Splunk Enterprise

My main use case for Splunk Enterprise Platform is as a log consolidation tool.

In my day-to-day work, we receive email logs, web logs, and any kind of user activity logs, and we investigate based on anomalies in user activity.

We initiated user behavior analysis, so we're looking for variations from a known baseline.

Splunk Enterprise Platform's best features include the ability to ingest data from any source without having to spend too much time getting the data into a set format.

The flexibility in data ingestion makes ingesting new data sources very easy and very quick for our team, allowing us to have new data sources online within a couple of days.

Splunk Enterprise Platform has positively impacted our organization by giving us insights into user behavior that we didn't have before, enabling us to track and monitor user activity that would otherwise have been missed.

It has led to faster investigations, as typically, we can go from query to resolution within a day.

The ability to delete data is something I would suggest for improvement, as at the moment, you can delete data from search, but you can't delete data permanently, which is an issue sometimes.

I have been using Splunk Enterprise Platform for 15 years.

Splunk Enterprise Platform is stable.

For our scale, Splunk Enterprise Platform's scalability is fine, as we have a relatively small license.

Customer support for Splunk Enterprise Platform is good, but technical support is variable.

I would rate customer support an eight on a scale of one to ten.

We did not use a different solution before Splunk Enterprise Platform; this was our first.

I wasn't involved with the initial purchase, but I understand the pricing, setup cost, and licensing are quite expensive.

I can't share any exact figures regarding return on investment, but we've had Splunk Enterprise Platform for 15 years, so I would say they're happy with their ROI.

I wasn't involved with the initial purchase, but I understand the pricing, setup cost, and licensing are quite expensive.

I evaluated other options before choosing Splunk Enterprise Platform; I can't remember them all, but I think Elasticsearch was one of them.

My advice to others looking into using Splunk Enterprise Platform is to make sure you have a defined use case you can measure against.

Splunk Enterprise Platform is deployed on-premises in our organization.

We don't have it at that scale, but I'm sure Splunk Enterprise Platform would work very well for managing data sovereignty at a petabyte scale within our environment.

We don't use the trusted control plane, so I don't have experiences in maintaining granular control over data using it.

We won't be using Splunk Enterprise Platform with any AI because of the client data we hold, which affects how we manage access to our operational data.

My impression of Splunk Enterprise Platform's approach to managing governance within a private network environment is very good.

The cost of it keeps it from being a perfect ten for me.

For manual searches, we are very happy with the outputs of Splunk Enterprise Platform.

I would rate this product an overall nine out of ten.

Splunk Enterprise Platform is used primarily for our SOC and ingesting all metrics and data from all the virtual machines that we're running in our cloud environment.

A specific example of how I use Splunk Enterprise Platform in my daily work is monitoring CPU usage for VMs, and if CPU credits run out on a burstable instance, we know to add more credits or reconsider how we're using that VM.

The latest best feature Splunk Enterprise Platform offers is probably MCP server, where people in the organization don't need to have knowledge of SPL and syntax; they can just query Splunk Enterprise Platform directly.

MCP server has changed the way my team works and collaborates by democratizing the use of Splunk Enterprise Platform so we don't have to go to someone that knows how to use it; anybody can spin up the co-pilot agent and start querying.

Splunk Enterprise Platform has positively impacted our organization by providing insight into our environment in a centralized manner so that we don't have to set up alerts in a bunch of different places; we just have to look at one place to get what we need.

Splunk Enterprise Platform helped save time; we've had a few issues where VMs stopped responding and we had trouble figuring out what was going on, but we just went on Splunk Enterprise Platform and it was easy to see the data there.

Splunk Enterprise Platform can improve by taking more positive steps towards user-friendliness so that more people can access it without having to go through a bunch of training to learn how to use it.

I have been using Splunk Enterprise Platform for about a year and a half.

Splunk Enterprise Platform is stable.

Splunk Enterprise Platform's scalability is very good; we can just start plugging in indexes as we need.

The customer support has been acceptable; we had an issue that we thought should be easily solvable or something that works out of the box, but it didn't.

I previously used Microsoft Sentinel and switched because we had more places we needed to ingest data from.

I have not seen a return on investment and think we have some internal issues; we really just got Splunk Enterprise Platform for our SOC.

My experience with pricing, setup cost, and licensing has been fairly straightforward; the partner we had to help us set up was pretty good.

I cannot comment on Splunk Enterprise Platform's capability to manage data sovereignty at a petabyte scale within my environment because we're not at that level.

We haven't been using Splunk Enterprise Platform's federated search for querying data in place, so there hasn't been much evolution or primary drivers for either expanding or limiting its use.

I have no experience in maintaining granular control over data using the trusted control plane within Splunk Enterprise Platform; we don't use it much.

I learned a lot at this conference about how we can manage access to our operational data through Splunk Enterprise Platform; we're not quite at that level, but once we are, then I'll have more feedback.

I don't think we use the feature to track specific metrics to evaluate the success of reducing TCO with Splunk Enterprise Platform's non-indexing analytics approach.

My advice to others looking into using Splunk Enterprise Platform is to start small; ingest a little bit of data that you can start to see returns on right away, and then expand from there as you learn how it works. My overall review rating for Splunk Enterprise Platform is eight out of ten.

My main use case for Splunk Enterprise Platform is gaining insights, visibility, and maintenance for on-premise infrastructure.

For insights, visibility, or maintenance, we have a Splunk forwarder on all of our Windows servers, desktop endpoints, Linux servers, and we collect Cisco switch IOS data. For our CCRI, we are required to collect logs from all those devices. Thanks to Splunk Enterprise Platform and SPL, I was able to write queries that would prove that all of our devices were online, checking in, and reporting. I was also able to show us what is actively online at any given time.

The best features Splunk Enterprise Platform offers include a robust environment and platform for all the various devices on the network, an easy ability to update, a great support team from Splunk, which helps us stay on track and expand our functionality, and an ecosystem with so many options to improve visibility of durability and everything else.

The feature I rely on the most or find the most valuable in my day-to-day work is the ability to keep eyes and ears on our network and be able to search for any events that need attention and make sure the network and all the devices are online.

Splunk Enterprise Platform positively impacts my organization by helping us keep all of our devices online and healthy and helped us prove we meet the requirements for the CCRI audit.

When we had a consultant come on site, they installed a bunch of apps, and some of those did not work. In order to go back and clean everything up, we have to go into the back end. It would be helpful if there were a way to look into the installed apps, which ones are being used, and which ones are not being used.

I have been using Splunk Enterprise Platform for two years.

Splunk Enterprise Platform has experienced stability issues.

Splunk Enterprise Platform's scalability for my needs is very good. It scales extremely easily because of our distributed environment and our deployment server, we can expand as needed very easily.

The customer support is second to none. It is some of the best customer support I have experienced in the IT world in 20 years.

Because Splunk Enterprise Platform is such a solid product, we only have two admins. One of them is a Linux administrator, which manages the back end, and then there is me, which is the Splunk admin, which is responsible for searches, dashboards, and setting up alerts. We have been able to keep a small team of only two people and have complete oversight over our network and all of our devices.

Because Splunk Enterprise Platform is such a solid product, we only have two admins. One of them is a Linux administrator, which manages the back end, and then there is me, which is the Splunk admin, which is responsible for searches, dashboards, and setting up alerts. We have been able to keep a small team of only two people and have complete oversight over our network and all of our devices.

Regarding Splunk Enterprise Platform's AI capabilities, we have not used it because it is on classified systems, which are air-gapped networks.

I have not used Federated Search.

In maintaining granular control over data using the Trusted Control Plane within Splunk Enterprise Platform, we have a few users from cybersecurity who have everything under the Power User role, and then we have admins. That is all.

Regarding Splunk Enterprise Platform's approach to managing governance within a private network environment, we use mostly business process as opposed to the technology, so we have not explored that yet, and I would be actually interested in learning about it.

The advice I would give to others looking into using Splunk Enterprise Platform is to understand that it is closer to a marathon than a sprint. If you are new to Splunk Enterprise Platform, it will take a little time to wrap your head around it and understand it. The value is there and your skills will grow over time, and you should contribute time every day or every week to learning and expanding your knowledge in Splunk Enterprise Platform. It is an excellent product.

The people in the Splunk world have been awesome. The conference is awesome. Splunk Enterprise Platform is awesome, and the value is awesome. I would rate this review a 9.