Splunk Enterprise

The team I work on is a workflow team for the bank. We get a lot of traffic because of onboarding and workflow processes, which results in around a million hits per day. Whenever we have a release scheduled, Splunk Enterprise Platform  is a very useful tool for me to monitor the logs.

Splunk offers an advantage where I can log and monitor all of the microservices in a single location. Search Processing Language (SPL), which is the query language for the product. SPL does take time to master as it is somewhat complex. When searches are straightforward, then it is quick, but if you need to perform complex searches with multiple pipes, sub-searches, or statistical functions, then it becomes somewhat confusing. You need time to become familiar with it.

I created some Splunk Enterprise Platform  dashboards, which is the main focus of my work. I used a drag-and-drop builder, and it has real-time updates, visualization varieties, drilldowns, and token inputs. I built a dashboard for the application which answered these questions: which workflow combination has the highest hits and which users are triggering them. I wrote a query using SPL which aggregated the results from the API in the given timeframe that we can choose, and accordingly it will show a pie chart. Using the drilldowns and tokens, I built another panel where if you click a particular combination, it will list the number of users hitting that combination and how many times. This is something very useful I found in Splunk Enterprise Platform dashboards.

Regarding the downsides of Splunk Enterprise Platform, as I mentioned, one is the Search Processing Language is somewhat complex when it comes to complex filtering and searching. You need to become familiar with it to make complex searches. That is one thing.

There is not a no-code option for panels. You have to write an entire query for it. It would be better if they could introduce more drag-and-drop options so that people can add more features to their panels and pie charts and visualize the data they want.

I have been using Splunk Enterprise Platform for 1.5 years.

Considering the stability of Splunk Enterprise Platform, it is pretty stable. It sometimes takes time when I switch the timeframe, such as from 15 minutes to one hour. It takes some time in loading all of the logs from the application. Otherwise, it is very stable. It is a latency issue.

As I mentioned, the current application I was working on already has a lot of users. So it is a pretty scalable solution. We get millions of hits for the APIs.

When I joined the company, Splunk Enterprise Platform was already in place from the very start. Many of my friends work in several different companies, many uses DataDog, but here, I have only used Splunk Enterprise Platform.

I am not involved in those kinds of decisions yet. I do not know about the pricing.

The whole bank uses the same tool to monitor their logs and analyze production data or any environment data. That is why I have not had any chance to use an alternative.

I am not familiar with the pricing because being a junior developer.

Splunk Enterprise Platform offers Federated Search, which I have not used.

My overall review rating for Splunk Enterprise Platform is 9 out of 10.

I mainly work on log management and observability for our platforms. We use Splunk Enterprise Platform  for the collection of logs and primarily for the observability of dashboards related to incident management and our application performance.

The feature I appreciate most about Splunk Enterprise Platform is the Search Processing Language, which is very flexible. It allows me to write complex queries and perform statistical analysis to create better dashboards and visualization capabilities. Through this, we can visualize our systems and manage incident management properly.

Our team primarily uses the technical capabilities for log management and observability of our systems and the performance of our applications. Our team operates mainly in the technical domain.

A major factor I dislike about Splunk Enterprise Platform is the cost. Since the cost is based on data ingestion or the volume of data, large logs or large volumes of logs sometimes increase the ROI and overall cost of the product for us. This direct relationship between cost and data ingestion volume is an area I dislike and where there is room for improvement.

On a scale from one to ten, I would rate Splunk Enterprise Platform overall 8.5 out of 10. The area where it can be improved is mainly the cost. Otherwise, the features and quality of the platform are very good. Splunk Cloud and Splunk Enterprise help reduce MTTR, Mean Time to Resolution, since incident management is faster. Additionally, the visualization and observability of the entire organization infrastructure and application performance are consolidated in one place, as data is collected in a central location. Overall, the features and aspects of Splunk Enterprise Platform are commendable, but the cost aspect could be improved.

I have been using Splunk Enterprise Platform for more than one year.

My impression of the stability of Splunk Enterprise Platform is that the stability is much better, and we can also scale by cluster indices if needed. The stability and scalability of the platform meet our requirements and are functioning properly.

The scalability of Splunk Enterprise Platform is such that we can scale by cluster indexes as needed. The scalability is appropriate to the standards we require.

I have not contacted the technical support or customer support for Splunk Enterprise Platform much because the procurement part was managed by our finance team.

Previously, we were using open-source tools such as Prometheus and Grafana  for our dashboards, visibility, and monitoring. Additionally, while selecting tools, we tried ELK for some time. However, we are currently using Splunk Enterprise Platform.

The initial deployment of Splunk Enterprise Platform is very easy because it was primarily done by our infrastructure team. The deployment was easy, especially since our deployment model is cloud-based. Although there is an on-premise setup available, we are not using that much, but the cloud-based deployment was very straightforward.

For the initial deployment of Splunk Enterprise Platform, two or three people were involved, though I am not entirely certain of the details because the organization was using this tool before I joined.

Granular data access is mainly for controlling data that gets ingested. I understand that granular control over data gives us the ability to restrict how much data we want, thereby helping us reduce the cost of Splunk Cloud.

I am not using the Federated Search feature of Splunk Enterprise Platform because we primarily use SPL queries for our log management and database visualization.

Splunk Enterprise Platform does not require any maintenance on our end since it is a cloud-based system, so I do not think we require any maintenance for that.

My impression of Splunk Enterprise Platform's capability to manage data sovereignty at a petabyte scale within my environment is that our data is collected at a centralized location for all our metrics and logs. Having it in one place helps us for better visualization and data sovereignty because our data is in one location, which reassures me that our data is not being leaked or used by other AI tools or any other third-party applications.

My impression of Splunk Enterprise Platform's approach to managing governance within a private network environment is that governance is managed by the security team. From my experience, the governance and compliance for the data of our organization with Splunk Enterprise Platform follows mainly SOC 2. I am not fully aware of all the details, but I know that it aligns with best practices in the market, which is why our security team has approved it.

I would rate Splunk Enterprise Platform overall 8.5 out of 10.

Splunk Enterprise Platform  is used mainly for monitoring and troubleshooting activities, and we work with SPL to query and filter logs. We identify patterns, and then we investigate issues around different systems.

Splunk Enterprise Platform  is used mainly for creating dashboards, monitoring alerts, and understanding system behavior. We have a few use cases about the alerting mechanism. We ingest logs from multiple sources and multiple hosts like AWS , Kafka, and different systems, and we use Splunk Enterprise Platform as a SIEM  tool. That is our main use case.

We use Federated Search, which allows us to search data across multiple Splunk Enterprise Platform deployments without moving all the data in a single instance, so it helps us very much to access and analyze distributed data sources from one central search interface.

Splunk Enterprise Platform is highly scalable for us as we are increasing our team horizontally as well as vertically, so it is scalable for us right now.

One thing I dislike is definitely the licensing cost, especially when our ingestion volume increases, so it is a bit costly. The second thing is that SPL query performance can slow down if searches are not optimized properly, so if searches are not optimized, then query performance is slower.

I have been using Splunk Enterprise Platform for approximately 14 to 15 months.

During one upgrade of our server, there was one crash, but it was solved by the Splunk Enterprise Platform team itself. During upgrades, we have found it one or two times; otherwise it is quite stable for us.

Splunk Enterprise Platform is super easy and does not take any maintenance so far; it is quite easy to use.

We have contacted their technical support mainly during an upgrade when we raised a ticket about our system crashing during the upgrade. Our KV store was not coming up, so we contacted them and they briefly told us what the issue was, and after that, we solved that problem.

I would definitely give them an 8 out of 10 because they were always helpful for us whenever we needed them.

We have been directly using Splunk Enterprise Platform.

It was quite easy because we have a dedicated Splunk Enterprise Platform team with us, so it was easy for us. It took less than a week; approximately one week it took us.

One person did the implementation for our entire team.

I would give this solution an overall rating of 9 out of 10.