Question

Looking at Splunk, http://www.splunk.com, it looks like a very nice platform for analysing how a system is performing in relation to the actions users are taking.

A Ruby on Rails implementation is provided, but it would seem to only offer traditional analytics.

Is there either:

• A way to use Slunk to monitor events defined in the code of a rails app?

or

• A better tool for the job?

Thanks!

Answer 1

There’s no ruby-specific query handler for ruby generated logs. It’s certainly possible to build one by

• Defining how to acquire the fields from ruby-style generated logs (as linked above)
• Defining how to translate your desired syntax to splunk’s search language, which would be probably, for that query “sign_up referer=bla”

Splunk is extensible in various ways. For example, it would be pretty possible to author a search filter which can narrow the set of events in ruby, parsing a ruby expression. The splunk search language has its own ideas about quotation marks, backslashes, and pipes, but the rest of the text would be up to the filter. However, the core performance optimizations of limiting the search to events containing substrings is currently only possible in the splunk search language syntax.

That said, if your data set is very small, and the analysis you want to do limited in scope, then maybe some custom ruby solution is closer to what you want.