuff, which just plain sucked.

The one thing that hasn't sucked is AWS CloudWatch Logs, after they added Insights (a log query engine). It has reasonable pricing and works really well if you're on AWS.

[physicles]

We’ve got some logs in CloudWatch, but I barely use it because the query interface is unfathomably slow (in terms of query throughput). Do you use the web interface to query, or some other way?