Splunk Enterprise

I focus on threat detection against stock trading systems. I am in charge of five to seven stock trading companies' B2C systems for detecting threat attacks. Our customers include several stock trading companies, banks and and large mobile careers in Japan.

We built a threat detection system for our client company, one of the biggest security company in Japan, using Splunk Enterprise Platform . We started a new business on this platform to provide threat detection systems to stock trading system companies and banks, expanding our customer base.

One valuable feature of Splunk Enterprise Platform  is citizen programming, which allows users to manage and compute huge stream-based datasets easily using SPL language. The second feature is its ability to perform matrix-like stream calculations concurrently, improving upon traditional SIEM  tools. Finally, Splunk's Machine Learning Toolkit is offered without charge, allowing users to incorporate machine learning in their business logic, aiding in procedures like threat hunting.

Splunk could improve by enhancing its graphical view functionality. Compared to other BI tools, Splunk's graphic features are limited; part of customers desire detailed, rich visual effects, like world maps showing threat attacks as animations. Additionally, the deep learning capabilities need enhancing, especially on Splunk Cloud, where customers find it challenging to use deep learning tools without setting up backend computing resources.

I have over 14 years of experience with Splunk Enterprise Platform, beginning my first evaluation in 2011.

I would rate the stability of Splunk Enterprise Platform as a seven. While it requires managing configuration files and processing scale-out operations manually, limiting its auto-scaling capabilities, it still performs adequately.

I rate the scalability of Splunk Enterprise Platform as an eight. Some products can automatically scale, but Splunk Enterprise requires manual configuration changes to achieve scale, which is slightly outdated compared to modern technologies.

I rate Splunk Japan's customer service as an eight. Although I generally provide support myself and do not often rely on Splunk support, this rating reflects general consultant feedback.

Positive

I previously used Elastic Search  and Kibana, but switched to Splunk for ease of use and to define business entities such as branches, channels, and stock accounts.

Standalone Installation was very easy. Designing and capacity planning for a distributed cluster environment was not easy.

I am a Splunk consultant and implement customer solutions myself.

I rate the pricing of Splunk as nine out of ten. The pricing model is based on ingesting data sizes, not user count, and includes a free tier for up to 500 MB of daily data, differentiating it from user-based pricing BI-tools.

I evaluated ArcSight and Manage Engine and made our selection.

# After using Splunk for several years, I conducted further evaluations, but our selection remained unchanged.

# Datadog  was ideal for bug traceback during APM  operations.

# Exabeam  was ideal for use case-centric threat detection.

Overall, I rate Splunk Enterprise Platform ten out of ten. I am dissatisfied with Splunk’s graphics view and deep learning capabilities; they could be better, especially on Splunk Cloud. While I was able to enhance the platform using technologies like JavaScript, most of my clients struggle.However, it will be sufficient for the next few years with it's strong Machine Learning capability.

 Also, it would be preferable for Splunk SOAR  to include sequential Splunk task execution and MCP/A2A support features.