Splunk Enterprise

I mainly work on log management and observability for our platforms. We use Splunk Enterprise Platform  for the collection of logs and primarily for the observability of dashboards related to incident management and our application performance.

The feature I appreciate most about Splunk Enterprise Platform is the Search Processing Language, which is very flexible. It allows me to write complex queries and perform statistical analysis to create better dashboards and visualization capabilities. Through this, we can visualize our systems and manage incident management properly.

Our team primarily uses the technical capabilities for log management and observability of our systems and the performance of our applications. Our team operates mainly in the technical domain.

A major factor I dislike about Splunk Enterprise Platform is the cost. Since the cost is based on data ingestion or the volume of data, large logs or large volumes of logs sometimes increase the ROI and overall cost of the product for us. This direct relationship between cost and data ingestion volume is an area I dislike and where there is room for improvement.

On a scale from one to ten, I would rate Splunk Enterprise Platform overall 8.5 out of 10. The area where it can be improved is mainly the cost. Otherwise, the features and quality of the platform are very good. Splunk Cloud and Splunk Enterprise help reduce MTTR, Mean Time to Resolution, since incident management is faster. Additionally, the visualization and observability of the entire organization infrastructure and application performance are consolidated in one place, as data is collected in a central location. Overall, the features and aspects of Splunk Enterprise Platform are commendable, but the cost aspect could be improved.

I have been using Splunk Enterprise Platform for more than one year.

My impression of the stability of Splunk Enterprise Platform is that the stability is much better, and we can also scale by cluster indices if needed. The stability and scalability of the platform meet our requirements and are functioning properly.

The scalability of Splunk Enterprise Platform is such that we can scale by cluster indexes as needed. The scalability is appropriate to the standards we require.

I have not contacted the technical support or customer support for Splunk Enterprise Platform much because the procurement part was managed by our finance team.

Previously, we were using open-source tools such as Prometheus and Grafana  for our dashboards, visibility, and monitoring. Additionally, while selecting tools, we tried ELK for some time. However, we are currently using Splunk Enterprise Platform.

The initial deployment of Splunk Enterprise Platform is very easy because it was primarily done by our infrastructure team. The deployment was easy, especially since our deployment model is cloud-based. Although there is an on-premise setup available, we are not using that much, but the cloud-based deployment was very straightforward.

For the initial deployment of Splunk Enterprise Platform, two or three people were involved, though I am not entirely certain of the details because the organization was using this tool before I joined.

Granular data access is mainly for controlling data that gets ingested. I understand that granular control over data gives us the ability to restrict how much data we want, thereby helping us reduce the cost of Splunk Cloud.

I am not using the Federated Search feature of Splunk Enterprise Platform because we primarily use SPL queries for our log management and database visualization.

Splunk Enterprise Platform does not require any maintenance on our end since it is a cloud-based system, so I do not think we require any maintenance for that.

My impression of Splunk Enterprise Platform's capability to manage data sovereignty at a petabyte scale within my environment is that our data is collected at a centralized location for all our metrics and logs. Having it in one place helps us for better visualization and data sovereignty because our data is in one location, which reassures me that our data is not being leaked or used by other AI tools or any other third-party applications.

My impression of Splunk Enterprise Platform's approach to managing governance within a private network environment is that governance is managed by the security team. From my experience, the governance and compliance for the data of our organization with Splunk Enterprise Platform follows mainly SOC 2. I am not fully aware of all the details, but I know that it aligns with best practices in the market, which is why our security team has approved it.

I would rate Splunk Enterprise Platform overall 8.5 out of 10.

Splunk Enterprise Platform  is used mainly for monitoring and troubleshooting activities, and we work with SPL to query and filter logs. We identify patterns, and then we investigate issues around different systems.

Splunk Enterprise Platform  is used mainly for creating dashboards, monitoring alerts, and understanding system behavior. We have a few use cases about the alerting mechanism. We ingest logs from multiple sources and multiple hosts like AWS , Kafka, and different systems, and we use Splunk Enterprise Platform as a SIEM  tool. That is our main use case.

We use Federated Search, which allows us to search data across multiple Splunk Enterprise Platform deployments without moving all the data in a single instance, so it helps us very much to access and analyze distributed data sources from one central search interface.

Splunk Enterprise Platform is highly scalable for us as we are increasing our team horizontally as well as vertically, so it is scalable for us right now.

One thing I dislike is definitely the licensing cost, especially when our ingestion volume increases, so it is a bit costly. The second thing is that SPL query performance can slow down if searches are not optimized properly, so if searches are not optimized, then query performance is slower.

I have been using Splunk Enterprise Platform for approximately 14 to 15 months.

During one upgrade of our server, there was one crash, but it was solved by the Splunk Enterprise Platform team itself. During upgrades, we have found it one or two times; otherwise it is quite stable for us.

Splunk Enterprise Platform is super easy and does not take any maintenance so far; it is quite easy to use.

We have contacted their technical support mainly during an upgrade when we raised a ticket about our system crashing during the upgrade. Our KV store was not coming up, so we contacted them and they briefly told us what the issue was, and after that, we solved that problem.

I would definitely give them an 8 out of 10 because they were always helpful for us whenever we needed them.

We have been directly using Splunk Enterprise Platform.

It was quite easy because we have a dedicated Splunk Enterprise Platform team with us, so it was easy for us. It took less than a week; approximately one week it took us.

One person did the implementation for our entire team.

I would give this solution an overall rating of 9 out of 10.

In my enterprise work as a consultant, I designed most of the architecture based on customer use cases and requirements. For the use case part, we can convert data into CSV to JSON with the ingest processor, which is a good point for data reduction. We create security alerts, notifications, and many data models to monitor data for compliance purposes.

Regarding Federated Search, it is an excellent feature. We have a separate environment where we can search data from different complete stacks or different complete Splunk infra. We have one platform with a complete environment for SIEM  and another environment for observability. We enabled Federated Search between both of these environments. Any observability team can get data from the SIEM , and the SIEM team can get data from observability.

What I appreciate most about Splunk Enterprise Platform  is that one of the best features is its ability to support customization. You can customize anything in Splunk Enterprise Platform . We have scripted input, normal file monitor, port monitoring, and many add-ons. Splunkbase is one of the biggest app and add-on stocks available. It supports everything you need. Wherever your data is, we can retrieve it. This is one of the best things about Splunk Enterprise Platform.

What I dislike about Splunk Enterprise Platform is the props and transforms functionality. For most types of data, we have custom add-ons and everything is available, but for some data we want to parse, the add-on is not available. Then we need to write manual props and transforms. Sometimes there are many issues with the Regex. When you write Regex, it may not work properly. In the Regex101 platform, you find Regex working, but when you apply it to Splunk Enterprise Platform, it is not working. Therefore, props and transforms, such as parsing of the data, are not that reliable.

Regarding maintenance, I don't think there is a strict maintenance requirement, but we need to continuously monitor the platform. For example, when Splunk version upgrades come in, we need to upgrade. Continuous monitoring is required. Sometimes knowledge bundle size increases, sometimes an alert is not running, and sometimes we have search head cluster replication factor down. Many kinds of issues are present with Splunk Enterprise Platform because you have your own infrastructure. This could be a plus or minus at any time, which is where we need to focus on maintenance.

Regarding the feature called Trusted Control Plane, I am not familiar with it. Is it in Splunk 10x or what?

I have been using Splunk Enterprise Platform for eight years.

The stability of Splunk Enterprise Platform is very good. There are no stability concerns.

Scalability is also good. There is not much configuration required. If you want to expand anything, you can increase more indexes or add storage. There is a separate storage tier that you can expand however you want. It supports both vertical and horizontal scaling. You can grow the environment without difficulty.

I was working directly with Splunk when I worked at Splunk.com as a Site Reliability Engineer with the data system. There we directly supported all Splunk customers by upgrading their environments, installing apps, and performing Splunk version upgrades. We handled many tasks such as changing configurations. For everything that a customer raised a support case for, we were the ones who provided support.

I have contacted Splunk support myself. I worked with two clients, including Emirates Airline, which I am currently working on. I raised support cases many times, including ODS cases. Regeneron Pharmaceuticals was another customer, and I raised many technical support cases for them.

I would rate Splunk support a nine because they are very good and very technical. They provide solutions on time, which is something I appreciate.

The initial deployment of Splunk Enterprise Platform is simple and very easy. You need some training before you do it. For a single instance, it is very easy. You just need to unzip the package and install it. However, if you want to set up clustering, search head clustering, indexer clustering, and other configurations, you either need to read the documentation or complete the architect labs. For me, it was very easy because I was an architect and consultant at that time.

Regarding pricing, it is costly. I don't know the exact numbers, but it is very expensive. However, it is worth it when you are using it properly. When you have a proper SIEM, proper data, and everything is in compliance, and you use Splunk Enterprise Platform to its full potential, then this investment is worth it.

I have used alternatives, and most of the customers are using Cribl  for parsing because it has the best UI and visual elements. In Splunk Enterprise Platform, we need to write the files, but Cribl  offers a visual approach, which is better.

I was working with Emirates Airline, where we take a license from Splunk and use Splunk Enterprise Platform. We have our own on-premises infrastructure. I am a customer of Splunk Enterprise Platform. I would give this product an overall rating of nine.