Devo vs Splunk Enterprise Security comparison

Devo and Splunk are both solutions in the Security Information and Event Management (SIEM) category. Devo is ranked #28 with an average rating of 8.5, while Splunk is ranked #1 with an average rating of 8.4. Devo holds a 1.0% mindshare in SIEM, compared to Splunk’s 9.5% mindshare. Additionally, 95% of Devo users are willing to recommend the solution, compared to 93% of Splunk users who would recommend it.

Devo

Read 22 Devo reviews

2,148 Views
1,023 Comparison Views

95% willing to recommend

Splunk Enterprise Security

Read 306 Splunk Enterprise Security reviews

13,819 Views
11,374 Comparison Views

93% willing to recommend

Devo

Splunk Enterprise Security

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Apr 6, 2025

Splunk Enterprise Security and Devo compete in the security analytics space, offering comprehensive solutions for data analysis and incident response. Splunk seems to have the upper hand due to its extensive feature set, particularly in operational intelligence and data visualization, making it highly suitable for complex environments.

Features: Splunk Enterprise Security offers robust log management, real-time alert setup, and operational intelligence capabilities. It excels in data correlation from various sources using schema-on-read technology, enhancing its dashboards and visualization tools. Devo stands out for its high-speed, scalable analytics, seamless data storage efficiencies, and the innovative Activeboards feature that facilitates real-time data analysis across multiple data types.

Room for Improvement: Splunk Enterprise Security needs to improve its GUI for enhanced search and dashboard customization, better documentation, and more granular security controls with integrations. Devo could focus on better supporting complex dashboards, enhancing Activeboards' aesthetic appeal, and simplifying data ingestion and parsing.

Ease of Deployment and Customer Service: Splunk Enterprise Security is versatile with deployment models including Public Cloud, On-premises, and Hybrid Cloud, complemented by solid but improvable customer service in terms of response times. Devo offers straightforward deployment with clear pricing models and quality technical support, though platform documentation could be improved.

Pricing and ROI: Splunk Enterprise Security, expensive especially for smaller enterprises, carries high data ingestion costs but offers significant ROI through comprehensive data analysis features. In contrast, Devo offers a straightforward pricing model based on data ingestion, generally making it more economical. Both tools have distinct pricing models, but Splunk’s more extensive features justify its investment for enterprises needing comprehensive security solutions.

To learn more, read our detailed Devo vs. Splunk Enterprise Security Report (Updated: April 2025).

Buyer's Guide

Devo vs. Splunk Enterprise Security

April 2025

Download the complete report

Helped 848,716 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Devo

Ranking in Log Management

27th

Ranking in Security Information and Event Management (SIEM)

28th

Ranking in IT Operations Analytics

6th

Average Rating

8.4

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

AIOps (15th)

Splunk Enterprise Security

Ranking in Log Management

2nd

Ranking in Security Information and Event Management (SIEM)

1st

Ranking in IT Operations Analytics

1st

Average Rating

8.4

Reviews Sentiment

7.6

Number of Reviews

306

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of April 2025, in the Security Information and Event Management (SIEM) category, the mindshare of Devo is 1.0%, down from 1.1% compared to the previous year. The mindshare of Splunk Enterprise Security is 9.5%, down from 12.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Featured Reviews

Michael Wenn

CEO / Co-Founder at Aiops ltd

Has cloud-first architecture with SIEM technology to run security operations

When it comes to scale, they're architected quite well. They handle some of the biggest customers globally, with significant throughput on their platform, managing thousands of customers. One of the most impressive aspects of Devo is its customer community. A large majority, over 80 percent of their customers, actively participate on a Devo-specific community page. They're contributing to product development and support, events, and user group information, helping each other out. This high level of engagement is rare and demonstrates both the loyalty of their customer base and the quality of their product. They offer a range of small, medium, and large options to cater to everyone. I sold Devo products while working with them, focusing on enterprise solutions. However, as a small reseller, my customers were typically smaller businesses. I rate the solution's scalability a nine out of ten.

Read full review

ROBERT-CHRISTIAN

CTO at kyndryl

Has many predefined correlation rules and is brilliant for investigation and log analysis

It is very complicated to write your own correlation rules without the help of Splunk support. What Splunk could do better is to create an API to the standard SIEM tools, such as Microsoft Sentinel. The idea would be to make it less painful. In ELK Stack, Kibana is the query language with which you can search log files. I believe Splunk has also a query language in which they search their log files, but once you have identified the log file that you want to use for further security correlation, you want to very quickly transport that into your SIEM tool, such as Microsoft Sentinel. That is something that Splunk could make a little bit less painful because it is a lot of effort to find that log file and forward it. An API with Microsoft Sentinel or a similar SIEM tool would be a good idea.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"One of the biggest features of the UI is that you see the actual code of what you're doing in the graphical user interface, in a little window on the side. Whatever you're doing, you see the code, what's happening. And you can really quickly switch between using the GUI and using the code. That's really useful."

"The user interface is really modern. As an end-user, there are a lot of possibilities to tailor the platform to your needs, and that can be done without needing much support from Devo. It's really flexible and modular. The UI is very clean."

"The most powerful feature is the way the data is stored and extracted. The data is always stored in its original format and you can normalize the data after it has been stored."

"The alerting is much better than I anticipated. We don't get as many alerts as I thought we would, but that nobody's fault, it's just the way it is."

"It centralizes security management within a business, functioning as a core system for a SOC."

"Devo has a really good website for creating custom configurations."

"The real-time analytics of security-related data are super. There are a lot of data feeds going into it and it's very quick at pulling up and correlating the data and showing you what's going on in your infrastructure. It's fast. The way that their architecture and technology works, they've really focused on the speed of query results and making sure that we can do what we need to do quickly. Devo is pulling back information in a fast fashion, based on real-time events."

"The thing that Devo does better than other solutions is to give me the ability to write queries that look at multiple data sources and run fast. Most SIEMs don't do that. And I can do that by creating entity-based queries. Let's say I have a table which has Okta, a table which has G Suite, a table which has endpoint telemetry, and I have a table which has DNS telemetry. I can write a query that says, 'Join all these things together on IP, and where the IP matches in all these tables, return to me that subset of data, within these time windows.' I can break it down that way."

More Devo pros

"The dashboards are the most valuable feature. We like the ability to drill in and see what queries are under the dashboard, build new visualizations, edit the querying, and see the reports."

"The most valuable function is the notable events. When I joined the team, I asked them what they could currently see, and they said nothing. I was pretty shocked. I know for a fact that they're using Enterprise Security or at least they had purchased it. I told them that there are several dashboards within Splunk that we can leverage. There is also notable events where we can see potential incidents or potential alerts about the infrastructure and the network itself."

"We can present to our management in real time the security of the batch management for the PCs, security regarding the network equipment. We're currently working in the Azure Cloud project, so we can send any logs from the cloud to Splunk. We can monitor them and we can present to the managers and customers. It's a very good solution for reporting. We use Splunk for reporting and monitoring of any solution in the company."

"Integration with the cloud is pretty important and good for us. We found the integration with a lot of tools, not all tools yet, valuable. It does make the transfer of data, log files, and other things easier for us."

"The most valuable feature is the custom dashboard feature."

"If properly built, I'm very impressed with the stability of Splunk ES."

"Splunk Enterprise Security helped improve our organization’s ability to ingest and normalize data."

"The risk-based alerting is excellent."

More Splunk Enterprise Security pros

Cons

"I would like to have the ability to create more complex dashboards."

"Technical support could be better."

"We only use the core functionality and one of the reasons for this is that their security operation center needs improvement."

"There's room for improvement within the GUI. There is also some room for improvement within the native parsers they support. But I can say that about pretty much any solution in this space."

"Some third-parties don't have specific API connectors built, so we had to work with Devo to get the logs and parse the data using custom parsers, rather than an out-of-the-box solution."

"From our experience, the Devo agent needs some work. They built it on top of OS Query's open-source framework. It seems like it wasn't tuned properly to handle a large volume of Windows event logs. In our experience, there would definitely be some room for improvement. A lot of SIEMs on the market have their own agent infrastructure. I think Devo's working towards that, but I think that it needs some improvement as far as keeping up with high-volume environments."

"There is room for improvement in the ability to parse different log types. I would go as far as to say the product is deficient in its ability to parse multiple, different log types, including logs from major vendors that are supported by competitors. Additionally, the time that it takes to turn around a supported parser for customers and common log source types, which are generally accepted standards in the industry, is not acceptable. This has impacted customer onboarding and customer relationships for us on multiple fronts."

"Where Devo has room for improvement is the data ingestion and parsing. We tend to have to work with the Devo support team to bring on and ingest new sources of data."

More Devo cons

"It is very complicated to write your own correlation rules without the help of Splunk support."

"I feel as though a major focus of upcoming releases should be set on Machine Learning, Predictive Analytics, and I would enjoy to see more security focused add-ons and apps developed by the vendor."

"Data retention can be better. If we want to look at the data for five months or six months, that is not available to us. We only have a history of 20 or 30 days. After that, the information gets lost. That is a drawback."

"I would like to get visibility into the data pipelines on heavy forwarders and indexers to see exactly their source and the cause of saturation when it occurs. This would help us learn even more about our high use applications."

"The integration with all our tool sets felt like we were reinventing the wheel, which was a pain point for us."

"The access and identity features could be improved. For example, let's say we have onboarded 65 logs. Now, we can identify the various processes, but we run into trouble when we're updating the processes for AWS CloudTrail, EDR, MDR, and XDR."

"For us, the area that Splunk Enterprise Security can improve is performance optimization."

"The incident response dashboard could be more user-friendly."

More Splunk Enterprise Security cons

Pricing and Cost Advice

"Be cautious of metadata inclusion for log types in pricing, as there are some "gotchas" with that."

"I'm not involved in the financial aspect, but I think the licensing costs are similar to other solutions. If all the solutions have a similar cost, Devo provides more for the money."

"I rate the pricing a four on a scale of one to ten, where one is cheap, and ten is expensive."

"Devo was very cost-competitive... Devo did come with that 400 days of hot data, and that was not the case with other products."

"It's a per gigabyte cost for ingestion of data. For every gigabyte that you ingest, it's whatever you negotiated your price for. Compared to other contracts that we've had for cloud providers, it's significantly less."

"Our licensing fees are billed annually and per terabyte."

"We have an OEM agreement with Devo. It is very similar to the standard licensing agreement because we are charged in the same way as any other customer, e.g., we use the backroom."

"Devo is a hosted or subscription-based solution, whereas before, we purchased QRadar, so we owned it and just had to pay a maintenance fee. We've encountered this with some other products, too, where we went over to subscription-based. Our thought process is that with subscription based, the provider hosts and maintains the tool, and it's offsite. That comes with some additional fees, but we were able to convince our upper management it was worth the price. We used to pay under 10k a year for maintenance, and now we're paying ten times that. It was a relatively tough sell to our management, but I wonder if we have a choice anymore; this is where the market is."

More Devo pricing and cost advice

"It's a little bit expensive for a small to medium enterprise."

"Truly evaluate the data you want to ingest and go slow. Pulling in data that can provide no use to your mission only wastes data against your license."

"Splunk licensing model might seem expensive but with all the gain in functionalities you will have compared to traditional SIEM solutions I think it’s worth the price."

"It's a yearly subscription."

"It's more expensive than the other tools, but it's worth it. Every penny is worth it."

"The pricing model is expensive and a nightmare based on the amount of data."

"Splunk is priced higher than other solutions."

"Splunk Enterprise Security is an expensive solution."

More Splunk Enterprise Security pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

848,716 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at Deloitte & Touche

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

17%

Computer Software Company

15%

Government

University

Financial Services Firm

15%

Computer Software Company

14%

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Devo?

Devo has a really good website for creating custom configurations.

See all answers

What is your experience regarding pricing and costs for Devo?

Compared to Splunk or SentinelOne, it is really expensive. I rate the product’s pricing a nine out of ten, where one is cheap and ten is expensive.

See all answers

What needs improvement with Devo?

They can improve their AI capabilities. If you look at some integrations like XDR or AI, which add to the platform to correlate situations in events, there are areas for enhancement. For instance, ...

See all answers

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...

See all answers

What is a better choice, Splunk or Azure Sentinel?

It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...

See all answers

How does Splunk compare with Azure Monitor?

Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring information from different sources. Splunk is very good at alerting us if we...

See all answers

Comparisons

IBM Security QRadar vs Devo

Compared 17% of the time

Microsoft Sentinel vs Devo

Compared 16% of the time

LogRhythm SIEM vs Devo

Compared 6% of the time

Wazuh vs Devo

Compared 6% of the time

Datadog vs Devo

Compared 5% of the time

More Devo Competitors

Wazuh vs Splunk Enterprise Security

Compared 9% of the time

IBM Security QRadar vs Splunk Enterprise Security

Compared 9% of the time

Dynatrace vs Splunk Enterprise Security

Compared 8% of the time

Datadog vs Splunk Enterprise Security

Compared 5% of the time

Sentinel vs Splunk Enterprise Security

Compared 4% of the time

More Splunk Enterprise Security Competitors

Product Reports

Buyer's Guide

Devo

April 2025

Download Devo product report

Buyer's Guide

Splunk Enterprise Security

March 2025

Download Splunk Enterprise Security product report

Overview

Devo is the only cloud-native logging and security analytics platform that releases the full potential of all your data to empower bold, confident action when it matters most. Only the Devo platform delivers the powerful combination of real-time visibility, high-performance analytics, scalability, multitenancy, and low TCO crucial for monitoring and securing business operations as enterprises accelerate their shift to the cloud.

Devo

Splunk Enterprise Security is widely used for security operations, including threat detection, incident response, and log monitoring. It centralizes log management, offers security analytics, and ensures compliance, enhancing the overall security posture of organizations.

Companies leverage Splunk Enterprise Security to monitor endpoints, networks, and users, detecting anomalies, brute force attacks, and unauthorized access. They use it for fraud detection, machine learning, and real-time alerts within their SOCs. The platform enhances visibility and correlates data from multiple sources to identify security threats efficiently. Key features include comprehensive dashboards, excellent reporting capabilities, robust log aggregation, and flexible data ingestion. Users appreciate its SIEM capabilities, threat intelligence, risk-based alerting, and correlation searches. Highly scalable and stable, it suits multi-cloud environments, reducing alert volumes and speeding up investigations.

What are the key features?

Comprehensive Dashboards: Provide a holistic view of security operations.
Flexible Data Ingestion: Supports various data sources for better analysis.
Robust Log Aggregation: Centralizes log management for easier monitoring.
Machine Learning Toolkit: Enhances threat detection and prediction capabilities.
SIEM Capabilities: Integrates security information and event management.
Threat Intelligence: Utilizes external information to improve security measures.
Risk-Based Alerting: Prioritizes alerts based on the risk they pose.
Correlation Searches: Identifies and correlates security events effectively.

What benefits or ROI should users look for?

Enhanced Visibility: Improves monitoring across endpoints, networks, and users.
Faster Incident Response: Speeds up identification and resolution of security issues.
Reduced Alert Volumes: Lowers false positives and enhances signal-to-noise ratio.
Scalability: Adapts to growing and changing security needs.
Improved Security Operations: Integrates multiple security facets into one platform.

Splunk Enterprise Security is implemented across industries like finance, healthcare, and retail. Financial institutions use it for fraud detection and compliance, while healthcare organizations leverage its capabilities to safeguard patient data. Retailers deploy it to protect customer information and ensure secure transactions.

Splunk

Sample Customers

United States Air Force, Rubrik, SentinelOne, Critical Start, NHL, Panda Security, Telefonica, CaixaBank, OpenText, IGT, OneMain Financial, SurveyMonkey, FanDuel, H&R Block, Ulta Beauty, Manulife, Moneylion, Chime Bank, Magna International, American Express Global Business Travel

Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.

Buyer's Guide

Devo vs. Splunk Enterprise Security

April 2025

Free Report: Devo vs. Splunk Enterprise Security

Find out what your peers are saying about Devo vs. Splunk Enterprise Security and other solutions. Updated: April 2025.

DOWNLOAD NOW

848,716 professionals have used our research since 2012.

See our Devo vs. Splunk Enterprise Security report.

See our list of best Security Information and Event Management (SIEM) vendors, best Log Management vendors, and best IT Operations Analytics vendors.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.