We have started using Splunk for syslog collection and reporting due to the performance degradation of Orion's database when pummeled by lots of log and trap data. We also started creating our own apps using Splunk's development tools and their application and add-on community. NPM has syslog and trap data in a SQL database and a Thwack community of developers, so why not open up Orion a bit to allow custom reporting and alerting? Orion has an API, and we can create custom pollers, but this isn't nearly as mature as Splunk's developer network. I already have Orion, so with Thwack and some support from SolarWinds it seems like we could be developing our own add-ins for Orion. With some database performance improvements and a more mature development environment, maybe Splunk can go away.
