Query Your Hydrolix Data in Splunk With SPL (2025)

If you're a Splunk user, you already know that Splunk has world-class tooling, a powerful query language, and the ability to unify your security and observability data. But it comes with a catch, at least when it comes to high volumes of data: a hefty price tag.

Hydrolix’s custom Splunk connectors can help solve this problem. By using Hydrolix to ingest, store, and query your log data, you can reduce the total cost of ownership (TCO) of your log data by 6x or more, all while keeping the Splunk interface and using a streaming data lake designed for log data at petabyte scale.

Our latest connector, Hydrolix Search for Splunk, allows you to use Splunk Search Processing Language (SPL) to query your Hydrolix cluster directly from Splunk. Hydrolix Search for Splunk is available in Splunkbase (the Splunk marketplace).

With this release, Hydrolix now offers two Splunk connectors:

• Hydrolix Search for Splunk is available in Splunkbase and allows you to use SPL to query your Hydrolix cluster. For simplicity, you can choose from a simple list of fields for SELECT statements with full support for WHERE clauses.
• Splunk DB Connect is a lightweight, custom Hydrolix JDBC driver that uses SQL to query Hydrolix data from Splunk. You can set it up in just a few minutes. With Splunk DB Connect, you have access to full Clickhouse SQL functionality (Hydrolix uses ANSI-compliant SQL based on Clickhouse).

Both connectors provide the same core functionality: the ability to use Splunk's UI for visualizing, alerting on, and analyzing data stored in Hydrolix clusters. To determine which connector is best for your teams, jump to Which Connector Fits Your Use Case?

Benefits of Combining Hydrolix and Splunk

Splunk is a powerful tool that allows you to unify your observability and security analytics in one platform. Combined with a flexible query language (SPL) that uses pipes to refine your query results, it's the observability platform of choice for many teams.

However, Splunk can be very expensive for enterprises that ingest terabytes of log data every day. The average volume of log data has gone up 500% over the past three years. As a result, many enterprises have to choose between paying high costs, discarding data, or moving data into tiered, cold storage where it's difficult to access and analyze.

Some data sources such as CDNs and firewall logs generate a massive amount of data. CDN logs are necessary to ensure that assets like videos are delivered efficiently to users around the world. Meanwhile, firewall logs are just one of many log sources that must be monitored comprehensively for a strong security posture. Comprehensive monitoring of these kinds of high-volume log sources often isn't practical or cost-effective with Splunk.

For enterprises ingesting at least one terabyte of log data per day, it's best to use a specialized tool for high volumes of log data such as Hydrolix. But that doesn’t mean you have to give up Splunk.

With Hydrolix Search for Splunk, Hydrolix can ingest large volumes of data, store it cost-effectively, and then make it available to Splunk to use with SPL and Splunk analytics. The next image shows how Hydrolix's streaming data lake architecture can ingest, process, and store log data for Splunk users.

With Hydrolix, you can:

• Ingest and transform large volumes of log data for real-time analytics. Data is typically ready for seconds after it's ingested even for events generating ten million log lines per second.
• Store data in S3-compatible object storage with compression rates of 90% or more. You get dramatic reductions in storage costs and long-term "hot" data retention (15 months by default).
• Query very large data seconds with sub-second latency regardless of whether the data is a minute or a year old.

With Hydrolix's strengths, it's a great fit for big data use cases like multi-CDN monitoring and threat hunting security data, making it complementary to Splunk's tooling.

Analyze Your Hydrolix Data With Splunk

One common use case for Splunk is needle-in-a-haystack queries, which Hydrolix excels at. For example, with a quick search of CDN logs, you can easily see which IP addresses are most common. This can help uncover an issue such as a DoS (denial of service) attack or other malicious attack (like an attacker trying to breach your network).

Then you could drill into logs from that particular IP address combined with other fields such as status code, time range, and more. The next image shows how you can quickly see the top ten IPs from your query results. In this case, the needle-in-a-haystack might be tracking down log lines from a specific IP and time range in a trillion-row dataset.

Many observability solutions have challenges with use cases like multi-CDN monitoring because they can generate terabytes of data from many different sources. With Hydrolix, you can ingest multiple data sources (such as CDNs) into a single table. As a result, you can easily compare sources later without complex join statements.

You can also slice your data in many different ways with SPL. For example, you could use SPL to determine the percentage for each HTTP status code from all your CDNs logs. The next image shows the results of an SPL piped query that returns the count and percentage of each status code.

With Hydrolix Search for Splunk, you combine the best of both worlds: the analytics of Splunk with a streaming data lake designed for log data. Even better, you can dramatically reduce your TCO by combining Hydrolix with Splunk.

Reduce Your Observability Total Cost of Ownership (TCO) by 6x

Hydrolix can help you reduce the TCO of an observability stack that uses Splunk, typically by 6x or more. You can keep more data for longer and reduce your observability costs. See our pricing estimator to compare the cost of a Hydrolix license versus observability solutions like Splunk, Elastic, and Datadog.

Note that many solutions such as Splunk and Datadog don't offer long-term data retention. Yet Hydrolix is still much more cost-effective even while allowing you to retain data much longer.

Reducing your TCO has multiple downstream benefits:

• No more choosing between your data and your bottom line
• Keep all your data—no discarding data or sampling needed
• Retain data for longer (15 months by default) for security, compliance, and data science use cases
• Reduced friction between teams that need observability and decision makers that need to manage budgets

Too many enterprises ask questions like are we paying too much for observability?

Instead, the question should be: how can we maximize the value of our observability data for more use cases?

By combining Hydrolix with Splunk, you can remove observability gaps while reducing costs. Spend more time asking questions that maximize value for your business instead of worrying about whether your observability tools will break your budget.

Which Connector Fits Your Use Case?

While both connectors have the same core functionality (querying your Hydrolix clusters from Splunk), there are some key differences. The following table explains the differences.

Next Steps

If you're already using both Splunk and Hydrolix, the next step is to choose your connector and get started.

• Read the Hydrolix Search for Splunk docs.
• Read the Splunk DB Connect docs.

If you're a Splunk user interested in seeing Hydrolix for yourself, contact Hydrolix about a trial or demo.