# Splunk Splunk is a self-hosted platform for collecting, indexing, searching, and analyzing log and security data, helping homelabbers and operations teams monitor systems and detect issues. It is open source and self-hosted, installable on Docker Hub and Unraid. Canonical page: https://ourlocalhost.com/app/1132/splunk ## Description Splunk is a self-hosted platform for collecting, indexing, searching, and analyzing log and security data, helping homelabbers and operations teams monitor systems and detect issues. ## Platform availability Available on 1 of 9 platforms: Unraid. ## Health score 24/100 (Low), based on 2 of 4 factors. - Easy to install: 35 (1 install platform, install notes, Docker image) - Light to run: 10 (12 GB minimum RAM) ## Links - Documentation: http://help.splunk.com/ - Docker Hub: https://hub.docker.com/r/atunnecliffe/splunk - Official website: https://www.splunk.com/ - Unraid: https://ca.unraid.net/apps/splunk-1cfw77s159af3g?q=splunk ## Common questions ### What kinds of home network logs has a homelab user sent to Splunk? A homelab user describes running the free version of Splunk at home to collect logs from Pi-hole, OPNsense, Proxmox, Home Assistant, and Windows or Linux machines. ### What practical limitations do homelab users report when running Splunk as a SIEM? One homelab user says a SIEM tool such as Splunk can require too many resources, and a home lab may not generate enough events to make it worthwhile. ### Where are data inputs and indexing documented in Splunk's main documentation? They are listed under the data management section, with separate sections for search and analytics and administration. ### What must you configure before starting the Splunk OpenTelemetry collector to send monitoring data? You must replace the realm and access token placeholders in the exporter settings with your Splunk region and token; otherwise Splunk won't accept the monitoring data. ### Where do you go to investigate detected threats in the self-hosted Splunk deployment? Go to the alerts section to investigate any potential threats or unusual behavior detected by Splunk. ## Alternatives - Better Stack: AI-driven monitoring platform providing incident management, real-time logs, uptime, traces, error tracking, infrastructure analytics, and… - Datadog: Datadog Agent is an on-host monitoring agent that collects metrics, logs, and traces from hosts, containers, and Kubernetes clusters and se… - Flink: Apache Flink is an open source distributed framework for processing data as continuous streams or batch jobs. - Fluentd: Fluentd is an open-source log collector that gathers events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, H… - Grafana: Grafana allows you to query, visualize, alert on and understand your metrics no matter where they are stored. - Grafana Loki: Grafana Loki is an open-source log aggregation system. - Graylog: Graylog is a centralized log management platform built on open standards for capturing, storing, and analyzing terabytes of machine data in… - HyperDX: An open source observability platform: Unify session replays, logs, traces, and errors – all without the Datadog price tag. - Logstash: Logstash is a server-side data processing pipeline that ingests data from many sources, transforms it, and forwards it to a destination suc… - Prometheus: Prometheus is a systems and service monitoring system. - VictoriaMetrics: VictoriaMetrics is a fast, cost-effective, and scalable open-source time-series database that stores long-term monitoring metrics, accepts… - Wazuh: Wazuh is a free and open source security platform that unifies XDR and SIEM protection for endpoints and cloud workloads. --- Source: Our Local Host (https://ourlocalhost.com/app/1132/splunk), the self-hosted and open-source app directory.