Splunk Enterprise

Splunk Enterprise Platform  serves as our SIEM  tool where we receive alerts and we primarily depend on it. As a centralized logging and monitoring system, we use Splunk based upon different data types. We receive data from our EDR solutions, our email, and cloud sources, so Splunk acts as a centralized point where we receive alerts from multiple sources. Day-to-day operations include Windows event loggings, such as when we get brute force alerts and similar kinds of alerts. Another example is with respect to Office 365 , which is our messaging logs where if there is a need and any email forwarding rules are detected, we set a set of alerts. We also receive alerts from the cloud, GuardDuty logs, and CloudTrail  logs.

Splunk Enterprise Platform  is a platform I truly love, whether it's the use cases, how we fine-tune them, how we parse them, or how we create dashboards exclusively in Splunk Enterprise Platform, and even the admin part. The dashboarding functionality provides a single-pane-of-glass view for us where whenever an alert comes or any part of threat hunting that we do, it stands exclusively, and we are able to monitor them at one place. Other features such as RBAC and risk-based alerting mechanisms provide a one-page view for us. With respect to the UI, we get all the details in; it is very user-friendly; we do not need to search here and there; we get it immediately.

Splunk Enterprise Platform has had a significant positive impact on our organization. We had a previous SIEM  tool and migrated to Splunk Enterprise Platform. The storage logs and the storage bucketing system in Splunk Enterprise Platform is extensively large, and the amount of data that is getting parsed is substantial. Splunk Enterprise Platform is the one platform where we use it on a day-to-day basis, not only with respect to the cyber team but all the other data reporting team and data team use it as well.

With respect to the use cases, we were able to create many use cases as well as fine-tune them, so thirty percent of the alerts were fine-tuned, and we have improved our detection logic and also the outcomes. In specific to the metrics, our detection rate was high. The mean time to detect was incredibly lower than when compared to the previous SIEM.

With respect to Splunk Enterprise Platform, we can have a bunch of use cases though we already have a database where we get a list of use cases. Given the trend, we can improve them. Just with threat intelligence, if Splunk Enterprise Platform gets a new feature such as IOCs integration directly, that would be very helpful, just as the Falcon  threat intelligence. It would be helpful if we get Splunk threat intelligence as well.

In my current field, I have been working for about six years.

Splunk Enterprise Platform is stable with no doubt about that.

I rate the scalability of Splunk Enterprise Platform an eight on ten.

I rate the customer support of Splunk Enterprise Platform a nine on ten.

We had a previous SIEM tool and migrated to Splunk Enterprise Platform. The storage logs and the storage bucketing system in Splunk Enterprise Platform is extensively large, and the amount of data that is getting parsed is substantial. Splunk Enterprise Platform is the one platform where we use it on a day-to-day basis, not only with respect to the cyber team but all the other data reporting team and data team use it as well.

Pricing for Splunk Enterprise Platform is actually very high, but at the same time, the value that it gives is highly beneficial.

With respect to the use cases, we were able to create many use cases as well as fine-tune them, so thirty percent of the alerts were fine-tuned, and we have improved our detection logic and also the outcomes. In specific to the metrics, our detection rate was high. The mean time to detect was incredibly lower than when compared to the previous SIEM.

With respect to Splunk Enterprise Platform, we can have a bunch of use cases though we already have a database where we get a list of use cases. Given the trend, we can improve them. Just with threat intelligence, if Splunk Enterprise Platform gets a new feature such as IOCs integration directly, that would be very helpful, just as the Falcon  threat intelligence. It would be helpful if we get Splunk threat intelligence as well.

As of integrations, we are good. Splunk Enterprise Platform can be integrated with multiple SOAR  solutions, so I would prefer to focus on the threat intelligence side.

Accuracy regarding Splunk Enterprise Platform's AI capabilities should be termed as a normal figure between sixty to seventy-five percent because sometimes it is not just AI capabilities; human intelligence is needed as well. So I would keep it around that range.

With respect to cybersecurity, you have the best solution available. I rate this review a nine overall.

I was a partner with Splunk for around six years, and later I moved to customer projects. As part of Splunk, I worked as a professional services consultant, and later I began working with multiple customers through a different company as an independent consultant.

Splunk Enterprise Platform  is exceptional as a SIEM  platform, with the breadth and depth built over the last 20 years. The main benefit is that it serves both core operations and security through Enterprise Security.

My experience maintaining granular control over the trusted control plane within Splunk involves working with numerous log types that can be ingested, whether from custom application events, OS events, access and identity information, or security or EDR events.

Regarding AI usage in RBAC, I have primarily used it for use case management and taking actions once a security notable event is generated.

I have used Splunk Federated Search, which I implemented for one of my customers about a year ago.

In my experience with Federated Search, I will provide some context on why it was introduced. Splunk was pushing more on Splunk Cloud platform, which is one of their SaaS-based offerings.

In terms of scalability, I would rate Splunk Enterprise Platform  between nine and ten because all you have to do is add one indexer to the platform. Splunk architects and consultants are involved in that process, but it is quite fast.

One area that has room for improvement is the log onboarding problem with all the AI aspects, which has not yet been solved.

I have been using this solution for around eight years.

My experience with technical support leads me to rate it between six and seven, leaning toward seven, as they have outsourced most of the support, and support in some regions is not excellent.

The deployment model of my clients is a mix, as I have a few customers who ingest between 40 to 50 terabytes a day who are on enterprise, and there are a few clients with around four to five terabytes a day on cloud.

I would say the deployment planning and architecting is medium to hard, but once that is planned, the deployment itself is easy.

In terms of Total Cost of Ownership (TCO), I would say it is consistently net-net positive because Splunk Enterprise Platform is one of the platforms where all the logs of the entire organization are ingested.

Regarding pricing, I find that Splunk is quite expensive, and I have seen customers getting migrated since the last two years.

In comparison with major vendors on the market, I see Splunk Enterprise Platform as still being the market leader, at least in terms of SIEM .

I have a team reporting to me, as I work for a company, serving a bunch of Splunk customers and other SIEM customers.

In my organization, there are around four to five specialists who work with Splunk.

My clients are enterprise and medium to large businesses.

Splunk Enterprise Platform requires regular maintenance, and I find it easy to maintain.

My impression of Splunk's approach to managing governance within private network environments is that it is straightforward.

I suggest conducting a POC first and having one real customer who uses Splunk, because it will not work if you are just installing it locally.

I would rate this solution a nine overall.

As a cybersecurity consultant, my job is to review all the alerts we are receiving on a daily basis and do root cause analysis of the alerts. I work as SOC L2, and I am using Splunk Enterprise Platform  for cybersecurity purposes.

I start my day by logging into Splunk Enterprise Platform ; first, I go to my dashboard where we get all the cybersecurity alerts. With the help of the dashboard, we get all the alerts, then we drill down those alerts and get all the information like user activity and the actions taken. Based on that, we respond to a cybersecurity incident.

I continuously use Splunk Enterprise Platform for multiple purposes, including reports, dashboards, cybersecurity incidents, alerts, and cybersecurity events. I do multiple things on a daily basis in Splunk Enterprise Platform.

In my current organization, we are using Splunk Enterprise Platform for multiple clients, and I think it is helping us very well because we use Splunk Enterprise Platform for mostly eighty percent of our clients, and so far so good.

As a SOC L2, I am using Splunk Enterprise Platform's Federated Search to query data, which is quite useful for managing our client requests.

I can say that Splunk Enterprise Platform is quite easy to use, and it is also smooth and clean. Based on the cybersecurity incidents and alerts we receive daily, it plays a major role in helping users understand what has happened in this activity or cybersecurity incident.

In the cybersecurity dashboard, Splunk Enterprise Platform plays a major role in getting and representing the cybersecurity alerts, which is quite easy to understand and work on. I never had any issue with Splunk Enterprise Platform getting wrong data or crashing, so I think it is quite robust.

Because of Splunk Enterprise Platform's ease of use, cybersecurity analysts can go through all the activities and incident events, helping us respond better to a cybersecurity alert. It aids various metrics including cybersecurity SLA and provides faster remediation.

The governance and security provided by Splunk Enterprise Platform, with artificial intelligence, is an important aspect because we are getting more than a hundred types of cybersecurity alerts. AI helps us bypass many false positives, allowing cybersecurity analysts to focus on real alerts.

Based on my recent experience, I find the accuracy and reliability of output quite good since it helps cybersecurity analysts focus more on high or critical alerts and reduces false positive alerts based on our previous responses and recommendations.

I think Splunk Enterprise Platform is quite efficient because it helps us manage cybersecurity incidents and alerts in a much better manner.

Splunk Enterprise Platform makes our job far more entertaining and easy to work on, helping us save on costs, money, and efforts.

I think Splunk Enterprise Platform can be improved to be more specific regarding certain cybersecurity-related incidents rather than giving all cybersecurity events; it can be far better.

I have provided all the information I have observed and experienced to improve Splunk Enterprise Platform.

In the cybersecurity domain, I have been working for the last seven years.

Splunk Enterprise Platform is stable.

Based on my observation, Splunk Enterprise Platform is highly scalable because we are onboarding multiple tenants.

The customer support is adequate and very helpful.

I advise others looking into using Splunk Enterprise Platform to be quite patient because getting to know how to work around it is going to help you. I would rate this product an eight out of ten.

My main use case for Splunk Enterprise Platform  is to monitor and troubleshoot, perform incident analysis, and search and analyze applications and system logs to identify the root cause of issues. I create dashboards to monitor key metrics, configure alerts for critical events, and generate reports for the operation systems.

A specific example of how I used Splunk Enterprise Platform  to solve a problem occurred when users reported intermittent application failures in production. I used Splunk Enterprise Platform to search and correlate application and server logs using SPL. By filtering the logs based on timestamps and error codes, I identified repeated timeout exceptions that were caused by backend services. I created a dashboard to monitor these errors and configured an alert to notify the support team whenever the error count exceeded a threshold. This helped the team detect similar issues proactively and reduce troubleshooting time significantly.

In addition to troubleshooting and log analysis, I use Splunk Enterprise Platform for real-time monitoring of application and infrastructure, creating dashboards for operational visibility, configuring alerts for critical events, and generating reports for stakeholders. I use SPL to analyze trends, identify recurring issues, and support root cause analysis. Overall, Splunk Enterprise Platform helps me monitor system health, reduce incident resolution time, and improve operational efficiency.

Splunk Enterprise Platform offers numerous powerful features including powerful log search using SPL, real-time monitoring and alerting, interactive dashboards and visualizations, data indexing and fast search, centralized log management, role-based access control, scalability, and integrations with various data sources. These features help our organization monitor and troubleshoot our systems.

Out of those features, I find the combination of real-time monitoring and SPL search capabilities the most valuable in my day-to-day work. Real-time monitoring helps me identify issues as soon as they occur, while SPL allows me to quickly filter and analyze large volumes of logs to pinpoint the root cause. This significantly reduces the troubleshooting time. I also rely heavily on dashboards because they provide a clear view of application health, error trends, and system performance in one place. Centralized log management is another key advantage as it brings logs from multiple sources and servers together, eliminating the need to check each system individually. Overall, these features help me resolve incidents faster, improve system reliability, and reduce downtime.

An additional feature I truly appreciate is the flexibility of Splunk Enterprise Platform. It can ingest data from a wide variety of sources, such as application servers, operating systems, and network devices, and correlate all the information in a single platform.

In order to improve Splunk Enterprise Platform, there are a few areas that need improvement. The licensing model is based on data ingestion volume and can become expensive as organizations grow. The initial setup and configuration can also be complex for new users.

I would rate Splunk Enterprise Platform an eight because it is a powerful and reliable platform for centralized log management and real-time monitoring. It significantly improves our troubleshooting times. I did not give it a ten because the licensing costs can be high, the initial setup and administration can be complex, and there is a learning curve for SPL and advanced configurations.

I have been using Splunk Enterprise Platform for about two years.

Splunk Enterprise Platform is stable.

Splunk Enterprise Platform is highly scalable. It can handle increasing volumes of machine data by scaling horizontally, such as adding more indexes, search heads, and forwarders as an environment grows. This allows organizations to support more users, onboard additional data sources, and process large amounts of data.

I do not have direct experience managing Splunk Enterprise Platform at petabyte scale. However, based on my understanding, Splunk Enterprise Platform is designed to scale horizontally by adding indexes and search heads, which allows it to handle very large data volumes. For data sovereignty, it supports role-based access controls, encryption, and various deployment options.

My experience with customer support was great.

I have not previously used a different solution before Splunk Enterprise Platform; we directly adopted Splunk Enterprise Platform.

The initial setup and administration can be complex, and there is a learning curve for SPL and advanced configurations.

The setup was performed by our in-house team who are highly skilled in working with Splunk Enterprise Platform.

I definitely see the return on investment. Splunk Enterprise Platform improved our reliability, and the time to investment ratio has been excellent because the time we are spending solving incidents through Splunk Enterprise Platform has been great.

My experience with pricing, setup cost, and licensing indicates that the initial setup cost, and when the organization grows, the setup cost might increase significantly. The main costs considering Splunk Enterprise Platform are licensing, infrastructure, and setup. Since licensing is based on data ingestion volume, costs can increase as the organization generates more log data.

We did not evaluate other options before choosing Splunk Enterprise Platform; we directly chose Splunk Enterprise Platform as our first option.

My advice to others looking into using Splunk Enterprise Platform is that if there is an organization which is about to scale to large numbers, I would highly suggest Splunk Enterprise Platform. However, I would ask them to carefully check and ingest valuable data only for cost efficiency. I would rate this recommendation an eight out of ten.