Relatively good Splunk replacement: logstash with kibana. Obviously, setting it up is way more complicated than setting up Splunk, but it offers similar - but not as complete - feature set.
First, your requirements:
Easy installation: fail. Installing logstash and kibana requires multiple steps. No official rpm packages are available. I recently evaluated all free log managers I could find, and there were no feature rich alternatives that were easy to install.
logs gathering and indexing: check. logstash collects and indexes logs from files or through syslog, among other mechanisms. Everything is indexed to ElasticSearch.
searching logs: check. ElasticSearch provides good searching and filtering facilities.
monitoring and alerting: check? logstash supports alerts based on message rates and values.
web gui: check. Kibana offers decent web GUI for logstash.
In my experience, the main differences between Splunk and logstash/kibana are following:
- In Splunk, virtually everything is configurable from UI, and built-in. This includes things like user authentication. With logstash/kibana, that's not the case. Both logstash ("backend") and Kibana ("frontend") have plenty of options that are not too well documented, and require tweaking settings files or templates (or code).
- Splunk has better performance (but that comes with high cost). logstash architecture supports horizontal scaling to multiple servers, if needed.
- Splunk looks better. For sysadmins, that often does not matter, but for average user, it often makes the difference.
- Splunk parses some log entries better than logstash. However, field parsing in logstash is good enough, and easily configurable.
- With logstash, you have to make more manual decisions (indexing, retention, filters, metrics etc.). Parts of the configuration are hard to change afterwards. With Splunk, virtually everything is configurable at any time, and defaults are good.