We use Splunk to create dashboards and do analysis.
Splunk can be used primarily to port log files, allowing for easy and quick management of large amounts of logs. However, this can also be a drawback due to the configuration, parsing, and dashboard creation limitations. Communication is stream-based, which means you need to do a lot of pre-emptive setup to get a nice export. Another issue with Splunk is its streamlined nature; it reruns the query whenever you refresh a dashboard. This becomes problematic if you have a large volume of log files, as it can be slow, resource-intensive, and require significant storage space.
It is designed to process and analyze log files. You feed log files into the platform, automatically extracting different fields. This allows you to filter and manipulate the data in a stream-based manner. Essentially, you pass a log file through various filters sequentially, enhancing or reducing its size by adding or removing information. However, this stream-based approach can make it challenging to create detailed dashboards easily. The platform primarily focuses on log files and is unsuitable for real-time data analysis.
I have been using Splunk Enterprise Platform for one or two years.
The product is stable.
I rate the solution’s stability a six out of ten.
It can be very slow if you have a lot of data, and scaling it up for better performance can be quite expensive.
A thousand users use this solution. We have many systems and a lot of data.
It is centrally deployed and used extensively across various systems. I use it daily, but sometimes I only use it once a month. It depends on the data I need or the issue I'm investigating.
I rate the solution’s scalability a four out of ten.
The initial setup is straightforward.
I wouldn't recommend Splunk Enterprise Platform because it's slow and has significant limitations.
Overall, I rate the solution a six out of ten.