Cisco Cloud Observability Operators

My main use case for Splunk Observability Cloud at my current company is monitoring apps. We have a lot of microservices because we sell different SaaS solutions to businesses, so monitoring, tracing, and everything related to that is essential given our microservices architecture.

We have traces and a service map set up where currently we only have two of the apps onboarded. The goal is to get the other four or five apps onboarded so we can have a single pane of glass view of how all of our apps work, how they're all connected, and how the traffic flows through them.

The best features Splunk Observability Cloud offers include in-depth capabilities. From going over it at the boot camp these last two days, there is definitely a learning curve, which could be a positive or negative. It's a positive thing because there are so many features, and it definitely takes a little time to get ramped up, but it is feature-rich with any feature one could think of, whether it's monitoring backends, frontends, or RUM metrics.

Regarding the RUM metrics feature, I'm not entirely sure yet, but we definitely have users of our SaaS solutions, so I can see it being useful to see how our apps load for users, how they are liking them, and what their sessions are like so we can research what it's from our end users' point of view.

I'm still relatively new, but I consider pricing one of the positives of how Splunk Observability Cloud has impacted my organization. From what I hear, they were using DataDog, and the pricing was very obscure, so they made a pivot to Splunk for pricing reasons. That combined with giving us clearer insights into the apps has been beneficial.

Clear insights are important because we host in AWS using ECS Fargate. It's difficult to rely on CloudWatch alone to trace everything that's going on with the apps running in the containers.

There is a pretty steep learning curve with Splunk Observability Cloud. There is a lot going on, which has pros and cons. The pros include the abundance of offerings in Splunk Observability Cloud, but the cons are that there is so much to learn that you need full-day boot camps just to really understand it.

I feel there is a lot going on, and I think some things could be simplified for certain, particularly the menus and how to accomplish things. Additionally, my understanding is that it is expensive to get infrastructure data into it, though I'm not sure if that's AWS's fault or Splunk's. My opinions may change since I just started using the product.

I've just started using Splunk Observability Cloud as I'm new at this company. I previously worked at Choice Hotels for practically my entire tech career. I started at this new company about a month and a half ago, and they use Splunk. I'm at the annual Splunk conference doing a three-day boot camp to learn Splunk Observability Cloud because we use it at this new company. I've been using it for approximately a month at this point.

Splunk Observability Cloud is stable.

Splunk Observability Cloud's scalability appears to be infinite from my understanding since it's a SaaS solution, so Splunk will ingest as many logs as we can send. I have heard that there are some limits on things, but I imagine if we pay for it, we can scale as large as we want.

I have not used customer support, but the people I've interacted with here today at the conference have been great, so I can imagine it's more of the same.

At this company they used DataDog, but at my previous company, we used OpenSearch.

I wasn't here when the setup, pricing, and licensing happened. However, I have heard that it was cheaper than DataDog, which is why we switched.

I have seen a return on investment in terms of time saved. I don't have hard numbers, but using the MCP server has saved me a ton of time. I'm able to multitask and do some work on the side while querying Claude to pull data and traces, which comes back to me rather than me having to manually do it and have that take my full attention.

Splunk Observability Cloud has helped improve my operational performance. I'm quite new, but I would definitely say it has improved operationally. I already got Claude hooked up to Splunk Observability Cloud and the regular Splunk Cloud MCP servers, which has helped me tremendously to be able to track down issues and traces, which could have taken me much longer to do manually.

It's really important for my organization that Splunk Observability Cloud has end-to-end visibility into our cloud-native environment. Otherwise, we're flying blind, especially because some of these new products we're about to release in an early release program require us to know what we're doing and to hit it out of the park to make it a success.

To help our organization scale, we only have two apps piped into it so far. We have acquired a couple of other companies, so Splunk Observability Cloud has allowed us to consider piping in that data as well to get the single pane of glass situation as we continue to build and grow the company.

I haven't noticed any specific outcomes or improvements in lowering the cost of unplanned digital downtime using Splunk Observability Cloud yet. I haven't done a traditional on-call role yet because I'm new to this company. We are beginning our on-call rotation, and I will definitely be leaning on Splunk Observability Cloud more heavily as I am on call and handling outages and after-hours calls. The solution's out-of-the-box dashboards and detectors are great. I'm doing the boot camp at the conference, and creating dashboards and filtering was probably my favorite part. Learning the roll-ups and the functions and how all of that works was excellent. The detectors seem very easy to create, and I appreciate how it creates a border on a chart when that chart is in the alert state.

I haven't really looked into the AI capabilities too much. I have used the AI tool that can help me write SPL, but that's about it. I typically use the MCP server for it and plug it into Claude, which has been my main way to interact with it from an AI perspective.

Regarding the accuracy and reliability of output from Splunk Observability Cloud's AI capabilities, I haven't used it too much beyond creating SPL, and so far there are no issues to report.

Splunk Observability Cloud monitoring consists of spans and traces from applications, events or logs for applications, and infrastructure metrics, along with synthetics. Splunk Observability Cloud includes open-source features such as OpenTelemetry because it has the backend of OpenTelemetry. It behaves as an integrator between various receivers, exporters, and processors, thus providing end-to-end monitoring solutions for microservices and applications.

By using Splunk Observability Cloud, we were able to migrate our current metric system from Splunk Core to the observability platform that has reduced the impacted costs exponentially. Along with that, we have been able to integrate it with other platforms such as Xmatters or Splunk, indirectly creating an observability system for our NOC, as well as business teams to be able to view their insights about their applications and hosts and inventory on a single platform.

The first valuable feature is the backing of open source OpenTelemetry and GitHub. Then the continuous product improvement roadmaps. The great support and involvement by the product team is also valuable. Newer features are getting added on a regular basis.

The CNCF backing has enabled us to get the Splunk vendor to add more features to their own offering for Splunk Otel Collector, as well as us getting more insights into how we can go to a vendor-agnostic platform. OpenTelemetry and observability is still a new and niche skill in the market, and we are trying to get as much as possible into the product and ease the lives of operations teams as well as provide end-to-end monitoring to the business stakeholders.

One thing that has kept Splunk Observability Cloud offering a little bit behind their competitors is the ability to have a config management tool for all their OpenTelemetry collectors. Though it seems that it is already in the roadmap, however, the official release has not yet happened and also does not yet comprise of all the features that a config management tool should have.

Splunk can go ahead and integrate a GUI using the OpAMP protocol so that we are able to manage our fleet of collectors remotely, perform the upgrades of the collectors, perform restarts when required, or change of configurations via Splunk OLLY UI itself.

I have been using Splunk Observability Cloud since almost three years.

I have experienced stability issues.

Splunk Observability Cloud scales beautifully. We are able to scale it as per our requirements.

Customer support is good. The product team always has open arms for any of the newer features that we would like to request. They take feature requests in a constructive way. Whenever there are newer features that we would like Splunk Observability Cloud to have, they consider them. The generic Splunk vendor support is also good.

For observability related use cases, we did not use any previous solutions. Splunk Observability Cloud is something new that has been added as a newer offering to our wider teams and stakeholders.

Splunk Observability Cloud is a vendor purchase.

I am not certain how we would rate on the investment side of it. However, there have been a lot of teams that have started coming on board to our product from the operation side. Everyone does see a return on investment on this particular observability monitoring solution.

I am not familiar with the pricing model. Our architect or the relevant team may have more insights into it.

We did not evaluate other options. Splunk Observability Cloud had everything that we required it to be. The team who had discussions on their pricing and the monetary value of it were also happy with the product offering.

On a day-to-day basis, my task is to create more synthetic tests for endpoint monitoring that comprise various steps. These can span uptime tests or browser tests or also digital experience for real user monitoring. I am also responsible for monitoring and onboarding new hosts or Kubernetes clusters to monitor their infrastructure metrics or any instrumentation for application ranging from Python, Java, or manual code instrumentation.

It is very important because ours is a payment-facing application. We need to be informed in case any services related to the payment are not working or the payments are failing anywhere or at the back end, the infrastructure has any limitations or capacity restraints which is causing the services not to run as intended.

It has been a really great journey so far with Splunk Observability Cloud and we are keen to go ahead with the journey and with the vendor and the product. At the same time, we are also looking at vendor-agnostic solutions because it is an open-source backed application. For scalability of the organization, it has greatly affected and helped us out in terms of adding more and more hosts that are being monitored.

The value was visible to the relevant audience as soon as we started the implementation. Where it took the people a lot of manual efforts and time to diagnose their systems, they were able to get automated insights as an available feature within Splunk Observability Cloud.

Most of the dashboards and detectors that are out of box are great. I would say that dashboards are excellent. Detectors not so much because there are custom use cases that need to be built. Dashboards are definitely great, though. I would definitely recommend going for Splunk Observability Cloud. I would rate this review as a 9 out of 10.

My main use case for Splunk Observability Cloud is real-time monitoring of infrastructure and applications, and I mainly use it to monitor system performance and identify issues quickly to troubleshoot performance or availability problems.

For example, we had a performance issue where an application was responding slowly, and I used Splunk Observability Cloud to check the application metrics and system performance, identified the affected component, and helped troubleshoot the issue, making root cause analysis much faster.

Splunk Observability Cloud also helps us monitor trends and detect potential issues early, and the centralized dashboard and alerts make daily monitoring and troubleshooting much easier.

The features that stand out most in Splunk Observability Cloud are real-time monitoring, customizable dashboards, powerful alerting, and infrastructure and application performance visibility, which make troubleshooting faster and help us identify issues proactively.

Splunk Observability Cloud has improved our monitoring and troubleshooting by giving us better visibility into system and application performance, allowing us to detect issues faster and reducing the time needed to identify and resolve problems. Issues can be identified and resolved faster because of real-time monitoring and alerts, and while I do not have an exact percentage, it has improved troubleshooting efficiency and overall system visibility.

Splunk Observability Cloud could be improved with more advanced troubleshooting tools, better dashboard customization, and more intelligent alerting, as these improvements would make monitoring and issue resolution even faster.

Better integration with third-party tools, more detailed reporting, and similar configuration would make the day-to-day experience smoother.

I have been working in my current field for one and a half years.

Splunk Observability Cloud is stable.

Its scalability is high, as it can easily support growing infrastructure and monitoring requirements.

The customer support for Splunk Observability Cloud has been good, with a responsive support team and helpful documentation and support resources when we face issues.

The pricing, setup cost, and licensing for Splunk Observability Cloud were reasonable for the features provided, and the initial setup was straightforward while the licensing model was manageable for our organization.

We have seen a return on investment through time-saving results, as faster issue detection and troubleshooting reduce the time our team spends investigating incidents.

Splunk Observability Cloud has helped reduce the cost of unplanned digital downtime by detecting issues early through real-time monitoring and alerts, allowing our team to respond and resolve incidents faster.

The pricing, setup cost, and licensing for Splunk Observability Cloud were reasonable for the features provided.

We evaluated a few other monitoring solutions, including Datadog and New Relic, before choosing Splunk Observability Cloud due to its strong monitoring capabilities, integration, and overall visibility.

I would rate Splunk Observability Cloud an 8 out of 10 overall.

I chose it because it provides reliable real-time monitoring, good visibility, and effective alerting that helps us identify and troubleshoot issues quickly, and I think better customization and advanced troubleshooting features could make it a 9 out of 10.

Strong governance and security are important for AI capability, and proper access control, role-based permission, and audit logs help ensure that the AI is used securely and responsibly.

The AI output of Splunk Observability Cloud is generally accurate and useful for identifying issues and analyzing performance data, although I would still validate important recommendations before taking action in a production environment.

Our organization uses a hybrid cloud deployment for Splunk Observability Cloud, allowing us to monitor both on-premises infrastructure and cloud-based applications from a single platform.

It is very important for our organization that Splunk Observability Cloud has end-to-end visibility into our cloud-native environment because it helps us monitor the entire environment from infrastructure to application, making it easier to identify performance issues and understand dependencies for quick troubleshooting.

I assess Splunk Observability Cloud very positively for helping our organization scale since it provides centralized monitoring and visibility as our infrastructure and applications grow, making it easier to manage performance and troubleshoot issues across a larger environment.

The out-of-the-box dashboards and detectors are very useful, as they provide a quick view of system and application health without requiring much initial configuration.

I recommend Splunk Observability Cloud for organizations that need real-time and end-to-end monitoring, as it provides good visibility, alerting, and troubleshooting capabilities in hybrid cloud environments.

Overall, I am satisfied with Splunk Observability Cloud, as it provides strong real-time monitoring, good visibility, and faster troubleshooting, being useful for improving our day-to-day operational efficiency. My overall rating for this solution is 8 out of 10.

I work in a financial domain company where we manage customer applications and use Splunk Observability Cloud for event connectors, metrics, and traces.

We monitor our applications and track customer journeys as our metrics and traces for improving our applications' visibility and reliability of our platform.

When I compare Splunk Observability Cloud with other products available in the market, I feel it is very comprehensive.

It gives me the flexibility of parsing data, and at the same time, I can write SQL queries, search my data, have an alert mechanism, dashboards for visualizations, create reports, and monitor my infrastructure using that application.

Multiple benefits come from having Splunk.

This single product can handle my infrastructure observability end-to-end, not just for the application, but also for the underlying infrastructure.

Splunk Observability Cloud has helped to improve not just the operational performance but also the entire enterprise platform reliability, as well as the availability of the entire platform, which has greatly increased because of it.

If something is about to happen or some of my servers are having issues, Splunk triggers an alert before something actually happens in the production.

It gives me that flexibility, so I can monitor and check the health of my underlying infrastructure.

Before something major happens, it alerts me so that I can look into this, investigate, and fix it.

The out-of-the-box customizable dashboards provided by Splunk are really good.

Whatever my requirement is, whether tree leaves or chloropleth or any other kind of dashboard, they are really good.

The customization helps me to create a view that is specific to my requirement, so they are really helpful.

The tool is very good, but I feel it is very bulky.

For a huge organization, it is easy to get the license and manage costs, but for smaller organizations with just fifteen or sixteen people who have limited data ingestion, it will be a little expensive.

Managing Splunk requires professional people; you need a team to oversee the entire Splunk setup, not just one engineer.

If Splunk could provide at least a beta version that is not this enterprise-heavy, that would be a great thing.

The pros of Splunk Observability Cloud are that it is enterprise-specific and a very comprehensive and extensive tool that covers almost all wider areas where an observability platform is required.

The cons are that it is quite heavy; you require dedicated servers to handle your Splunk Enterprise instances, rather than just being able to install Splunk onto an application server or any other server.

You need a heavy infrastructure to maintain these Splunk Enterprise instances.

I have been using Splunk Observability Cloud for the last six or seven years.

Splunk Observability Cloud is very stable.

I have never seen any glitches or experienced any lag unless the underlying server is unhealthy or the underlying infrastructure is not good; Splunk remains very stable.

Splunk Observability Cloud scales very well with the growing needs of my organization.

Scaling up and scaling out is easy, but only if I know how it has been installed and how it has been set up.

I just create other instances following the same standards as the initial ones.

However, if the pre-work is not done well, then it becomes very complex.

The technical support team of Splunk is very prompt and helpful.

There are three mechanisms to reach out to them: via call, email, or chat support.

Email responses take twenty-four hours, call support is instant, and we have opened on-demand services with this plan.

I would rate their services as eight point five out of ten.

Whenever we raise cases with the Splunk team, they are very prompt, and we have that on-demand support, which is really good.

I have previously used Cribl, which we use very extensively along with Splunk for our observability, in addition to Grafana and an in-house tool called ELK.

The initial setup and deployment part of Splunk Observability Cloud is complex; it is not straightforward.

To set it up in a professional way, as an enterprise would, requires a lot of professional hands.

It is not as easy as just installing and being ready to use.

To make the best use of it, everything has to be standardized.

I find it cost-effective in larger organizations like financial companies such as Goldman Sachs, JPMorgan, or Chase. For huge enterprises, it is easy to get licenses and set up a team, which they actually need because these organizations require professional people to take care of observability.

In reference to smaller startups with just fifteen employees whose requirements are not much but want to set up observability, it may be different.

However, for my organization, it is very cost-effective.

I directly purchased Splunk from Splunk Enterprise, not through the AWS Marketplace.

I am using Splunk, Cribl, ELK, and Grafana.

These are the platforms that I am using.

The customizable dashboards in Splunk are definitely helpful when it comes to showcasing IT performance to business leaders.

The reason is that leadership does not have much time to go through events and summaries, so they visualize.

When we present anything in visualized form, it is catchy and easy for them to look into the KPIs and metrics rather than going through the entire data and summary.

I do not think there are any missing features in Splunk that I would like to see included in the future.

As far as I have explored Splunk, I feel it is a very comprehensive tool.

It does not miss out on anything.

I would give a really positive review about the No-Sample Tracing feature in Splunk.

It is a good feature that Splunk has.

Having this AI-powered analytics and guidance from Splunk helps me in issue resolutions.

Splunk has that AI capability, which aids in writing the queries, and if I want to create something, instead of navigating and doing it myself, I can just create a prompt, and the prompt helps me to create those kinds of features in my Splunk.

We are using the ability to enrich data with custom metrics in Splunk Observability Cloud.

We create Excel files, upload them, and that reads specific items, enriches the data, and removes duplicates and unnecessary events, providing the key-value pairs that are actually required for us. It is very helpful.

My advice for others looking into implementing Splunk Observability Cloud is straightforward.

If a person who is purchasing Splunk Enterprise has more than five hundred users, it is good to go for it.

Splunk Observability Cloud is very effective.

If I were to rate it out of ten, I would generally give it somewhere around eight or eight point five.

Splunk Observability Cloud has effectively helped me lower my downtime.

Since I have a platform that is constantly monitoring my infrastructure and keeping an eye on the health and metrics of my infrastructure, if any applications or servers are about to go down, there is a lot of noise on that specific infrastructure, and it triggers an alert so that I know what is about to happen.

I can investigate that before something actually breaks.

At the same time, if something goes down, I actually know the root cause of where it has broken.

It has helped me greatly.

Instead of investigating end-to-end, I know the root cause prior and where to look into, so it has helped us a lot.

I gave this review a rating of nine out of ten.

Splunk Observability Cloud is used to monitor the health and performance of cloud infrastructure and microservices, providing infrastructure applications and their health insights for security insurance as well as correlating performance anomalies.

Regarding the feature sets of Splunk Observability Cloud, the primary benefit is real-time infrastructure monitoring. Additionally, APM (application performance monitoring) is provided, which helps to obtain intelligent alerting with the aid of log and metric correlation available in the portal. There is also an AI-driven analytics add-on.

Regarding the detector functionality of Splunk Observability Cloud, the intelligent alerting mechanisms in the observability platform have been observed and implemented. These help to obtain continuous metrics with predefined conditions that are automatically generated whenever the performance threshold has increased or when high volumes of traffic or anomalous behavior have been identified by the detectors. This helps to achieve benefits such as proactive monitoring, real-time alerting, and faster instant responses.

This has helped regarding the monitoring of blind spots by improving the inline visibility of infrastructure with Splunk Observability Cloud, which helps to correlate metrics, traces, and logs from a single platform, enabling the identification of issues that might go unnoticed within a single system. It also helps to reduce troubleshooting time.

In Splunk Observability Cloud, the AI analytic engine detects anomalies and prioritizes critical issues, which helps with prioritization as the main concern is to get alerts resolved within a timeframe to improve MTTR. It also accelerates root cause analysis by correlating metrics and traces within the dependencies.

For example, in a case where an application response gradually increased over a certain period, increasing CPU and memory consumption, which was normal, the AI analytics capabilities detected the anomaly based on historical behavior and generated an alert before users monitored these dashboards. This had a noticeable impact, enabling proactive investigation to reduce troubleshooting time.

The problem that was to be fixed with the help of the RCA detections is that Splunk Observability Cloud streamlines the entire engine lifecycle, helping to identify the root cause. The AI-powered detection and anomaly detection in Splunk Observability Cloud identify performance issues in real-time, generating alerts before they significantly impact customers, and proactively detecting errors. Engineers can correlate metrics, distributed traces, service maps, and logs to follow the request path and identify issues.

A specific instance where Splunk Observability Cloud identified the root cause across a hybrid environment, which would have typically required manual integration to solve, occurred when users reported an ecommerce application that was loading slowly. A detection was received from the detector indicating that the API response time had increased from the normal baseline threshold. Using RCA analytics tracing, the engineer followed the user request through the application, revealing delays occurring in the database query while correlating metrics, indicating increased CPU and query division. That aspect required troubleshooting. Based on these insights, the team optimized the query response by improving the port sizes, resolving the issue within the time limit.

With regard to visibility into the entire AI stack including LLM performance, GPU utilization, and vector stores, this has changed the ability to manage the nondeterministic nature of AI applications while maintaining cost and quality standards. Traditional applications give the same input and the same output, while AI applications evaluate quality and relevance based on dynamic perspectives and the availability of data, focusing on response qualities, latencies, and token usage. Changes in latency monitoring have been implemented that help generate responses.

The integration of business context in the telemetry has helped to reduce MTTR by fifty percent, which has been the key metric.

The key benefits of Splunk Observability Cloud are related to performance monitoring and service monitoring that provide end-to-end visibility. It offers unified infrastructure and operations, such as Kubernetes and cloud services, all within a single platform, which helps to maintain end-to-end visibility. Furthermore, it provides real-time monitoring that helps to continuously assess the health of applications.

Splunk Observability Cloud has helped improve operational performance and company resilience, as members have access to all in one place, which significantly reduces MTTR. Additionally, it provides instant responses with the intelligent detectors mentioned, such as the AI-driven anomaly detection, which aids in detecting alerts or performance issues that degrade over time.

MTTD has been reduced by thirty percent as of the current date.

Regarding time to value with Splunk Observability Cloud, the biggest value regarding performance was that the monitoring system did not have to be built from scratch. This is key because within a short period after deployment, actionable dashboards, intelligent alerts, and end-to-end visibility were available.

Enhancements can be made to Splunk Observability Cloud dashboard, particularly the widgets that can help display ROI metrics and streamline setup for detection tuning. These two points are key concerns that should be highlighted.

Splunk Observability Cloud has been used for seven to eight months.

Splunk Observability Cloud is stable when it comes to visibility aspects.

Splunk Observability Cloud would be assessed as a nine out of ten for helping the organization scale.

The tech support of Splunk would be rated as a nine on a scale of one to ten.

Prior to using Splunk Observability Cloud, no different monitoring product was used.

The experience with lowering the cost of unplanned digital downtime using Splunk Observability Cloud shows that while managing critical incidents in the past few weeks, it has helped reduce downtime by providing timely detections using the AI detection-driven mechanism.

The deployment was done in-house, and support was available during the setup process.

A specific instance where Splunk Observability Cloud identified the root cause across a hybrid environment, which would have typically required manual integration to solve, occurred when users reported an ecommerce application that was loading slowly. A detection was received from the detector indicating that the API response time had increased from the normal baseline threshold. Using RCA analytics tracing, the engineer followed the user request through the application, revealing delays occurring in the database query while correlating metrics, indicating increased CPU and query division. That aspect required troubleshooting. Based on these insights, the team optimized the query response by improving the port sizes, resolving the issue within the time limit.

It took approximately two months to build Splunk Observability Cloud from scratch.

No other options or solutions available in the market have been evaluated, as Splunk or Cisco tool stack is already being used. Therefore, the decision was made to go with Splunk Observability Cloud, as the native tools are inbuilt and work well with the systems.

The ability to enrich data with custom metrics in Splunk Observability Cloud is managed by the administration team, and there is no direct involvement in that aspect.

My impressions of Splunk for helping the organization focus on business-critical initiatives show that it is on the right track, with several features including AI-driven analytics and detection, which are quite helpful in reducing downtime, making them key features.

Organizations looking for an end-to-end observability platform with faster root cause analysis, improved uptime, real-time dashboards, alerts, and scalability monitoring should consider the Splunk Observability Cloud solution. This review is rated as a nine out of ten.