Try our new research platform with insights from 80,000+ expert users

Elastic Observability vs Splunk ITSI (IT Service Intelligence) comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jul 24, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Elastic Observability
Ranking in Application Performance Monitoring (APM) and Observability
7th
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
26
Ranking in other categories
IT Infrastructure Monitoring (7th), Log Management (12th), Container Monitoring (4th), Cloud Monitoring Software (7th)
Splunk ITSI (IT Service Int...
Ranking in Application Performance Monitoring (APM) and Observability
10th
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
49
Ranking in other categories
IT Alerting and Incident Management (4th)
 

Mindshare comparison

As of January 2025, in the Application Performance Monitoring (APM) and Observability category, the mindshare of Elastic Observability is 6.4%, up from 5.4% compared to the previous year. The mindshare of Splunk ITSI (IT Service Intelligence) is 0.8%, up from 0.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Performance Monitoring (APM) and Observability
 

Featured Reviews

Adelina Craciun - PeerSpot reviewer
Customization enables tailored monitoring and alerting across departments
The possibility to customize it has been quite useful. Whatever the other departments want to dream up, we implement. Whatever they want to monitor, the granularity of it, the changes in the threshold, and the anomalies that they want reported all require some development. So far, every single request has been fulfilled.
Sunil K R - PeerSpot reviewer
Helps improve our incident response time, and our mean time to resolve, but visibility is limited
In my previous project, I successfully led the end-to-end deployment of a Splunk migration. The process went smoothly thanks in part to Splunk's professional services team. They conducted a thorough assessment, identified all our potential pain points, and developed a tailored solution and migration plan. This comprehensive approach ensured a seamless transition. Our core deployment team consisted of 5 internal members and two specialists from Splunk. Additionally, the project included a project manager and a product owner. We also benefited from the expertise of two professional service consultants and two representatives from the customer's side. An on-site admin architect further provided valuable technical support. Throughout the deployment process, we leveraged support from various resources whenever necessary. This included assistance with configuration changes, deployments, and other related tasks. We also collaborated effectively with our teammates to ensure a smooth and successful implementation.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It is scalable and supports multitenancy, which is beneficial for MSPs."
"The price is very less expensive compared to the other solutions."
"I recommend Elastic Observability for its completeness of vision and wide ecosystem."
"We use AppDynamics and Elastic. The reason why we're using Elastic APM is because of the license count. It's very favorable compared to AppDynamics. It's inexpensive; it's economical."
"Machine learning is the most valuable feature of this solution."
"Its diverse set of features available on the cloud is of significant importance."
"The solution is open-source and helps with back-end logging. It is also easy to handle."
"It's easy to deploy, and it's very flexible."
"The solution's most valuable feature is the aggregation of the metrics and the relative ease of getting them away from search."
"In my opinion, Splunk IT Service Intelligence (ITSI) is better than QRadar. With the help of Splunk, we can get results."
"Splunk ITSI offers a valuable visualization tree that allows us to map and analyze dependencies and co-dependency within our environment."
"What I like the most is the event correlations. It's a file structure, and ITSI has a correlation layer where you can normalize the events from different sources. Once these events are normalized, you set up rules to aggregate them into different or the same attributes. After the rules are defined, you can automate the process to solve the issue automatically."
"The search function is the most valuable. It includes regular expressions and wild card searches. We'll write searches using field and case-sensitive services and use all of these search types to write an alert condition. Splunk ITSI has another feature called Glass Table that offers a visual representation."
"The most valuable features are the mapping of the entities, which provides a comprehensive analysis, and the service analyzer for thresholding."
"We can automate routine tasks. We're able to create alerts, reports, scheduled searches, et cetera. It's helping us to save time."
"The solution's scalability is fine."
 

Cons

"The auto-discovery isn't nearly as good. That's a big portion of it. When you drop the agent onto the JVM and you're trying to figure things out, having to go through and manually do all that is cumbersome."
"One example is the inability to monitor very old databases with the newest version."
"There's a steep learning curve if you've never used this solution before."
"Elastic Observability is difficult to use. There are only three options for customization but this can be difficult for our use case. We do not have other options to choose the metrics shown, such as CPU or memory usage."
"The price is the only issue in the solution. It can be made better and cheaper."
"In the future, Elastic APM needs a portfolio iTool. They can provide an easy way to develop the custom UI for Kibana."
"Elastic Observability is an excellent product for monitoring and visibility, but it lacks predictive analytics. Most solutions are aligned with the AIOps requirements, but this piece is missing in Elastic and should be included."
"The solution would be better if it was capable of more automation, especially in a monitoring capacity or for the response to abnormalities."
"The dashboard function inside the individual episodes, not at the ITSI Notable Event Aggregation Policy level but actually at the correlation search layer, is an area where improvements are required."
"They should make it easier to use. Many people are new to it. It is hard and has a steep learning curve."
"The end-to-end visibility in Splunk ITSI is limited and has room for improvement."
"Splunk ITSI consumes a lot of CPU resources."
"If they can somehow integrate it with AI in the near future, it will definitely be a game changer."
"Splunk ITSI lacks out-of-the-box solutions for enterprise users."
"Splunk ITSI generates numerous false positives and has the potential for enhancement."
"Integration is the most critical area to improve in Splunk IT Service Intelligence (ITSI). It wasn't a great experience because you had to do a little back and forth to integrate the solution."
 

Pricing and Cost Advice

"We will buy a premium license after POC."
"One needs to pay for the licenses, and it is an annual subscription model right now."
"So far, there are just the standard licensing fees. Several of the components are embedded in the license or are even open source. They're even free depending on what you use, which makes it even more appealing to someone that is discussing pricing of the solution."
"Elastic Observability is cheaper than other similar solutions, such as Dynatrace. Its license calculation is based on various factors like data volume and physical infrastructure, particularly related to RAM capacity."
"We have been using the open-source version."
"There are two types: cloud and SaaS. They charge based on data ingestion, ingest rate, hard retention, and warm retention. I believe it costs around $25,000 annually to ingest 30GB of data daily. That is the SaaS version. There is also a self-managed license where the customer manages their own infrastructure on-prem. In such cases, there are three license tiers that respectively cost $5,000 annually per node, $7,000 per node, and $12,500 per node."
"The product is not that cheap."
"The price of Elastic Observability is expensive."
"It is interesting. I am not involved that much lately, but if I recall correctly, you license primarily on the volume of data that you are using in Splunk ITSI, but there is no way Splunk can ever check if that is true, so that is interesting. We are not doing it, but someone can pretend to just use 10%, and it would be super cheap. It is tricky, but it is more tricky for Splunk than for us."
"Splunk ITSI is expensive compared to other tools."
"I would prefer that the price be reduced, as it would be easier to implement it and to sell it."
"The licensing is based on data usage."
"Splunk ITSI is expensive; however, with the appropriate use case, it justifies the cost."
"The pricing of Splunk is a bit high."
"Splunk ITSI is an expensive tool, and we need to purchase the utility license."
"Splunk ITSI is a premium application and comes with a premium price tag."
report
Use our free recommendation engine to learn which Application Performance Monitoring (APM) and Observability solutions are best for your needs.
831,158 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
22%
Computer Software Company
15%
Manufacturing Company
8%
Government
6%
Financial Services Firm
20%
Computer Software Company
13%
Government
13%
Manufacturing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Elastic Observability?
Elastic Observability significantly improves incident response time by providing quick access to logs and data across various sources. For instance, searching for specific keywords in logs spanning...
What is your experience regarding pricing and costs for Elastic Observability?
Elastic Observability is cost-efficient and provides all features in the enterprise license without asset-based licensing. However, sizing and licensing information could be clearer.
What needs improvement with Elastic Observability?
Elastic Observability could improve asset discovery as the current requirement to push the agent is not ideal. Simplifying the parsing of logs and manual efforts would also be beneficial.
What needs improvement with Splunk ITSI (IT Service Intelligence)?
Currently, Glass tables in ITSI only display metrics related to KPIs. I proposed adding an option to show metrics related to entities. This would eliminate the need for custom SPL to achieve this f...
 

Learn More

 

Overview

 

Sample Customers

PSCU, Entel, VITAS, Mimecast, Barrett Steel, Butterfield Bank
TransUnion, Cox Automotive, Carnival Cruises, Leidos, Econocom, National Ignition Factory, Entrust Datacard, Molina Healthcare, United States Census Bureau
Find out what your peers are saying about Elastic Observability vs. Splunk ITSI (IT Service Intelligence) and other solutions. Updated: January 2025.
831,158 professionals have used our research since 2012.