Splunk Cloud Platform Reviews

We use Splunk Cloud Platform for security and want to implement it as a SIEM solution. We also want to replace our old legacy SIEM solution because we are adopting a cloud solution instead of an on-premises solution. Another use case is that we want to use this tool in our managed service offering. We do not use the solution to resell licenses to our customers, but rather to provide services to them. We appreciate the powerful integration that Splunk Cloud Platform offers, making it easy to integrate with any sources and any data. It is able to handle data that resides in an S3 bucket or elsewhere, not just ingested directly into the SIEM itself. We are also looking at Splunk Cloud Platform's strategy, which is very interesting because of the integration they will have regarding Agentic AI and automation. A unique solution for orchestration and automation, called SOAR in cybersecurity, combined with SIEM in a unique platform is a very interesting strategy from our point of view.

It is Enterprise Security in the cloud. This is a cloud solution.

Splunk Cloud Platform is a very mature solution and an enterprise-grade solution that brings the work we have to do with customers to an enterprise-grade level. It is something that we can manage from a single pane, and it is quite easy to deploy. I see a benefit that is not strictly related to the features that Splunk Cloud Platform offers, but it depends on the company belonging to Cisco now because we are a Cisco partner and Splunk Cloud Platform is a pillar, a vertical technology in the security area of the partnership. The benefit of partnering with Splunk Cloud Platform falls into the Cisco partnership and the benefits we can have in this important partnership we have as a company.

Compared to my previous situation, the first benefit of this solution is the speed and the effort reduction in terms of onboarding new customers and maintaining the entire platform. I will not have any more effort for system upgrades and infrastructure maintenance. This is one of the biggest benefits I can have from the solution. I save a lot of money because I do not have to spend resources anymore to maintain and operate the infrastructure and the systems.

I think it is really effective, and we are still at the beginning. The capability to search for insights is very powerful and also supported by AI and machine learning. The capabilities are increasing day by day, and new features are being released and will be released soon.

I am not able to answer right now, but I am confident they will be able to predict a trend because they promise they are able to do this using machine learning algorithms and Agentic AI features. They say they will be able to predict the behavior of your network or your infrastructure. I am really confident about this, and I hope it will be true because I need this.

There is something that they say will be improved, and I am still waiting for it. This is the Agentic AI elements inside the platform that I mentioned before. There is something present today, but the full feature is not released yet. From my point of view, it is a bit late. It is okay for me because we are adopting it and we can work on this, and it is acceptable for my timing. However, from a market perspective, they are a bit late. Competitors in some cases are earlier adopters. But I am sure they will release a very powerful tool, as per the Cisco approach. They want to win when they start doing something, and I am confident they will release a very powerful tool.

I have been working with it for one month.

It is still a bit early to answer. We have just seen it on paper, and we have to check it.

In my previous experience, I had enterprise security, but on-premises a few years ago, three years ago. It was integrated with another SOAR from another vendor.

It is something that we can manage from a single pane. It is quite easy to deploy.

Compared to my situation, it does not have any meaning because I have something legacy now. However, it is a good price on the market. It depends because if you look at the list price, it is a bit expensive from my point of view. But once you are in the partnership with Splunk Cloud Platform and with Cisco, you can have good discounts, you can make the deal and discuss, and they are willing to help you as a partner in finding the solution and finding your target. So it is good from my point of view. But if you look at the list price, it is expensive.

We evaluated QRadar, FortiSIEM, and Palo Alto SIEM. We chose Splunk Cloud Platform because of a combination of different aspects, not just for price or features. It is the whole combination of the features, the benefits, the cost, the partnership, and there is no one aspect leading the choice. It is a mix and a combination.

Today, we are working with the SIEM solution, which is quite a legacy term. Saying SIEM is not really effective. It is the Enterprise Security solution, and we are now in the process to implement it. We are adopting the solution and are at the beginning. We have studied a lot, we are training people, and we are changing and modifying our process as per what the technology allows us to do. We are also evaluating the observability solution. We are working on two different paths, and one is at a more mature stage, while the other one is at an evaluation stage.

We are setting up alerts as expected.

We are integrating Splunk Cloud Platform SIEM solution with our SOAR solution, which is today from another vendor and not Splunk Cloud Platform. Then we will see tomorrow what we want to do if we want to use the unique platform, the unique Splunk Cloud Platform with SOAR, Agentic AI, SOC automation, and everything, or if we want to keep using our actual SOAR. We are integrating Splunk Cloud Platform with this SOAR.

My recommendation is to look at the future and look at the strategy. Do not look at the features today but look at the features tomorrow and not just at the technical features but at the whole strategy to integrate in one single platform all the capabilities that a SIEM solution or a log gathering solution might have. Putting together orchestration, observability, security, this kind of strategy is what an integrator should evaluate in my opinion.

I would rate this product an 8 out of 10.

We currently utilize Splunk Cloud Platform for detection and response engineering. We utilize it for network and endpoint types of detections. Specifically for an endpoint, it would be similar to a CrowdStrike alert. Those logs are sent into Splunk Cloud Platform, and we set up a rule that alerts if there are any abnormal detections on that endpoint.

Our main use case is detection and response engineering. We have GitHub code for these detections and those are deployed into Splunk Cloud Platform.

Splunk Cloud Platform offers features that are easier to use than having Enterprise Security and other applications on top of it. The most significant advantage is not having to deal with on-premises server management.

This has affected my day-to-day work significantly, as we have only two Splunk engineers who manage Splunk Cloud Platform as a whole. It makes management much easier, especially considering how large our company is.

Splunk Cloud Platform has positively impacted our organization by maintaining very consistent detection speed across Splunk Cloud Platform and Splunk Enterprise. The focus has been on having more uptime on the server as a whole, particularly regarding the detection and response engineering aspect and how our team utilizes Splunk Cloud Platform.

There are no improvements needed at this time, as the focus is on purchasing other applications such as Enterprise Security if we want to mature our security team as a whole.

The pricing may change with the new Security Essentials program that just launched, and I believe that the AI benefit in Security Essentials will be very beneficial for onboarding people into that program.

We have been using Splunk Cloud Platform for about a year and a half.

Splunk Cloud Platform is stable.

Splunk Cloud Platform's scalability has been very suitable for our environment.

The platform's ability to scale aligns well with our organization's demand fluctuations, and we are not a large enough company for the volume of logs being sent to Splunk Cloud Platform to encounter issues at this time. It parses the data effectively, and we maintain consistent uptime.

Customer support for Splunk Cloud Platform has been good to our company.

My advice for others considering Splunk Cloud Platform is to think about what you are looking for in your company, whether you want more products and if the pricing model with on-premises is more beneficial to having more applications while managing that server. I am not familiar with the pricing model, so I cannot provide detailed information. I would rate this product an overall 8 out of 10.

I used Splunk Cloud Platform for fraud detection. The first thing is fraud detection, and the second thing is understanding data better because of the data visualization that it has. The display that it has compared to a simple type of visualization is much clearer compared to any kind of thing you might notice on a super dense Wireshark.

Data Visualization and IT Alerting and Incident Management are the main valuable features, primarily to get a better idea of what's going on.

When you do data reporting using Splunk Cloud Platform, because you have everything in front of you and it's so detailed and easy to read once you have the data. Another thing that makes it clear is because of the amount of evidence you have in front of you, the data is a lot more valuable. It's less of a human claim and more of evidence presented in front of you when you're trying to make any kind of claim on a certain thing going on.

I really do like about Splunk Cloud Platform the real-time alert where you can search for anything and the data is still stored there because at the end of the day, we are finally in a generation of cloud where everything is stored on a cloud platform to the point that you can search anything, as long as you do it in the appropriate way, you will find the results. It's in a good visual status with good visibility. I appreciate this feature.

To be honest, I don't think it's beginner-friendly. It takes time and multiple meetings to actually understand how to create different types of alerts or how to search for them. It's quite similar to how you might search on SQL, but that's asking another set of skills to have. I know there are tutorials on the website, but I feel if they rolled out more free courses on such things that provide a link to a free course for beginner training, I feel people would be interested in it.

I ended up getting access around three to four months back. I was part of a team that was using it, so we got on a call together while I was observing them and using it while giving my input for a project.

I haven't really faced much of it, but my usage was pretty less intensive, so I can't really talk about it for everyone. From my perspective, because of my light amount of research and light usage of it, I would say it's been pretty good. I haven't experienced any stability issues.

Splunk Cloud Platform is a good tool, but it's not the easiest to transfer between different teams because there's a lot of training involved in it. While I do the tool and I do feel it's really useful, if you ever notice in this current industry, people are wanting employees to learn Splunk Cloud Platform, or at least they want applicants who apply for a certain role to have known Splunk Cloud Platform because of not only how new it is or how recent it is after the cloud integration, but also just that it takes time to learn and takes time to be efficient at it.

When you work in a corporation, you have people dedicated just for that.

Negative

I've used Splunk Cloud Platform very briefly, not too much. I use ServiceNow, Confluence for documentation, and Keyfactor for generating certificates.

It's kind of hard for me to say because I came from a corporation where Splunk Cloud Platform was already a part of the user group where I got access to it, so I didn't have to do any of that.

Any IT person would rather use the command prompt. Using a simple command prompt and trying to see based on the elevated access they have, you can always check what's going on. Wireshark itself is a really good tool and a really good alternative to have any kind of packet capture and read through the data to understand what's going on.

Splunk Cloud Platform is different because it offers real-time alert. Wireshark is something that you have to let things be and then later catch and see, while Splunk Cloud Platform updates on its own. It has a lot better visuals overall.

Regarding whether Splunk Cloud Platform's ingest and visualization features have helped improve data reporting and the overall alerting mechanisms, I haven't had the chance to use it for myself, but from the time when I was researching them for the project that I was working on, it seemed to be really effective in at least the fraud department of the team to understand any type of price alerts when something is going on.

Regarding how easy or difficult it was for me to learn how to use it, I would say on a scale of easy with one being the easiest and ten being the hardest, I would say it was around a four or five. I've used other tools before, and I've used other things such as Wireshark and some others a lot before, so I had a much better grasp than a lot of beginners might have. Recently in a meeting where we were trying to teach a beginner about this, the main person who uses it had to go through multiple rounds of meetings to show them how to use it. While watching that, I realized the gap in knowledge between someone who's in IT for years versus someone who's trying to be more hands-on but is unfamiliar with the tool.

My main use case for Splunk Cloud Platform is data operations. We ingest all of our feeds into the platform and normalize the data for Enterprise Security and notable use as a specific example of how I use Splunk Cloud Platform for data operations. I think it's a unique case because we are doing retail fraud instead of the normal security authentication and governance.

The best features Splunk Cloud Platform offers include GUI access for a lot of operational commands. For example, we're able to restart our search heads, create indexes, and HEC tokens on the front end. Having GUI access for those operational commands helps my team day-to-day as it saves time and reduces errors.

Splunk Cloud Platform has positively impacted my organization by offering a one-stop shop to get a lot of things done. In one place now, we're able to triage incidents much faster within the platform and create our apps to upload easily, which has had a significant impact on my workflow and team.

I think Splunk Cloud Platform could be improved by having a little more access to the backend for admins.

I have been using Splunk Cloud Platform for three and a half years.

Splunk Cloud Platform is stable.

The scalability of Splunk Cloud Platform is pretty easy and pretty good as we have a lot of data. The platform's ability to scale aligns pretty well with my organization's demand fluctuations, and we haven't had major issues regarding scalability.

The customer support for Splunk Cloud Platform is helpful. My experience with Splunk Cloud Platform's app ecosystem is that it's pretty easy to manage updates within this ecosystem. If we are having issues, our Splunk support is pretty quick to hop on a call or get an email to help us when we create a ticket.

I did not previously use a different solution; I've only used Splunk.

I have seen a return on investment as we have had money saved with investigations and we are able to keep the team to a minimum with the support of the platform.

Before choosing Splunk Cloud Platform, I did not evaluate other options as I was not a part of that decision, but previously, I did on-prem.

My advice for others looking into using Splunk Cloud Platform is to create and document protocols for your data before launching. The subscription model impacts my financial planning for data platform investments by working pretty well, and we're currently working on reducing our licensing by working on our feeds before they're indexed. I rate this product an 8.

My main use case for Splunk Cloud Platform is performance monitoring. For performance monitoring, I get the data in from our workloads into the platform and then write searches in order to set up alerts on certain thresholds for that data. That is the main way I use Splunk Cloud Platform.

In my opinion, the best features Splunk Cloud Platform offers are the flexibility to complete virtually any use case. That flexibility has made a difference for my team by allowing us to help other IT teams with increasing efficiency. Splunk Cloud Platform has positively impacted my organization by allowing us to be more proactive with our monitoring. Being more proactive has changed things for my team by allowing us to decrease downtime of business applications.

Splunk Cloud Platform could be improved by integrating AI agents into the platform since they should be a native feature, similar to how they are a feature in observability.

I have been using Splunk Cloud Platform for over five years.

Splunk Cloud Platform is stable.

Splunk Cloud Platform's scalability is pretty good.

Customer support for Splunk Cloud Platform can be improved.

We previously used a different platform before Splunk Cloud Platform, but I do not want to say the name, and the reason for the switch was more flexibility.

I have seen a return on investment with Splunk Cloud Platform, and there is definitely efficiency that was created with time saved, though I do not have a hard number for you.

Overall, Splunk Cloud Platform is very good, but there are some areas of improvement that are still needed, which is why I would rate it an eight out of ten.

Regarding Splunk Cloud Platform's AI capabilities, I do not think I have any issues with its governance and security. However, I think its accuracy and reliability of output are not very good right now. I think AI features need a lot of help in Splunk Cloud Platform.

My experience with Splunk Cloud Platform's app ecosystem is that it is not too difficult to manage updates, but the biggest pain point is with vendors making apps compatible with new versions of Splunk Cloud Platform.

Splunk Cloud Platform does a good job of letting me see what is happening across all my different environments such as my cloud systems, my on-premises systems, and my hybrid setups. The platform's ability to scale aligns well with my organization's demand fluctuations, and it does a good job.

My advice to others looking into using Splunk Cloud Platform is to learn the platform first.

Splunk Cloud Platform serves as our primary observability solution, focusing on monitoring logs, metrics, and traces for our systems.

We primarily use Splunk Cloud Platform for log monitoring by setting up feature dashboards in my day-to-day work.

Dashboards are used to monitor business API and business-related metrics from logs, which enhances our workflow.

Splunk Cloud Platform offers exceptional features including quick upgrades, as Splunk Cloud receives the first upgrade for any GA release with rapid support.

Their team manages indexers and search head upgrades, allowing us to focus on bringing data and creating metrics from it and monitoring that output.

Splunk is very helpful in troubleshooting with its SPL, and the AI assistant significantly helps in troubleshooting issues.

Splunk MCP allows quick turnaround with integration into platforms.

The platform's ability to validate application logs, correlate microservices using trace IDs, and enhance security with threat detection greatly impacts our organization.

More guardrails can be implemented, and workload management can be improved in Splunk Cloud Platform.

Ad hoc searches are still being executed with index equal to star, which reveals opportunities for improvement, and there must be a way to enforce this.

Splunk should enforce predicates for users, requiring index equal to an index name instead of allowing index equal to star. This will improve compute utilization and help maintain stability in Splunk Cloud Platform.

I have been working in my current field for the last six years.

We have been using Splunk Cloud Platform for the last six years.

Splunk Cloud Platform is stable.

Scalability is good, as we work with our TAM to ensure our environment is right-sized, preventing any issues or load impacts.

Customer support is very good, and we have a dedicated TAM as well as a dedicated engineer to assist us.

We did not use any other solution previously. We were using Splunk Enterprise before migrating to Splunk Cloud Platform, so we have always been Splunk customers.

We are utilizing federated search with S3 in our organization, redirecting 20 terabytes of low-value logs into S3.

Using federated search heavily allows us to save significantly on costs, which is a very important metric for us.

My experience with pricing, setup costs, and licensing has been very good, as we did not face any issues.

We're receiving all the needed support from the start.

Teams should evaluate their business use case and compare whether that use case can be effectively implemented with Splunk Cloud Platform.

It's important to determine the retention period for logs and to identify high-value logs versus low-value logs; high-value logs can go directly into Splunk Cloud Platform while low-value logs can be redirected to S3, utilizing federated search with S3 for low-value log management.

I would rate this solution a 7 overall.

I advise customers on using Splunk Cloud Platform to bring together and analyze logs and other machine data for security monitoring, troubleshooting, and operational visibility. My focus is on identifying business outcomes and opportunities to reuse data across multiple use cases. I do not operate the platform within my own organization.

What are Splunk Cloud Platform's best features? Why?

What I value most is the flexibility to search, correlate, and visualize data from different sources. This supports discussions that start with a business problem and then identify the data needed to address it, rather than limiting the conversation to a single predefined application.

Search, dashboards, and alerting can help teams investigate issues and make operational information easier to understand. The ability to use relevant data across multiple use cases is particularly valuable when customers want to connect security monitoring with broader operational visibility. 

It is important to distinguish the platform from complementary products.

 Splunk Cloud Platform, provides a foundation for data analysis, while requirements such as a full  SIEM solution or application performance monitoring may call for additional products, capabilities, and configuration.

A public customer example of the broader Splunk platform's potential is Zeppelin. Splunk's published customer story describes how Zeppelin uses operational and equipment data, together with machine learning, to identify potential faults and support predictive maintenance. This illustrates how data analysis can help organizations move from reactive troubleshooting toward more proactive maintenance.

I was not involved in that implementation. The published case uses Splunk Enterprise, Splunk Machine Learning Toolkit, and Splunk DB Connect; it should therefore be understood as an example of the broader Splunk platform rather than a reference deployment of Splunk Cloud Platform.

More ready-to-use configurations, guided workflows, and clear reference architectures would help customers turn business requirements into working solutions faster. Simplifying app selection and configuration would benefit teams with limited specialist resources. Clearer guidance on when to use Splunk Cloud Platform and when to add complementary security or observability products would also improve project scoping and time to value.

I have been working with Splunk Cloud Platform in a customer advisory capacity for more than seven months. My experience focuses on discussing business requirements and potential use cases rather than administering an internal deployment.

I consider scalability one of Splunk Cloud Platform's strengths. However, I have not personally carried out capacity planning or load testing.

For a specific deployment, I would ask a technical specialist to validate the expected data volumes, search workloads, retention requirements, and service capacity against the customer's needs.

My overall impression of Splunk's technical support is good to excellent, and I would rate it eight to nine out of ten. This reflects my advisory perspective rather than day-to-day ownership of support cases for an internal production deployment.

From an advisory perspective, I assess pricing in relation to the customer's intended outcomes and total cost of ownership rather than license cost alone.

For a narrowly scoped requirement, customers should carefully assess whether the expected benefits justify the investment. The value proposition can become more compelling when the platform supports several relevant use cases and allows data to serve multiple teams or business objectives.

However, broader usage does not automatically mean lower costs. Customers should understand the applicable licensing model, expected usage, data retention requirements, additional products, implementation services, and ongoing administration.

Implementation effort depends on the environment, data sources, integrations, and desired outcomes. I would avoid assuming a fixed deployment timeframe or making a general pricing comparison with another vendor without a like-for-like scope.

I would rate Splunk Cloud Platform nine out of ten, based on my customer advisory experience. 

My advice is to start with a clearly defined business problem and measurable success criteria. Identify the necessary data sources, confirm which products and capabilities are required, and involve experienced technical specialists early.

Start with a manageable use case that can demonstrate value, then expand where there is a sound business case. Evaluate implementation effort and ongoing operating costs alongside the platform's flexibility.

My main use case for Splunk Cloud Platform is detecting issues and dashboard monitoring. I monitor our provisioning platform with Splunk Cloud Platform to detect whether fallouts are occurring and to determine success rates.

I have not been able to explore the new features in depth yet after we just rolled out Splunk Cloud versus our Splunk Enterprise. I actually preferred the navigation in Splunk Enterprise versus Splunk Cloud, which I found to be not as user-friendly.

Splunk Cloud Platform has positively impacted our organization because we have been able to detect increases in failures and report on success rates of our platform. The performance is about the same as what we were able to do with Splunk Enterprise regarding how quickly we are able to detect those failures or any specific outcomes or metrics since moving to Splunk Cloud Platform.

Quicker access to logs via the searches that we run is how Splunk Cloud Platform can be improved, as there are cases where queries take extended amounts of time even if we are pulling a short amount of duration, which could be due to the way queries are written and their inefficiency.

I have been using Splunk Cloud Platform for just a couple months.

As a user, I have noticed no issues, which indicates that Splunk Cloud Platform is stable in my experience.

As a user, I feel that Splunk Cloud Platform scales relatively well, but since I do not work with that, I am unable to prove it.

Splunk Enterprise was the previous solution.

I do not believe that our company is utilizing the AI capabilities of Splunk Cloud Platform at this point regarding its governance and security. I believe the accuracy and reliability of output in Splunk Cloud Platform is good, and it depends on what the query is and how well the query is written, and whether we are actually querying for what we are looking for.

My advice for others looking into using Splunk Cloud Platform is to make sure you learn and understand how to write efficient queries so your results load more quickly, allowing you to get the most accurate results. I would rate this review an 8.

My main use case for Splunk Cloud Platform is building dashboards and alerts to help aid our Dev team and video team troubleshoot.

For our acquisitions team, I set up an alert to track the provider issues that cause the errors. From them, it leads to how many times a provider goes down, and it sends it to a web hook.

We mainly use Splunk Cloud Platform to troubleshoot through our logs and find areas of weakness or help us determine where something has gone wrong with our microservices through AWS.

The best features Splunk Cloud Platform offers are that it is easy to learn and the accessibility to the different features as well as step-by-step processes.

What makes it easy to learn is the querying style in Splunk, which is straightforward and simple in syntax.

Splunk Cloud Platform positively impacts our organization by allowing us to go through our logs more simply and filter out different material that we are looking at, as well as collect logs in one place for us to search through and build comprehensive dashboards to show leadership and dev.

Splunk Cloud Platform has reduced our errors and has helped us troubleshoot significantly with the alerts that we have set up with the logging that it offers. We have been able to trace issues faster and get more engineers to locate the errors, so visibility has been excellent.

I have not had too much interaction with Splunk Cloud Platform, with only three months of experience using it. I have not come across any flaws yet, but I am sure as always, things will come up.

I have been using Splunk Cloud Platform for three months.

Splunk Cloud Platform has been stable for the past three months.

I have not used Splunk Cloud Platform's AI capabilities.

I have not used Splunk Cloud Platform's zero-setup feature for AI models.

I do not have experience managing updates within Splunk Cloud Platform's app ecosystem.

The solution's visibility into multiple environments, such as cloud, on-premises, and hybrid, is very useful, but I am very siloed, so I do not really work with anything else. I would rate this product an 8.

I was a consumer using Splunk Cloud Platform at that time. I have been familiar with Splunk Cloud Platform. I was a user of Splunk Cloud Platform and a customer also.

Splunk Cloud Platform is a data analysis tool that works on big data and unstructured data. What I appreciated about it is that Splunk data processing is very good. When I performed search and threat hunting on Splunk, I was very satisfied.

Splunk Cloud Platform supports AI automation and can empower analysts to use AI assistance and agentic playbooks to accelerate threat detection, investigation, and mean time to detect or mean time to respond.

Since Splunk already offers me an embedded AI solution, why would I go to any other AI solution? Splunk is helping us in the new era of AI.

There is always room for improvement. Splunk can improve because it is a very expensive product. Because of the cost, we do not have as many skilled resources for Splunk, which makes it very difficult to find a compatible resource to help us troubleshoot.

I have worked with Splunk Cloud Platform for around 10 to 11 months.

Splunk Cloud Platform is a very vendor-diverse product. You can integrate almost anything around the infrastructure. It totally supports integration.

Splunk Cloud Platform is currently the best option in the market if you have the capacity to pay what Splunk requires. If you are tight on budget, you can consider other options. With respect to price, Splunk is the best solution, but it is expensive.

When comparing it with LogRhythm, LogRhythm is for small organizations, but Splunk has financial considerations. Splunk has more advantages than LogRhythm when comparing from a financial perspective.

Splunk Cloud Platform is currently owned by Cisco, and Cisco has very great support in my region.

I was only using Splunk Cloud Platform.

If you are planning to deploy Splunk Cloud Platform, there is a whole lot of architecture planning involved. You need to plan accordingly as per your infrastructure needs.

I was on the technical side, and the finances were managed by the governance team. I cannot answer questions regarding the subscription model and pricing structure.

Splunk Cloud Platform is a Gartner leading product. Splunk is superior in comparison with any other SIEM.

Splunk Cloud Platform is a Gartner leading product. Splunk is superior in comparison with any other SIEM.

Splunk Cloud Platform should be improved in certain aspects. In comparison with QRadar, QRadar has dedicated log sources, but Splunk does not have dedicated log sources. We can only sort the log sources from the IPs or hostnames. Splunk can do that, or if they do not do that, it will not affect anything, but it could be beneficial for a SOC analyst to specify the data source.

I cannot suggest additional features that could improve the rating further. I gave this review a rating of 9.