App47 Selects Loggly Over Splunk for Log ManagementSeptember 19, 2012
by Nicole Laskowski
Sometimes, it pays to be the little guy.
Just ask App47, a mobile application management (MAM) provider based out of Reston, Va. When searching for a partner that could corral machine-generated log files and organize them into a searchable format, App47 whittled its choices down to include the well-known Splunk Inc. and the lesser-known Loggly Inc., both headquartered in San Francisco, Calif.
In the end, App47 chose Loggly, which was founded by former Splunk employee Kord Campbell, because of its Software as a Service (SaaS) deployment option and because Loggly took an interest in the company, said Andrew Glover, App47's chief technology officer.
Chaos in the app world
Unlike mobile device management software, which focusses on managing smartphones and other handheld devices, App47's MAM offering provides security, deployment options and analytics at the mobile application level.
Managing those applications can be tricky because, in today's world, apps have to be tweaked for different operating systems, different devices and even different versions of those devices, according to Glover.
"Once you build an app and it goes out into the wild, you just don't know how people are using it and what they're doing," said Glover.
While the App47 team had the in-house talent to collect the data and create analytical algorithms to serve up in customized dashboards, figuring out how to index machine-generated logs and make them searchable wasn't as straightforward, Glover said. Those logs were an important piece of the puzzle because they can provide valuable insights when an application is misfiring or malfunctioning.
"When Joe Blow uses your app and it crashes, you want as much information as possible," Glover said. "That's what we capture for them. This is real-world debugging on devices."
App47's choice ultimately came down to building the functionality itself or buying it. They considered both, but when it came down to it, building a log management feature meant, "You still need to know the nuts and bolts," said Glover.
That left the company having to select which company to purchase the technology from, a short list of vendors that included both Splunk and Loggly.
Splunk vs. Loggly
A December 2011 article from The New York Times called Splunk "a wily start-up" whose clients included Macy's and Edmunds. In April, it generated considerable buzz with a closely watched initial public offering (IPO). But that kind of a high profile was actually a turnoff to App47, according to Glover.
"We would get lost in the shuffle," he said. "Certainly [Splunk was] dealing with startups, but I think [its] focus is on the IBMs and the Proctor & Gambles of the world."
Loggly, on the other hand, could stand in as App47's stunt double; in terms of youth and size, the two companies are similar. Those characteristics, according to Glover, translated into more of a personalized service, such as contact with top Loggly executives and a voice in feature development.
"Working with Loggly, we felt like we were partners," Glover said. "That was a major difference."
Glover said Loggly didn't initially support Java Script Object Notation (JSON) document indexing, but a couple of weeks after App47 asked for it, they emailed information about a new JSON feature.
Plus, Splunk would need to be deployed on-premises, while Loggly offered a cloud-based Software-as-a-Service product. Splunk has since released its own SaaS-based product called Storm.
App47, a mostly SaaS-based company itself, gathers data from a client's mobile application, using session data or event data for analytics, and then sends log files, the second biggest form of data it receives, to Loggly for indexing and storage. (App47 has an on-premises option as well, which it provides through ElasticSearch.)
The actual deployment went smoothly, and, according to Glover, the Loggly technology was up and running in just a matter of days, though not without a few challenges.
The running of the logs
Logs collected by App47 are placed in a queue and shipped over to Loggly, but because App47 receives so much data -- more than one million log messages in a 24-hour period -- the queue can become backed up.
"It won't go down, but it will get slow, and it will back our queue up," said Glover. "That hasn't happened in a while, but it happened enough that I was kind of having a day-to-day conversation with their support team."
To Loggly's credit, Glover continued, they spent the time working with him until the problem was fixed.
"It's kind of nice, when you're a small company, being able to deal with human beings," he said.