Splunk in a nutshell: it runs a daemon on all your boxes, that tails all your logfiles (you can configure which ones) and pipes them all to a central logging server. On the logging server, another daemon runs that does pattern matching/filtering on the incoming logs, and fires an alert when it gets a match. And umm, that's about it really.
The one useful thing it can do is give (say) devs access to logfiles from prod servers that they aren't allowed for whatever reason to log into themselves. But you could do this yourself with a periodic rsync to an internal webserver...
The one useful thing it can do is give (say) devs access to logfiles from prod servers that they aren't allowed for whatever reason to log into themselves. But you could do this yourself with a periodic rsync to an internal webserver...