Try our new research platform with insights from 80,000+ expert users

Splunk Enterprise Security vs vRealize Network Insight comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Splunk Enterprise Security
Average Rating
8.4
Reviews Sentiment
7.6
Number of Reviews
305
Ranking in other categories
Log Management (2nd), Security Information and Event Management (SIEM) (1st), IT Operations Analytics (1st)
vRealize Network Insight
Average Rating
8.6
Reviews Sentiment
7.6
Number of Reviews
46
Ranking in other categories
Network Monitoring Software (23rd), IT Infrastructure Monitoring (23rd)
 

Mindshare comparison

While both are Systems Management solutions, they serve different purposes. Splunk Enterprise Security is designed for Security Information and Event Management (SIEM) and holds a mindshare of 9.5%, down 12.8% compared to last year.
vRealize Network Insight, on the other hand, focuses on IT Infrastructure Monitoring, holds 0.5% mindshare, down 0.6% since last year.
Security Information and Event Management (SIEM)
IT Infrastructure Monitoring
 

Featured Reviews

ROBERT-CHRISTIAN - PeerSpot reviewer
Has many predefined correlation rules and is brilliant for investigation and log analysis
It is very complicated to write your own correlation rules without the help of Splunk support. What Splunk could do better is to create an API to the standard SIEM tools, such as Microsoft Sentinel. The idea would be to make it less painful. In ELK Stack, Kibana is the query language with which you can search log files. I believe Splunk has also a query language in which they search their log files, but once you have identified the log file that you want to use for further security correlation, you want to very quickly transport that into your SIEM tool, such as Microsoft Sentinel. That is something that Splunk could make a little bit less painful because it is a lot of effort to find that log file and forward it. An API with Microsoft Sentinel or a similar SIEM tool would be a good idea.
NiteshKumar1 - PeerSpot reviewer
The tool's configuration is easy and artifacts are easily accessible through professional services and the web
The product is highly regarded, and many customers have been using it along with other VMware products like vSphere and VMware vCloud Usage Insight. However, recently, there's been a trend among customers, especially those using VMware for a considerable period, to explore the potential of migrating to the public cloud. The common concern among these customers is how the VMware products will perform in the public cloud environment. Migrating instances from VMware to different platforms is not easy, especially when dealing with many instances across multiple customers. Customers are keen to maintain the functionality of their existing VMware products but prefer to run them on the public cloud instead of on-premise servers. Our clients for vRealize Network Insight are enterprise businesses. I rate it a nine out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We can quickly search for almost anything across many log sources in seconds."
"They are a good partner for Google Cloud. It provides great visibility, threat detection, and proactive mitigation of risks for our mutual consumers."
"The feature that I have found most valuable with Splunk is the ability to sift through a bunch of data very quickly."
"The most valuable feature of Splunk Enterprise Security is the comprehensive logging capabilities it provides."
"The most valuable feature of Splunk is the management and built-in workflows."
"Splunk allows us to find insights that we were not able to with traditional BI tools using ETL​. It allows us to dig into raw events."
"The UI of Splunk makes it easier for our analysts to move around and see what they need to see."
"It has quite extensive support in terms of integration. If you want to do anything, there are tools for that."
"The solution helps reduce time to value, increase performance, provide deep visibility, and easily manage networks."
"It allows us to see how the network devices function as well as to see network glitches or fluctuations or dropping of packets."
"It gives the visibility that was either broken or there in pieces only. This solution provides a unified view of the whole system, back and forth. It has helped to reduce time to value, increase performance, more easily manage networks, and provide deep visibility."
"The tool's ease of configuration and use and the availability of information and artifacts through professional services and the web are key factors that customers find valuable."
"By doing dependency mapping, it makes migrations more efficient. There are less outages that require engineers to spend additional hours troubleshooting the migration failures."
"What's valuable to us is the ability to get a view into the virtual space, which is something we haven't had before. Before, it was done by collecting from network endpoints and extrapolating into the virtual environment. Now it's coming directly from the virtual environment."
"The ability to use the natural language query and see the visualization is quickly intuitive, and it works very well."
"It helps a lot because, until now, we didn't have the tools to figure out the micro level, VM-to-VM kind of traffic; that was not in the current environment. We could not figure out VM-to-VM communication from the other tools. This is the tool which gives us end-to-end transparency."
 

Cons

"Splunk can improve regex/asset analysis as we do not want to crawl until it is done."
"The threat management part is still lagging. There are some gaps in threat management. Other vendors have built-in threat management systems, but Splunk lacks the threat management component in its portal. The UEBA and everything else is perfect, but it lacks a unified threat intelligence and management part."
"The algorithms customization of Splunk could improve. They have limited algorithms for machine learning support. If they can allow the user to add more machine learning algorithms, such as the ability to choose the algorithm that a user might want. Additionally, they should provide the required libraries for those algorithms, and then analyzes the data for use."
"I think the machine learning should be emphasized. Now, it's really important to analyze Big Data, data mining. A SIEM solution, like Splunk, needs an improved data mining solution, artificial intelligence."
"I would like some additional AI capabilities to provide additional information about things going wrong and things going well."
"A problem that we had recently had was we licensed it based on how much data you upload to them every day. Something changed in one our applications, and it started generating three to four times as many logs and. So now, we are trying to assemble something with parts of the Splunk API to warn ourselves, then turn it off and throttle it back more. However it would be better if they had something systematically built into the product that if you're getting close to your license, then to shut things down."
"It could be more user friendly, in terms of the end-user experience."
"It does not give us permission to implement on-premise so we implement them on the cloud."
"I would like to see more reporting features, more dashboards."
"I want to be able to monitor a network flow that is approximately two weeks back, but I haven't found an easy way to do this."
"The only issue we have is that the solution does not always capture the host names."
"I would like to see application identification. That would be cool."
"If it were more application-aware, more descriptive; if it were able to determine the application that is actually doing the communication, that would be easier. More application information: which user or account it's accessing, is it accessing this application, doing these calls, if it is accessing a script, what script is it accessing. Things like that would provide deeper analytics so I can track what's going on. It would not just be, "These people shouldn't be talking," but who is actually doing these calls."
"There could be some deeper analytics into packet inspection and trace flows. It could use some kind of machine learning to look at Layer 7 traffic for potential malware or corrupt packets."
"The solution can be improved by making it more compatible with other brands, allowing for better integration."
"If it had some kind of plugins with vSphere, more effective plugins with Horizon View or other VMWare products, if it had interconnectivity, I think it would be more effective than it is today."
 

Pricing and Cost Advice

"Free Splunk license for PoCs on personal machines and the ability to scale the PoC to an enterprise level app."
"Personnel costs are saved by not having to involve the domain developers from multiple teams when tracing a problem that spans multiple platforms."
"Most people share the same thought that the ingestion rates can get pretty pricey. There is a lot of work we do to curate the data that we send to Splunk so that it is not too noisy or too expensive."
"It can be tough to determine if you are getting all of the value out of your investment at times."
"The pricing depends on the bandwidth of an organization and is good compared to some SIEM tools. IBM, for example, is quite costly. But Microsoft Sentinel is notably cheaper."
"It can be cost-prohibitive when you start to scale and have terabytes of data. Its cost model is based on how much data it processes a day. If they're able to create scaled-down niche or custom package offerings, it may help with the cost. Instead of the full-blown features, if they can narrow the scope where it can only be used for a specific purpose, it would kind of create that market for the product, and it may help with the costing. When you start using it as a central aggregator and you're pumping tons of logs at it, pretty soon, you'll start hitting your cap on what it can process a day. Once you've got that, you're kind of defeating the purpose because you're going to have to scale back."
"Splunk differs from other SIEM solutions by using a gigabyte-based pricing model, rather than the agent-based licenses common with its competitors."
"I think that most of the log analytics solutions are expensive and I'm not sure if it's worth it."
"The solution has helped us to reduce time, increase performance, reduce costs, and even easily manage networks. We are probably seeing 10 to 20 percent labor savings because we are able to be very specific and focused on what we want to do. It ends up saving the customer money and makes us be more efficient on our cost deliveries."
"It reduces costs. It takes something that may be challenging and makes it more usable and visual by being able to bring in tools, seeing what their impact is, such as microsegmentation and application rationalization, and seeing it quickly."
"vRealize Network Insight is expensive."
"It has brought more money into our company."
"I rate vRealize Network Insight's pricing a seven point five out of ten."
"They should include the product in NSX because it's important to have it for deployment."
"It's an expensive product because we have a lot of nodes."
"Cost always has room for improvement, you could always make it cheaper. But I think it's a good value for what you pay for it."
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
842,767 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Computer Software Company
14%
Manufacturing Company
8%
Government
8%
Financial Services Firm
16%
Computer Software Company
13%
Government
11%
Manufacturing Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
What is a better choice, Splunk or Azure Sentinel?
It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...
How does Splunk compare with Azure Monitor?
Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring information from different sources. Splunk is very good at alerting us if we...
What do you like most about vRealize Network Insight?
The tool's ease of configuration and use and the availability of information and artifacts through professional services and the web are key factors that customers find valuable.
What is your experience regarding pricing and costs for vRealize Network Insight?
Broadcom is known for increasing product prices, making them expensive compared to what people used to pay. I liken the subscription model to not truly owning what you pay for.
What needs improvement with vRealize Network Insight?
Right now, I do not see a specific area for improvement. My main concern is understanding the intentions of Broadcom, which has acquired VMware. Broadcom should improve by going back to what was wo...
 

Also Known As

No data available
Arkin
 

Overview

 

Sample Customers

Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.
NTTi3, VCIX-NV, VMware Networking and Security Business Unit, Illumio, CompuNet
Find out what your peers are saying about Splunk, Wazuh, Microsoft and others in Security Information and Event Management (SIEM). Updated: March 2025.
842,767 professionals have used our research since 2012.