Splunk Cloud Platform vs Splunk Enterprise Security comparison

The compared Splunk Cloud Platform and Splunk Enterprise Security solutions aren't in the same category. Splunk Cloud Platform is ranked #3 in DV , with an average rating of 8.4, and holds a 0.5% mindshare in the category. Splunk Enterprise Security is ranked #1 in SIEM , with an average rating of 8.4, and holds a 11.2% mindshare. Additionally, 96% of Splunk Cloud Platform users are willing to recommend the solution, compared to 93% of Splunk Enterprise Security users who would recommend it.

Splunk Cloud Platform

Read 56 Splunk Cloud Platform reviews

232 Views
103 Comparison Views

96% willing to recommend

Splunk Enterprise Security

Read 303 Splunk Enterprise Security reviews

16,171 Views
13,494 Comparison Views

93% willing to recommend

Splunk Cloud Platform

Splunk Enterprise Security

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Splunk Cloud Platform and Splunk Enterprise Security based on real PeerSpot user reviews.

Find out in this report how the two Data Visualization solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed Splunk Cloud Platform vs. Splunk Enterprise Security Report (Updated: March 2023).

Buyer's Guide

Splunk Cloud Platform vs. Splunk Enterprise Security

March 2023

Download the complete report

Helped 824,067 peers since 2012

Categories and Ranking

Splunk Cloud Platform

Average Rating

8.2

Reviews Sentiment

4.4

Number of Reviews

Ranking in other categories

Data Visualization (3rd), IT Alerting and Incident Management (3rd)

Splunk Enterprise Security

Average Rating

8.4

Reviews Sentiment

7.1

Number of Reviews

303

Ranking in other categories

Log Management (1st), Security Information and Event Management (SIEM) (1st), IT Operations Analytics (1st)

Mindshare comparison

While both are Systems Management solutions, they serve different purposes. Splunk Cloud Platform is designed for Data Visualization and holds a mindshare of 0.5%, up 0.3% compared to last year.
Splunk Enterprise Security, on the other hand, focuses on Security Information and Event Management (SIEM), holds 11.2% mindshare, down 15.0% since last year.

Data Visualization

Security Information and Event Management (SIEM)

Featured Reviews

Mark Furman

Security Engineer at White Lodging

Offers real-time threat detection by continuously analyzing incoming logs and correlations

The Splunk Cloud Platform has improved our observability. We can see a lot more information both good and bad, but at least we have the information. It is important that Splunk Cloud Platform has visibility into our cloud-native environments. It comes to observability. And with the visibility, we're able to link, especially with our cloud environment, with Azure the correlations for threat reporting, correlations for account breaches, and correlations for compromised data ex-filtration that's going in and out. Splunk Cloud Platform has improved our mean time to resolution. It stepped down our investigation times. An investigation that used to take ten minutes is now down to five or six minutes per incident. It offers real-time threat detection by continuously analyzing incoming logs and correlations. These trigger pre-defined alerts, and any suspicious activity will be reported within five or six minutes. Splunk Cloud has saved costs through time savings. I can focus that time on other tasks improving productivity. We saw time to value within the first month of implementing the Splunk Cloud Platform. Splunk Unified Platform helps consolidate networking, security, and IT observability tools. We're primarily focusing on the security area and building out the correlations. We haven't moved to the infrastructure side yet. That is something we have on our company roadmap.

Read full review

Avinash Gopu.

Associate VP & Cyber Security Specialist at US Bank

Offers good visibility into multiple environments, significantly reduces our alert volume, and speeds up our security investigations

There are limitations with Splunk not detecting all user activity, especially on mainframes and network devices. This is because Splunk relies on agents, which cannot access certain workstations. In these cases, we have to rely on application data. For example, with mainframes, manual reports are generated and sent to Splunk, limiting visibility to what's manually reported. This lack of automation for specific platforms needs improvement from Splunk. Additionally, API access is limited for other applications that rely on API calls and requests. This requires heavy customization on Splunk's end. These are the main challenges we've encountered. Monitoring multiple cloud platforms, like Azure, GCP, and AWS, with Splunk Enterprise Security presents some challenges. While Splunk provides different connectors for each provider, consolidating data from two domains across distinct cloud environments can be complex. However, leveraging pre-built templates and Splunk's data collation capabilities can help overcome these hurdles. Despite initial difficulties, I believe Splunk can effectively address this task, earning it an eight out of ten rating for its multi-cloud monitoring capabilities. While Splunk Enterprise Security offers insider threat detection capabilities, its effectiveness could be enhanced by integrating with additional tools, such as endpoint security solutions. This integrated approach is particularly crucial for financial institutions, which often require dedicated endpoint security teams. While using multiple tools is valuable, further improvements within Splunk itself are also necessary. Considering both external integration and internal development, I would rate its current insider threat detection capabilities as three out of ten. Threat detection is where Splunk falls behind. While it offers tools, other use cases require additional work. PAM is an enterprise tool that centralizes information about users, servers, and everything else. It needs real-time monitoring, which I haven't seen in any of the companies I've worked for. They only rely on Splunk for alerting, but real-time monitoring should be handled by the endpoint security team's tools. This means there's no detection or analysis at the machine or endpoint level. Additionally, threat analysis reporting is also absent.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"I like the Cloud monitoring console feature."

"Dashboarding has been very powerful. I work with a lot of different customers, so being able to tailor the data for different customers has been valuable. I am able to make visuals and have reports where they can self-serve."

"Dashboards and alerting are the most valuable features. The dashboards let us see how the system looks in terms of anomalies, and the alerts trigger us to go and look at what possible problems are happening."

"Its interconnectivity with the cloud platforms, such as Azure and AWS, was valuable."

"Splunk Cloud Platform's most valuable features are enterprise security and ticketing integration."

"he cloud performance is good."

"In my organization, Splunk Cloud Platform has improved the issue revolving around transactions."

"The most valuable feature for me is the flexibility of being able to send the log to the https endpoint."

More Splunk Cloud Platform pros

"The ability to ingest different log types from many different products in our environment is most valuable."

"Being able to aggregate detection and alerts from various sources is valuable. Like everyone else, we have a wide range of tools in our shop. We are able to stop at one spot and look at all the data. All the data is able to come through, and we can then jump from source to source or index to index. We can dig deep whenever we need to and get a good high-level understanding."

"The Splunk queries are valuable."

"Splunk stands out for its extensive application integrations."

"The indexing and data collection are valuable."

"Splunk is stable, and this is why many customers want it."

"The most valuable function is the notable events. When I joined the team, I asked them what they could currently see, and they said nothing. I was pretty shocked. I know for a fact that they're using Enterprise Security or at least they had purchased it. I told them that there are several dashboards within Splunk that we can leverage. There is also notable events where we can see potential incidents or potential alerts about the infrastructure and the network itself."

"We can automatically suspend or terminate suspicious sessions."

More Splunk Enterprise Security pros

Cons

"Splunk Cloud could improve by having pre-defined templates. It has very good design views, but there is no predefined template. You have to define your own. If they could add predefined templates for different use cases."

"It needs to mature; it's just getting established in the industry on a wider scale."

"Support is the bigger issue when we have a problem. When we need their help, it takes weeks or months to actually get resolved."

"It is sometimes slow. Some of that has to do with the queries themselves not being efficient, but sometimes it is slow."

"Using basic natural language in English instead of writing a regex expression will be helpful."

"Customization could be simplified."

"I have not come across anything that I would consider missing as such. If anything, sometimes we have dashboards that would not go into the dark mode. It is a minor issue, but it is the only thing that I wish was there. The dark mode would definitely help."

"The administration could use improvement. We have to rely on support more often than we're used to."

More Splunk Cloud Platform cons

"Writing queries is a bit complicated sometimes."

"Splunk is more expensive than other solutions."

"There are new services which are coming up. If Splunk can catch up with the speed of Amazon, and with the integration, instead of us waiting for another year or so, that would be good."

"In the next releases, I would like to see more pricing flexibility."

"Most importantly, Splunk can be outrageously expensive. That is the problem with both Splunk and Sentinel. Their pricing literally explodes based on the amount of data you feed in."

"Its search or filtering capability is nice, but it can be improved. It is currently a bit complicated, and it should be simplified. If we can write the search filter in a more simplified way, it would be better."

"In terms of the interface, it could include some improvements for the look and feel."

"Splunk is very expensive. The license is based on the volume of the logs ingested. I was responsible for managing the contract with our service integrator. I don't know the precise details of the competing solution, but I have heard that Splunk is more expensive than others. I don't know what the going rate is on the market, but I think there are at least two competitors that are less expensive. We have experienced a few issues with our service providers in terms of log filtering and ingestion, so we continue to pay a bit more per day for our logs."

More Splunk Enterprise Security cons

Pricing and Cost Advice

"The cost of the Splunk Cloud Platform is high, and in addition to the standard licensing fee, we also have a premium support fee."

"The pricing model makes this an expensive solution."

"It was a good model."

"The Splunk Cloud Platform is expensive."

"We were on ingest. We were on-prem, and when we switched to the cloud, we went to an SVC model, and that has been a huge help. We are now able to ingest more data than before."

"I do not personally deal with that side, but from discussions, I know that it is one of the more expensive tools. I do not have anything to compare it with."

"The cost makes more sense for organizations that have a large amount of data ranges."

"It is a touchy subject because we are locked into it. That goes back to the rehydrating data. We cannot have the retention that we want to store for legal and compliance purposes because that is seven years' worth of data for some of the indexes, so we ship them off into S3 buckets and install them there, at which point they are invisible to Splunk, so we have to rehydrate them, but we cannot rehydrate those pockets into Splunk Cloud. We have to rehydrate them into a self-hosted version of Splunk, which can take days to set up and get going. I would not call Splunk's licensing and pricing predatory, but they have made it very difficult to maintain the independence of your own data."

More Splunk Cloud Platform pricing and cost advice

"Splunk is priced higher than other solutions."

"The solution is costly."

"While Splunk offers generous developer licenses and obtaining annual licenses is straightforward, the cost is a major consideration."

"Splunk is expensive based on our current requirements, but it's obviously worth what we pay."

"The price is comparable."

"As a team, we prefer the old pricing model with a perpetual license. We are still evaluating the whole subscription-based model."

"While licensing can be a concern, there are ways to reduce the licensing costs including filtering some events."

"ROI is estimated at saving my team roughly 10 to 12 man hours per week in troubleshooting for our company as well as what our profits had been from our services of installing, configuring, and supporting other clients with the product."

More Splunk Enterprise Security pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Data Visualization solutions are best for your needs.

See recommendations

824,067 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at Deloitte & Touche

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Computer Software Company

27%

Financial Services Firm

13%

University

Educational Organization

Financial Services Firm

15%

Computer Software Company

14%

Government

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Splunk Cloud Platform?

Splunk has sped up our response and reduced the time we spend manually monitoring any logs for ticketing tools or servers. It saves us around two hours daily.

See all answers

What is your experience regarding pricing and costs for Splunk Cloud Platform?

Splunk Cloud is affordable, depending on your license. I don't know how much it costs exactly, but my colleague said it depends on your licensing and which features you use.

See all answers

What needs improvement with Splunk Cloud Platform?

First-time users may struggle with the user interface. When I first used Splunk, I entered my username and password. After that, we get a dashboard on the left side with apps. At the top, you can c...

See all answers

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...

See all answers

What is a better choice, Splunk or Azure Sentinel?

It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...

See all answers

How does Splunk compare with Azure Monitor?

Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring information from different sources. Splunk is very good at alerting us if we...

See all answers

Comparisons

Wazuh vs Splunk Cloud Platform

Compared 59% of the time

Fortinet FortiAnalyzer vs Splunk Cloud Platform

Compared 10% of the time

Coralogix vs Splunk Cloud Platform

Compared 8% of the time

SolarWinds Kiwi Syslog Server vs Splunk Cloud Platform

Compared 8% of the time

More Splunk Cloud Platform Competitors

Wazuh vs Splunk Enterprise Security

Compared 10% of the time

IBM Security QRadar vs Splunk Enterprise Security

Compared 9% of the time

Dynatrace vs Splunk Enterprise Security

Compared 8% of the time

Datadog vs Splunk Enterprise Security

Compared 5% of the time

Sentinel vs Splunk Enterprise Security

Compared 4% of the time

More Splunk Enterprise Security Competitors

Product Reports

Buyer's Guide

Splunk Cloud Platform

November 2024

Download Splunk Cloud Platform product report

Buyer's Guide

Splunk Enterprise Security

November 2024

Download Splunk Enterprise Security product report

Learn More

Splunk

Overview

Splunk Cloud Platform is widely used for log management, security monitoring, application performance monitoring, troubleshooting, data aggregation, and IT operations. It centralizes logs from numerous sources, enabling detailed analysis, incident detection, and effective dashboard creation.

Companies across various industries leverage Splunk Cloud Platform for cybersecurity, compliance, user activity monitoring, and alerts. It helps in managing cloud environments, optimizing data storage costs, and enhancing customer insights with effective data visualization. The platform's robust capabilities include customizable reporting, flexible log sending, powerful search features, and seamless integration with other systems. Users monitor multiple environments and platforms effortlessly with the cloud infrastructure maintained by Splunk. Despite its advantages, users find the pricing steep, support ineffective, and encounter performance issues with large data volumes. Integration challenges, limited training resources, and insufficient documentation also pose concerns.

What are the most important features of Splunk Cloud Platform?

Customizable Reporting and Dashboards: Design personalized reports and visual dashboards.
Quick Setup: Rapid deployment and setup process.
Flexible Log Sending: Send logs seamlessly from multiple sources.
Powerful Search Capabilities: Conduct detailed log event searches efficiently.
Easy Integration: Integrates easily with other systems.
End-to-End Visibility: Complete monitoring of the IT infrastructure.
Automated Monitoring: Real-time automated oversight.
Federated Search: Search across multiple data sources.
User-Friendly Interface: Intuitive and accessible design.

What benefits can users expect from Splunk Cloud Platform?

Business Resilience: Improved continuity and reduced downtime.
Enhanced Cybersecurity: Advanced security features and compliance.
Performance Improvement: Better system performance and faster issue resolution.
Cost Optimization: Efficient data storage and cost management.
Customer Insights: Enhanced analytics for better understanding of customer behavior.

Splunk Cloud Platform is implemented across industries including finance, healthcare, retail, and technology. Organizations use it to enhance cybersecurity measures, meet compliance requirements, monitor user activities, and issue automated alerts. In finance, it assists in fraud detection and compliance. In healthcare, it ensures data security and regulatory adherence. Retailers use it for customer behavior analysis and performance monitoring, while technology companies benefit from its troubleshooting and log management capabilities. Despite its powerful features, companies face challenges with pricing, support, and integration that require consideration during implementation.

Splunk Enterprise Security is widely used for security operations, including threat detection, incident response, and log monitoring. It centralizes log management, offers security analytics, and ensures compliance, enhancing the overall security posture of organizations.

Companies leverage Splunk Enterprise Security to monitor endpoints, networks, and users, detecting anomalies, brute force attacks, and unauthorized access. They use it for fraud detection, machine learning, and real-time alerts within their SOCs. The platform enhances visibility and correlates data from multiple sources to identify security threats efficiently. Key features include comprehensive dashboards, excellent reporting capabilities, robust log aggregation, and flexible data ingestion. Users appreciate its SIEM capabilities, threat intelligence, risk-based alerting, and correlation searches. Highly scalable and stable, it suits multi-cloud environments, reducing alert volumes and speeding up investigations.

What are the key features?

Comprehensive Dashboards: Provide a holistic view of security operations.
Flexible Data Ingestion: Supports various data sources for better analysis.
Robust Log Aggregation: Centralizes log management for easier monitoring.
Machine Learning Toolkit: Enhances threat detection and prediction capabilities.
SIEM Capabilities: Integrates security information and event management.
Threat Intelligence: Utilizes external information to improve security measures.
Risk-Based Alerting: Prioritizes alerts based on the risk they pose.
Correlation Searches: Identifies and correlates security events effectively.

What benefits or ROI should users look for?

Enhanced Visibility: Improves monitoring across endpoints, networks, and users.
Faster Incident Response: Speeds up identification and resolution of security issues.
Reduced Alert Volumes: Lowers false positives and enhances signal-to-noise ratio.
Scalability: Adapts to growing and changing security needs.
Improved Security Operations: Integrates multiple security facets into one platform.

Splunk Enterprise Security is implemented across industries like finance, healthcare, and retail. Financial institutions use it for fraud detection and compliance, while healthcare organizations leverage its capabilities to safeguard patient data. Retailers deploy it to protect customer information and ensure secure transactions.

Sample Customers

Mindtouch

Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.

Buyer's Guide

Splunk Cloud Platform vs. Splunk Enterprise Security

March 2023

Free Report: Splunk Cloud Platform vs. Splunk Enterprise Security

Find out what your peers are saying about Splunk Cloud Platform vs. Splunk Enterprise Security and other solutions. Updated: March 2023.

DOWNLOAD NOW

824,067 professionals have used our research since 2012.

See our Splunk Cloud Platform vs. Splunk Enterprise Security report.

We monitor all Data Visualization reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.