Splunk Enterprise

My main use case for Splunk Enterprise Platform is log aggregation and SOC operations.

For log aggregation and SOC operations, any alerts that are generated by detection tools go into Splunk.

Once those alerts are in Splunk, analysts review them manually.

The most useful feature that Splunk Enterprise Platform offers is the integration with data sources.

Integrating with various data sources has made my work easier and more effective.

I have logs coming in from network devices, endpoints from different operating systems, RADIUS or other NAC tools that might have all kinds of different formats, and then it's all there in Splunk.

Splunk Enterprise Platform has positively impacted my organization because it works and solves the problem that we have.

It allows us to satisfy compliance audits because having the data there in Splunk allows that reporting to be generated.

We are able to satisfy compliance reporting requirements since implementing Splunk.

I would prefer to have real-time reporting as opposed to just schedule-based jobs with Splunk Enterprise Platform.

The user interface for search results is slower than it should be, and we would appreciate higher performance.

These are the top two needed improvements for Splunk Enterprise Platform.

I have been using Splunk Enterprise Platform for ten years.

Splunk Enterprise Platform has been very stable in my experience with no issues of downtime or reliability.

Splunk Enterprise Platform's scalability is good.

The clustering capabilities allow us to scale it as our needs have grown.

I have not had to reach out to customer support for Splunk Enterprise Platform.

I have not personally used a different solution before Splunk.

We have used Splunk for a long time.

Before choosing Splunk Enterprise Platform, everything was already in Splunk.

Splunk being an open source deployment at the time was really just traditional syslog, not necessarily all the different products able to aggregate logs to a single space.

Splunk is not doing any managing or controlling of governance within a private network environment.

Splunk is reporting on access control and compliance and policy, but it is just reporting.

My experience with pricing, setup cost, and licensing for Splunk Enterprise Platform is that the add-ons feel very expensive.

The ingest license—I was fortunate to piggyback off of a parent organization that had an ingest license that was more than we needed—but then there are extra features that we would get that feel priced out of reach.

The primary drivers for evolving my use of Splunk's federated search for querying data in place have been compliance and to some degree security.

Trusted control plane does not sound familiar to me regarding maintaining granular control over data using it within Splunk.

Role-based access control is going to always have to be there as my organization considers new use cases and agentic AI, and what role the AI agent needs to have is a good question.

My advice to others looking into using Splunk Enterprise Platform is that it depends on your use case.

If you are similar to our organization, then the clustering is probably the way to go.

I would rate this product an eight out of ten.

My main use case for Splunk Enterprise Platform is security logging. For security logging, we bring in Windows event logs and other logs from data sources and ingest them into Splunk Enterprise Platform.

Splunk Enterprise Platform impacts my organization positively by making it easier for us to meet security compliance requirements. We can use Splunk Enterprise Platform to set up alerts or reports that match the security controls and use that as artifacts to meet those compliance requirements.

The best features Splunk Enterprise Platform offers are the ability to search the data and having it all in one space.

Having all my data in one place and being able to search it helps me day-to-day by making my investigations easier and faster.

I do enjoy the dashboard feature and the alert feature, but I hate the new UI that was released with Splunk 10. The dashboards and alert features help me in my work by making it easier for me to set up reports and alerts for very specific things, and then I can make the important things pop out or create graphs and charts. However, I find the new UI terrible. I wish they would let us use the classic Splunk UI instead of the new Cisco UI.

It would be a lot more beneficial to have greater visibility into things that run, such as Splunk Universal Forwarder, because it is very hard to manage, and there are a lot of features that are missing that are available in some of the competitors.

Being able to parse the data at the source rather than having to send it into Splunk Enterprise Platform would be nice, and being able to deep dive into different agents without having to wait for the logs to come in would be a great improvement.

I have been using Splunk Enterprise Platform for almost five years.

For the most part, Splunk Enterprise Platform is stable.

Splunk Enterprise Platform's scalability is fine.

I have never had a problem with customer support.

I did not previously use a different solution before Splunk Enterprise Platform.

I have not seen a return on investment; our license costs have only gone up every year, and there has not been any return on investment.

My experience with pricing, setup cost, and licensing is that it is expensive.

I did not evaluate any other options before choosing Splunk Enterprise Platform; I came in and we had Splunk Enterprise Platform, so that is what we went with.

My advice to others looking into using Splunk Enterprise Platform is to not use it. I do have additional thoughts about Splunk Enterprise Platform. My overall review rating for Splunk Enterprise Platform is six out of ten.

Our main use case for Splunk Enterprise Platform is collecting syslog information from our servers and network equipment, and then generating alerts based on some security events.

I recognize that we are underutilizing Splunk Enterprise Platform.

I do not use Splunk Enterprise Platform much myself, but I took a class on the search application, and the ability to go through all the logs and perform searches and analyze the incoming data is very helpful.

I appreciate the fact that you can create searches and then create custom fields that you can later query for additional insights in Splunk Enterprise Platform, which was very helpful compared to the previous tool we used.

Splunk Enterprise Platform has reduced time in our workflow; we are able to find or correlate events much quicker, making my team's work easier so they can focus on other priorities.

I believe I am too new to provide feedback about how Splunk Enterprise Platform can be improved, but so far, what I see looks very good.

We have had some frustrations with the amount of data we are sending to Splunk Enterprise Platform, as sometimes it contains information that is not needed, but that is more about my team needing to understand how to parse through that data before it gets sent to Splunk. What we need more is additional training.

My team has been using Splunk Enterprise Platform for a little over a year.

Splunk Enterprise Platform is stable.

We have not tested Splunk Enterprise Platform's scalability yet; our deployment is stable and not changing.

Customer support for Splunk Enterprise Platform is very good; whenever we have questions or are trying to do something, we can call support and get the help we need, and there is a ton of information available on the web that we can rely on.

We used a different solution before using Splunk, but I cannot disclose which one it was; the support for that solution was very poor, combing through the data was clunky, and the price was very high.

I chose a 10 for my rating because, from the feedback I have received, it was easy to implement, and it was as easy to ingest data into Splunk as it was from our previous solution, making data ingestion great and easy to use for my team.

I would rate Splunk Enterprise Platform a 10; so far, no negative things have come out.

I would say our return on investment with Splunk Enterprise Platform was in time saved, as we have saved about 30 hours a month.

We were able to track some metrics that indicated success in reducing TCO with Splunk's non-indexing analytics approach; while we were able to save some money by deploying Splunk, after adding a few extra devices, our ingestion went up significantly, which could have increased costs, but we managed that.

Before choosing Splunk Enterprise Platform, I did not evaluate other options.

Splunk Enterprise Platform's AI capabilities sound very good; I do not fully trust them yet as I would want to see them in a dev environment in my data center first, with just non-production systems, so I would need to see them to really trust them.

I have not tested Splunk Enterprise Platform's AI capabilities, so I cannot speak much about its accuracy and reliability of output, but from what I have seen in the keynotes and presentations, it appears very promising.

I do not have a clear answer regarding Splunk Enterprise Platform's capability to manage data sovereignty at a petabyte scale within my environment.

I do not believe we utilize Splunk's Federated Search.

I am not experienced in maintaining granular control over data using the Trusted Control Plane within Splunk.

As my organization considers new use cases such as agentic AI, I believe Splunk Enterprise Platform's governance and role-based access controls would play a key role by controlling and applying security to our agents.

My advice to others looking into using Splunk Enterprise Platform is to work with a partner to help deploy it and deploy it the right way the first time. I gave this review an overall rating of 10.

I use Splunk Enterprise Platform to get logs from different devices in our organization, and after getting logs, it creates some alerts. I do further analysis on those alerts to determine if they are true positives or false positives.

I appreciate that Splunk Enterprise Platform creates alerts based on pre-described rules. Splunk Enterprise Platform provides better correlation of logs than IBM QRadar. IBM QRadar is more graphically oriented and has a good user interface, but the backend and technical processes are not as strong as Splunk's.

Splunk Enterprise Platform can improve in defense capabilities by blocking suspicious and malicious activities or preventing attacks.

I have been using Splunk Enterprise Platform for almost two years.

I have experienced lagging sometimes with Splunk Enterprise Platform, but this is not the fault of Splunk; it is the fault of deployment and some other team members.

Splunk Enterprise Platform is scalable.

I used IBM QRadar previously. I prefer Splunk Enterprise Platform more.

I appreciate the initial deployment part of Splunk Enterprise Platform because it is very easy. Compared to other products, Splunk deployment is straightforward.

I don't get involved in maintenance, but Splunk Enterprise Platform requires maintenance, and the maintenance team is different in our company.

My company deals with the pricing, so I have no idea about it.

Splunk Enterprise Platform provides better correlation of logs than IBM QRadar. IBM QRadar is more graphically oriented and has a good user interface, but the backend and technical processes are not as strong as Splunk's.

I have experienced lagging sometimes with Splunk Enterprise Platform, but this is not the fault of Splunk; it is the fault of deployment and some other team members. I am not familiar with the feature called Trusted Control Plane. I don't have any information about Federated Search. My company deals with the pricing, so I have no idea about it. Overall, I would give Splunk Enterprise Platform a score of eight point five out of ten. I would rate this product nine out of ten overall.

I work with Splunk Enterprise, Enterprise Security, UBA, and SOAR. We are relatively small because of the amount of automation and AI that we have implemented. Probably 20 people use it, but we are a massive enterprise and we fulfill the purpose across the entire enterprise.

The best features are good dashboarding, excellent search capabilities, and the speed of searching data. My experience in maintaining granular control over data with the trusted control plane is very good. I love federated search. The biggest thing for us with federated search is the ability to use it to do searches into other data planes.

A lot has room for improvement; Dashboard Studio needs significant enhancement. Their SPL, when I am running Agentic workloads, is not well suited to Agentic AI at all, especially when I have Agentic AI agents that are writing their own SPL. The MCD server could really do with a lot of improvement.

The bottom line is that going into the Agentic era, and this is across any data platform, no data platform at this moment in time is built to handle the Agentic AI era. With Splunk Enterprise Platform specifically, I hit a real hard wall at about 300,000 searches an hour, and I could not get above that. That is a real bottleneck.

When I am running Agentic swarms doing investigations, incident response, and other things and querying in code, SPL at its very core is not designed for agents. It is a human language. The volume of searches, even when I am running tens of indexes, does not scale horizontally as I thought it would. Adding more compute does not solve this issue at the volume of searches I am running now. It is fine for humans.

I have been working with Splunk Enterprise Platform through various companies for the last eight years.

Stability is a 10 and scalability, in the human world and context, is also a 10. However, in the Agentic world, it would probably be a four or a five.

The only real competitor is Elastic, and it is much of a muchness. There are a couple of other SIEM vendors and SOAR vendors that are also good. If I had to go to cloud, I would probably go to Google SecOps before I go to Splunk Cloud, but for on-premise, you would be hard-pressed to beat Splunk Enterprise Platform.

We use Agentic AI for other things, but we do not use it for granular access control. I have built entire Agentic AI workloads and I have extensive experience using Agentic AI. It has been a multi-year journey and challenge. If I am running it on-prem, governance management is great. I would rate this solution an 8 overall.