Try our new research platform with insights from 80,000+ expert users

Elastic Observability vs Splunk ITSI (IT Service Intelligence) comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jul 24, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Elastic Observability
Ranking in Application Performance Monitoring (APM) and Observability
7th
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
26
Ranking in other categories
IT Infrastructure Monitoring (8th), Log Management (15th), Container Monitoring (4th), Cloud Monitoring Software (7th)
Splunk ITSI (IT Service Int...
Ranking in Application Performance Monitoring (APM) and Observability
10th
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
50
Ranking in other categories
IT Alerting and Incident Management (4th)
 

Mindshare comparison

As of March 2025, in the Application Performance Monitoring (APM) and Observability category, the mindshare of Elastic Observability is 5.6%, down from 5.7% compared to the previous year. The mindshare of Splunk ITSI (IT Service Intelligence) is 0.7%, up from 0.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Performance Monitoring (APM) and Observability
 

Featured Reviews

Adelina Craciun - PeerSpot reviewer
Customization enables tailored monitoring and alerting across departments
The possibility to customize it has been quite useful. Whatever the other departments want to dream up, we implement. Whatever they want to monitor, the granularity of it, the changes in the threshold, and the anomalies that they want reported all require some development. So far, every single request has been fulfilled.
Sunil K R - PeerSpot reviewer
Helps improve our incident response time, and our mean time to resolve, but visibility is limited
In my previous project, I successfully led the end-to-end deployment of a Splunk migration. The process went smoothly thanks in part to Splunk's professional services team. They conducted a thorough assessment, identified all our potential pain points, and developed a tailored solution and migration plan. This comprehensive approach ensured a seamless transition. Our core deployment team consisted of 5 internal members and two specialists from Splunk. Additionally, the project included a project manager and a product owner. We also benefited from the expertise of two professional service consultants and two representatives from the customer's side. An on-site admin architect further provided valuable technical support. Throughout the deployment process, we leveraged support from various resources whenever necessary. This included assistance with configuration changes, deployments, and other related tasks. We also collaborated effectively with our teammates to ensure a smooth and successful implementation.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"I found Elk to be excellent for log analytics, security analytics, application code-level analytics, collaboration with DevOps teams, CI/CD, microservices, and Kubernetes, specifically cloud-native or cloud-specific tasks."
"The tool's most valuable feature is centralized logging. Elastic Common Search helps us to search for the logs across the organization."
"The ability to ensure that the data is searchable and maintainable is highly valuable for our purposes."
"The solution has been stable in our usage."
"It is a powerful tool that allows users to collect and transform logs as needed, enabling flexible visualization and analysis."
"It has always been a stable solution."
"I have built a mini business intelligence system based on Elastic Observability."
"We use AppDynamics and Elastic. The reason why we're using Elastic APM is because of the license count. It's very favorable compared to AppDynamics. It's inexpensive; it's economical."
"Splunk Episodes are valuable because it correlates and aggregates all the information, and you do not have one million events to look at and triage, so it is quite convenient."
"The solution is easy to scale."
"The most valuable features are the mapping of the entities, which provides a comprehensive analysis, and the service analyzer for thresholding."
"Customers have noted the solution helps streamline incident management."
"In my opinion, Splunk IT Service Intelligence (ITSI) is better than QRadar. With the help of Splunk, we can get results."
"We liked the built-in calculation of health scores."
"One particularly useful feature of Splunk ITSI is the ability to create custom services."
"What I like the most is the event correlations. It's a file structure, and ITSI has a correlation layer where you can normalize the events from different sources. Once these events are normalized, you set up rules to aggregate them into different or the same attributes. After the rules are defined, you can automate the process to solve the issue automatically."
 

Cons

"The price is the only issue in the solution. It can be made better and cheaper."
"Elastic Observability needs to improve the retrieval of logs and metrics from all the instances."
"Elastic APM's visualization is not that great compared to other tools. It's number of metrics is very low."
"Simplifying the parsing of logs and manual efforts would also be beneficial."
"Elastic Observability’s price could be improved."
"Improving code insight related to infrastructure and network, particularly focusing on aspects such as firewalls, switches, routers, and testing would be beneficial."
"More web features could be added to the product."
"The tool's scalability involves a more complex implementation process. It requires careful calculations to determine the number of nodes needed, the specifications of each node, and the configuration of hot, warm, and cold zones for data storage. Additionally, managing log retention policies adds further complexity. The solution's pricing also needs to be cheaper."
"Predictive analytics, in terms of preventing incidents before they occur, still needs time to mature."
"If the product had some prebuilt machine learning features, it would add value to our use cases."
"Splunk ITSI could benefit from including more features that other solutions support, such as vulnerability management modules."
"ITSI could benefit from a security model that would allow operations team members to get involved in model building, KPI implementation, and model maintenance, while maintaining appropriate segregation of duties."
"After upgrading Splunk ITSI from version 4.11 to 4.13, the analyzer stopped finding values for KPS and services."
"While integrating services and KPIs in ITSI is straightforward, I found it challenging to analyze them with the service analyzers; specifically, using the deep dive feature to pinpoint the exact source and time of an issue proved difficult."
"There should be entity conflict resolution, specifically regarding duplicate entities. There should be case sensitivity for various keys amongst entities, specifically host names. We need IT metrics-based indexes and more content packs. I know they are coming out with these features"
"When configuring a dashboard, we can write search criteria. Based on the search criteria, the dashboard shows all the alerts, including the alert time, creation time, and a summary description of the alert. When you add an extra column, such as the user that triggered the alert, the next time he refreshes the dashboard, he wants to know that the alert is acknowledged. We want to improve that comment feature."
 

Pricing and Cost Advice

"The product is not that cheap."
"So far, there are just the standard licensing fees. Several of the components are embedded in the license or are even open source. They're even free depending on what you use, which makes it even more appealing to someone that is discussing pricing of the solution."
"We will buy a premium license after POC."
"One needs to pay for the licenses, and it is an annual subscription model right now."
"Users have to pay for some features, like the alerts on different channels, because they are unavailable in different source versions."
"Pricing is one of those situations where the more you use it, the more you pay."
"There are two types: cloud and SaaS. They charge based on data ingestion, ingest rate, hard retention, and warm retention. I believe it costs around $25,000 annually to ingest 30GB of data daily. That is the SaaS version. There is also a self-managed license where the customer manages their own infrastructure on-prem. In such cases, there are three license tiers that respectively cost $5,000 annually per node, $7,000 per node, and $12,500 per node."
"Elastic Observability's pricing could be better for small-scale users."
"I would prefer that the price be reduced, as it would be easier to implement it and to sell it."
"Its pricing has been changed as per the market. You get a good support service with it as well. They have 24/7 customer support. There is a portal, and if you are having issues, they are available in order to resolve them. So, its pricing isn't too much."
"Pricing has some room for improvement."
"Splunk ITSI is expensive."
"Splunk ITSI is expensive; however, with the appropriate use case, it justifies the cost."
"Splunk pricing is high."
"Splunk ITSI is a pay-per-use service that is priced fairly based on the amount of data we use."
"The licensing is based on data usage."
report
Use our free recommendation engine to learn which Application Performance Monitoring (APM) and Observability solutions are best for your needs.
842,592 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
20%
Computer Software Company
15%
Manufacturing Company
9%
Government
6%
Financial Services Firm
21%
Computer Software Company
13%
Government
12%
Manufacturing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Elastic Observability?
Elastic Observability significantly improves incident response time by providing quick access to logs and data across various sources. For instance, searching for specific keywords in logs spanning...
What is your experience regarding pricing and costs for Elastic Observability?
Elastic Observability is cost-efficient and provides all features in the enterprise license without asset-based licensing. However, sizing and licensing information could be clearer.
What needs improvement with Elastic Observability?
Of course, maintenance is necessary, as with any software, requiring updates with the latest features and security enhancements. It lacked some capabilities when handling on-prem devices, like netw...
What needs improvement with Splunk ITSI (IT Service Intelligence)?
Currently, Glass tables in ITSI only display metrics related to KPIs. I proposed adding an option to show metrics related to entities. This would eliminate the need for custom SPL to achieve this f...
 

Overview

 

Sample Customers

PSCU, Entel, VITAS, Mimecast, Barrett Steel, Butterfield Bank
TransUnion, Cox Automotive, Carnival Cruises, Leidos, Econocom, National Ignition Factory, Entrust Datacard, Molina Healthcare, United States Census Bureau
Find out what your peers are saying about Elastic Observability vs. Splunk ITSI (IT Service Intelligence) and other solutions. Updated: March 2025.
842,592 professionals have used our research since 2012.