Splunk Enterprise

The team I work on is a workflow team for the bank. We get a lot of traffic because of onboarding and workflow processes, which results in around a million hits per day. Whenever we have a release scheduled, Splunk Enterprise Platform  is a very useful tool for me to monitor the logs.

Splunk offers an advantage where I can log and monitor all of the microservices in a single location. Search Processing Language (SPL), which is the query language for the product. SPL does take time to master as it is somewhat complex. When searches are straightforward, then it is quick, but if you need to perform complex searches with multiple pipes, sub-searches, or statistical functions, then it becomes somewhat confusing. You need time to become familiar with it.

I created some Splunk Enterprise Platform  dashboards, which is the main focus of my work. I used a drag-and-drop builder, and it has real-time updates, visualization varieties, drilldowns, and token inputs. I built a dashboard for the application which answered these questions: which workflow combination has the highest hits and which users are triggering them. I wrote a query using SPL which aggregated the results from the API in the given timeframe that we can choose, and accordingly it will show a pie chart. Using the drilldowns and tokens, I built another panel where if you click a particular combination, it will list the number of users hitting that combination and how many times. This is something very useful I found in Splunk Enterprise Platform dashboards.

Regarding the downsides of Splunk Enterprise Platform, as I mentioned, one is the Search Processing Language is somewhat complex when it comes to complex filtering and searching. You need to become familiar with it to make complex searches. That is one thing.

There is not a no-code option for panels. You have to write an entire query for it. It would be better if they could introduce more drag-and-drop options so that people can add more features to their panels and pie charts and visualize the data they want.

I have been using Splunk Enterprise Platform for 1.5 years.

Considering the stability of Splunk Enterprise Platform, it is pretty stable. It sometimes takes time when I switch the timeframe, such as from 15 minutes to one hour. It takes some time in loading all of the logs from the application. Otherwise, it is very stable. It is a latency issue.

As I mentioned, the current application I was working on already has a lot of users. So it is a pretty scalable solution. We get millions of hits for the APIs.

When I joined the company, Splunk Enterprise Platform was already in place from the very start. Many of my friends work in several different companies, many uses DataDog, but here, I have only used Splunk Enterprise Platform.

I am not involved in those kinds of decisions yet. I do not know about the pricing.

The whole bank uses the same tool to monitor their logs and analyze production data or any environment data. That is why I have not had any chance to use an alternative.

I am not familiar with the pricing because being a junior developer.

Splunk Enterprise Platform offers Federated Search, which I have not used.

My overall review rating for Splunk Enterprise Platform is 9 out of 10.

My main use case for Splunk Enterprise Platform  is as a SIEM /SOAR .

I use Splunk Enterprise Platform  as a SIEM  where we send all the relevant logs including firewall logs, EDR logs, authentication logs, application logs, and database logs towards Splunk, and then we write rules based on that.

Day-to-day, it is mainly used as a SIEM solution to look at all the security events and write the rules.

Splunk Enterprise Platform offers very good integration patterns and extensive support for many log sources with pre-built rule sets and pre-built integrations. It also has a wide variety of support sources.

Those integrations and pre-built rule sets help my team in our daily work as they made the integrations much faster and easier. Using the community rules was also much faster.

Splunk Enterprise Platform has very good retention and log ingestion methods. The log querying is also pretty good.

Splunk Enterprise Platform has positively impacted my organization by providing very good insight into the different security logs.

I have seen specific outcomes or improvements with Splunk Enterprise Platform, where the time to respond is pretty good. The time to write a rule is very fast, and the time for integration to the different log sources is very good.

One area where Splunk Enterprise Platform can be improved is that the underlying search architecture is not up to the mark compared to something Elastic. This could be improved.

I wish Splunk Enterprise Platform could do more towards AI and use AI to help in SOC automation.

Regarding Splunk Enterprise Platform's AI capabilities, I think its governance and security are pretty good, but not up to the mark.

Regarding Splunk Enterprise Platform's AI capabilities, I feel that its accuracy and reliability of output are still in the nascent stages, although it is pretty good.

I have been using Splunk Enterprise Platform for about to three years.

Splunk Enterprise Platform is stable.

Splunk Enterprise Platform's scalability is very good.

The customer support is very good.

I would rate the customer support on a scale of one to ten as an eight. They are able to query and answer most of the questions.

We have used many solutions before, including Sentinel  and Elastic, which we use in combination.

I feel I have seen a return on investment, and my general impression is that it is a great product.

My experience with pricing, setup cost, and licensing is that the setup costs and licensing are pretty high.

Before choosing Splunk Enterprise Platform, I evaluated other options including Elastic.

My advice for others looking into using Splunk Enterprise Platform is that it is a great solution, but it is a little expensive. I would rate this review a seven out of ten.

I mainly work on log management and observability for our platforms. We use Splunk Enterprise Platform  for the collection of logs and primarily for the observability of dashboards related to incident management and our application performance.

The feature I appreciate most about Splunk Enterprise Platform is the Search Processing Language, which is very flexible. It allows me to write complex queries and perform statistical analysis to create better dashboards and visualization capabilities. Through this, we can visualize our systems and manage incident management properly.

Our team primarily uses the technical capabilities for log management and observability of our systems and the performance of our applications. Our team operates mainly in the technical domain.

A major factor I dislike about Splunk Enterprise Platform is the cost. Since the cost is based on data ingestion or the volume of data, large logs or large volumes of logs sometimes increase the ROI and overall cost of the product for us. This direct relationship between cost and data ingestion volume is an area I dislike and where there is room for improvement.

On a scale from one to ten, I would rate Splunk Enterprise Platform overall 8.5 out of 10. The area where it can be improved is mainly the cost. Otherwise, the features and quality of the platform are very good. Splunk Cloud and Splunk Enterprise help reduce MTTR, Mean Time to Resolution, since incident management is faster. Additionally, the visualization and observability of the entire organization infrastructure and application performance are consolidated in one place, as data is collected in a central location. Overall, the features and aspects of Splunk Enterprise Platform are commendable, but the cost aspect could be improved.

I have been using Splunk Enterprise Platform for more than one year.

My impression of the stability of Splunk Enterprise Platform is that the stability is much better, and we can also scale by cluster indices if needed. The stability and scalability of the platform meet our requirements and are functioning properly.

The scalability of Splunk Enterprise Platform is such that we can scale by cluster indexes as needed. The scalability is appropriate to the standards we require.

I have not contacted the technical support or customer support for Splunk Enterprise Platform much because the procurement part was managed by our finance team.

Previously, we were using open-source tools such as Prometheus and Grafana  for our dashboards, visibility, and monitoring. Additionally, while selecting tools, we tried ELK for some time. However, we are currently using Splunk Enterprise Platform.

The initial deployment of Splunk Enterprise Platform is very easy because it was primarily done by our infrastructure team. The deployment was easy, especially since our deployment model is cloud-based. Although there is an on-premise setup available, we are not using that much, but the cloud-based deployment was very straightforward.

For the initial deployment of Splunk Enterprise Platform, two or three people were involved, though I am not entirely certain of the details because the organization was using this tool before I joined.

Granular data access is mainly for controlling data that gets ingested. I understand that granular control over data gives us the ability to restrict how much data we want, thereby helping us reduce the cost of Splunk Cloud.

I am not using the Federated Search feature of Splunk Enterprise Platform because we primarily use SPL queries for our log management and database visualization.

Splunk Enterprise Platform does not require any maintenance on our end since it is a cloud-based system, so I do not think we require any maintenance for that.

My impression of Splunk Enterprise Platform's capability to manage data sovereignty at a petabyte scale within my environment is that our data is collected at a centralized location for all our metrics and logs. Having it in one place helps us for better visualization and data sovereignty because our data is in one location, which reassures me that our data is not being leaked or used by other AI tools or any other third-party applications.

My impression of Splunk Enterprise Platform's approach to managing governance within a private network environment is that governance is managed by the security team. From my experience, the governance and compliance for the data of our organization with Splunk Enterprise Platform follows mainly SOC 2. I am not fully aware of all the details, but I know that it aligns with best practices in the market, which is why our security team has approved it.

I would rate Splunk Enterprise Platform overall 8.5 out of 10.