We use the solution for monitoring systems. We also use it with servers and CG routers from the data center, as well as for collecting the ADL from all networks which are located in our regions of the country.
Network Operations Center Engineer at a tech company with 51-200 employees
A stable and scalable solution which is easy to install and use and has good tech support
Pros and Cons
- "I am satisfied with the support."
- "The price of the solution could be cheaper."
What is our primary use case?
What is most valuable?
I like that the solution is easy to use and stable.
What needs improvement?
The price of the solution could be cheaper.
For how long have I used the solution?
I am currently working with Splunk and have a year's experience doing so.
Buyer's Guide
Splunk Enterprise Security
August 2024
![PeerSpot Buyer's Guide](https://www.peerspot.com/images/peerspot_logo_lt.png)
Learn what your peers think about Splunk Enterprise Security. Get advice and tips from experienced pros sharing their opinions. Updated: August 2024.
800,688 professionals have used our research since 2012.
What do I think about the stability of the solution?
The solution is stable.
What do I think about the scalability of the solution?
The solution is scalable.
How are customer service and support?
Support is at a level one department and I am responsible for managing both IT support and node engineers.
I am satisfied with the support.
How was the initial setup?
The solution is easy to install.
It took half a day.
What about the implementation team?
We were able to handle the installation on our own.
There are 40 people responsible for the deployment and maintenance of the solution, four of whom are engineers. There is a computer DE who is responsible for the engineering and a candidate for graduation in 2022.
What's my experience with pricing, setup cost, and licensing?
The solution could be more cost-effective, as we charge our customers the cheapest price.
The subscription is monthly.
What other advice do I have?
The solution is cloud-based.
There are more than a thousand users making use of the solution in our organization, who are connected with us in over 530 different areas.
I recommend the solution and plan to continue using it.
I rate Splunk as a seven out of ten.
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Senior Cloud Operations Analyst at a tech vendor with 1,001-5,000 employees
Makes us much faster finding and addressing issues
Pros and Cons
- "We are much faster finding and addressing issues with Splunk."
- "I would like to get visibility into the data pipelines on heavy forwarders and indexers to see exactly their source and the cause of saturation when it occurs. This would help us learn even more about our high use applications."
What is our primary use case?
Splunk is our monitoring and investigating Swiss Army knife for key applications and systems. If we run it, we Splunk it.
How has it helped my organization?
We are much faster finding and addressing issues with Splunk. We reduce the MTR and get more done.
What is most valuable?
So many of Splunk's features are invaluable to us:
- Machine and business data retention
- Solid HA and distribution
- Adaptability to custom data
- Search, Search, Search.
What needs improvement?
I would like to get visibility into the data pipelines on heavy forwarders and indexers to see exactly their source and the cause of saturation when it occurs. This would help us learn even more about our high use applications.
For how long have I used the solution?
One to three years.
What do I think about the stability of the solution?
No stability issues.
What do I think about the scalability of the solution?
No scalability issues.
How is customer service and technical support?
The support team is very competent.
How was the initial setup?
The initial setup is very straightforward.
What about the implementation team?
We implemented in-house
What was our ROI?
Our ROI is high.
Which other solutions did I evaluate?
We evaluated LogRhythm.
What other advice do I have?
I love this product.
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Buyer's Guide
Splunk Enterprise Security
August 2024
![PeerSpot Buyer's Guide](https://www.peerspot.com/images/peerspot_logo_lt.png)
Learn what your peers think about Splunk Enterprise Security. Get advice and tips from experienced pros sharing their opinions. Updated: August 2024.
800,688 professionals have used our research since 2012.
Foundation Technology Specialist at a insurance company with 1,001-5,000 employees
Provides the ability to diagnose problems in production and non-production.
Pros and Cons
- "The ability to rapidly diagnose problems in production and non-production, across hundreds of log files, is the most valuable feature."
- "It is a challenge to manage the environment in such a way, that one’s log, even with the bandwidth license, isn’t exceeded."
How has it helped my organization?
MTTR is drastically reduced, because the developers and other IT support staff have instant access to log events.
People costs are saved by not having to involve the domain developers from multiple teams, when tracing a problem that spans multiple platforms.
Security is improved by not having to give as many people access to log on to the servers.
What is most valuable?
The ability to rapidly diagnose problems in production and non-production, across hundreds of log files, is the most valuable feature.
What needs improvement?
Official training, even CBT, is expensive so not many people are able to get certified. This leads/causes the users to make use of the most basic functionality only.
It is a challenge to manage the environment in such a way, that one’s log, even with the bandwidth license, isn’t exceeded. Splunk has moved towards not applying hard caps in data ingestion, and this will help us in the future.
However, I’d like an easier way to flag certain source log files as non-critical and have Splunk automatically disable those event sources when the license capacity exceeds an arbitrary value.
What do I think about the stability of the solution?
There were no stability issues.
What do I think about the scalability of the solution?
There were no scalability issues.
How are customer service and technical support?
Customer Service:
I haven't had the need to log any critical issues. Most of my support tickets have been revolved around configuration questions. I'm very happy with the way Splunk's support staff respond - they're pretty helpful. I think I've only had one situation where the response was acceptable, but not stellar.
Technical Support:
The technical support is good. I'm sometimes surprised when the support engineer doesn't immediately know the answer to my questions (as I feel they must be fairly common queries). But, this can probably be excused because of the breath of features Splunk Enterprise has.
Which solution did I use previously and why did I switch?
We were not using any other solution previously.
I evaluated ELK Stack but at the time, Splunk offered more flexibility, better support and was easier for us to implement.
How was the initial setup?
Initial setup was fairly straightforward, but we used an experienced implementation partner and ensured that our team was intimately involved in the installation/configuration process on a technical level.
What about the implementation team?
We used a combintation of in-house (ie. myself) and an experienced Splunk partner.
What's my experience with pricing, setup cost, and licensing?
The product has a lot of value, and I feel that we’re getting the value that we’re paying for.
Splunk Enterprise becomes extremely expensive after the 20GB/month license, but if you take care of what you log, i.e., by not logging excessive application events, then that license will get you a long way.
Which other solutions did I evaluate?
We looked at ELK Stack.
What other advice do I have?
Use an experienced Splunk architect to design your infrastructure configuration.
Ensure that your tech leads are intimately involved and understand exactly how the product fits together.
Manage your Splunk configuration in a repository (Git).
Educate the end users as quickly as possible to use the tool effectively.
Change practices and encourage staff to use Splunk instead of old ways of getting the data they need. Prevent, or limit, direct access to the servers or server log files if you can.
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Technical Director at a consultancy with 11-50 employees
It allows us to store raw data and use it repeatedly for different domains.
How has it helped my organization?
We are using it for operational intelligence. We are using Splunk as a data lake for machine data. We gather all our machine data from the IT infrastructure and monitor its health.
What is most valuable?
Splunk's schema-on-read technology is one of the most valuable characteristics of this solution. It allows us to store raw data and use it repeatedly for different domains. You don't need to prepare the data upfront.
Splunk's Search Processing Language (SPL) is another beneficial feature. It is a very powerful tool that gives you the ability to do almost anything with your data.
What needs improvement?
Visualizations can improve. There are some performance and stability issues with the visualization layer.
What do I think about the stability of the solution?
There were stability issues, but only with the visualization layer.
What do I think about the scalability of the solution?
There were no scalability issues.
How are customer service and technical support?
The technical support is quite good.
Which solution did I use previously and why did I switch?
Previously, we worked with different vendors and solutions.
How was the initial setup?
The setup was very straightforward.
What's my experience with pricing, setup cost, and licensing?
The price is pretty high for our region.
Which other solutions did I evaluate?
We did a SIEM solutions review with this and other systems for one of our customers.
What other advice do I have?
This is the right choice if you are looking for a platform that can combine all machine-generated data and use it for various use cases from different domains.
Disclosure: I am a real user, and this review is based on my own experience and opinions.
![Alireza Ghahrood - PeerSpot reviewer](https://www.peerspot.com/static-assets/anonymous_avatar_x30.png)
Alireza GhahroodConsultant & Instructor -Cyber Security,GovernanceRIskCompliance (CISO as a Services) at Independent
Top 10Real User
Splunk's schema-on-read technology is one of the most valuable characteristics of this solution. It allows us to store raw data and use it repeatedly for different domains. You don't need to prepare the data upfront.
Fast and easy to use, but could be faster
Pros and Cons
- "The solution is very fast and succinct."
- "I feel the solution to be too slow."
What is most valuable?
The solution is very fast and succinct.
What needs improvement?
When it comes to out of the box use cases, I feel the solution to be too slow.
For how long have I used the solution?
I have not been working with Splunk for long.
How was the initial setup?
The initial setup was simple.
It took an hour.
Which other solutions did I evaluate?
Curator is more scalable than certain other solutions.
What other advice do I have?
We are partners of Splunk and provide the solution to customers.
I feel Splunk is easy to utilize.
My company has an app. on which the solution is deployed on-premises on a single server.
There is another team in my company that works with Splunk products.
I rate Splunk as a seven-point-five out of ten.
Which deployment model are you using for this solution?
On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
IT Infrastructure Architect at a tech company with 201-500 employees
Does event matching between several appliances and correlates data from different sources.
What is most valuable?
- Event matching between several appliances
- Correlating data from different sources
- Report viewer
How has it helped my organization?
It helps us to detect viruses and security events from our network.
What needs improvement?
It needs documentation, and "how-to-do" information. It's complicated to build reports and views.
For how long have I used the solution?
I have used Splunk for about two years.
What do I think about the stability of the solution?
There were no stability issues. It was running on a VM over Hyper-V.
What do I think about the scalability of the solution?
There were no scalability issues. It was running on a VM over Hyper-V.
How are customer service and technical support?
I used support a little bit for some templates for formatting data from Cisco and Fortinet logs. They were very fast with their response. I didn't have any support contract, but only entry level support.
Which solution did I use previously and why did I switch?
This was our first try for log analysis.
How was the initial setup?
The setup was easy.
What's my experience with pricing, setup cost, and licensing?
There is nothing to say. At that time, it was for GBs of data received.
Which other solutions did I evaluate?
We did not look at alternatives. It was a consulting provider recommendation. It was a rapid implementation to accomplish legal requirements. After we used it for a while, we decided to keep it.
What other advice do I have?
Check for the plugin to format data of already completed templates for the appliance to which you want to keep logs and events.
Disclosure: I am a real user, and this review is based on my own experience and opinions.
BS Systems Engineer at a tech services company with 501-1,000 employees
Makes use of all logs and takes proactive actions
Pros and Cons
- "Integrity with many vendors: This simplifies the implementation and integration with different devices"
- "Enterprise security: Splunk must work on clarifying the solution to customers and explain how to gain more from it."
What is our primary use case?
We used it to create a full security operations center (SOC) for our IT department by adding all network and security devices, the AD, and mail servers to it. Then Splunk started to receive their logs, it analyzed them, and provided useful reports.
How has it helped my organization?
It helps the IT staff to monitor the full structure. It also makes use of all logs and takes proactive actions.
What is most valuable?
Integrity with many vendors: This simplifies the implementation and integration with different devices.
What needs improvement?
Enterprise security: Splunk must work on clarifying the solution to customers and explain how to gain more from it.
For how long have I used the solution?
One to three years.
Disclosure: My company has a business relationship with this vendor other than being a customer: We are a partner with Splunk.
Solutions Consultant at a tech services company with 1,001-5,000 employees
Easy to use, provides a lot of analytics, and allows you to do pretty much whatever you want
Pros and Cons
- "It provides a lot of analytics with the underlying AI engine, and it is a lot easier than other solutions. There are some products that do automated AI-based detection and drawing up charts, but for network monitoring and all of the monitoring aspects, it is quite a nice tool. It is very convenient for business users because they get more or less a lot of data readily available. If you're familiar with the Splunk query language, you can pretty much do whatever you want."
- "If you have to do your own stuff, such as customized charts, it is a little bit more work, but once you're familiar with the Splunk query language, you can pretty much do whatever you want. In terms of features, it should probably have the features that other competitors provide."
What is most valuable?
It provides a lot of analytics with the underlying AI engine, and it is a lot easier than other solutions. There are some products that do automated AI-based detection and drawing up charts, but for network monitoring and all of the monitoring aspects, it is quite a nice tool.
It is very convenient for business users because they get more or less a lot of data readily available. If you're familiar with the Splunk query language, you can pretty much do whatever you want.
What needs improvement?
If you have to do your own stuff, such as customized charts, it is a little bit more work, but once you're familiar with the Splunk query language, you can pretty much do whatever you want. In terms of features, it should probably have the features that other competitors provide.
For how long have I used the solution?
I have been using this solution for about three to four months.
What do I think about the scalability of the solution?
I'm not sure. I do not really throw a lot of data in it, but it has been authenticated very nicely. It manages indexes and all of these things very nicely. I have not been privy to any production systems where you have millions of lines of log coming in every second. It works very well for the data that I have. It should be able to handle a lot of data. That's the whole purpose of it, and that's why Splunk has become so popular. It is an enterprise monitoring tool, and a lot of customers have Splunk in their ecosystem.
How are customer service and technical support?
They have pretty much good documentation and good training. Their documentation is a lot better than Qlik Sense.
Which solution did I use previously and why did I switch?
Splunk is an enterprise monitoring tool. Qlik Sense can do a little bit of log monitoring, but it is mostly used for dashboard reporting, whereas Splunk is more around monitoring and figuring out threats and all such things. They are different, but both deal with the data and allow you to create operation reports.
Power BI is another tool that a lot of our customers use, but Splunk is quite often requested. It is also a lot more popular than Qlik Sense. We have a fair number of Qlik Sense customers.
We usually sell Blue Prism to business users who are more concerned with the reporting aspect, which is why they would like to have easy tools like Qlik Sense in their ecosystem, but on the infrastructure side, it would be Splunk for enterprise monitoring.
How was the initial setup?
Simple environments are easier to install. Because there is a lot of data log monitoring, once you have a production system, there is some amount of work in setting it up, especially making it SSL Secure and exposing it on the internet. There are multiple components behind it, so you need to ensure that all these things are set up correctly. These kinds of things are not required on a cloud platform because you are just uploading data. You really don't have much access to the backend.
Splunk also has a cloud version, which I haven't looked at, but I have used Qlik Sense's cloud platforms. With on-premises, you are in control of pretty much how you set up all the data that you are sending out. A lot of our customers have the issue that if it is a cloud platform, they cannot really send out the data to any of these cloud platforms. So, there are data residence and other issues.
What's my experience with pricing, setup cost, and licensing?
It is economical than other solutions.
What other advice do I have?
I would definitely recommend Splunk. It is quite a decent tool, and it is there in a lot of enterprises.
I would rate Splunk an eight out of ten.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer: partner
![PeerSpot user](https://www.peerspot.com/assets/media/images/anonymous_avatar_x50-87dfede4.png)
Buyer's Guide
Download our free Splunk Enterprise Security Report and get advice and tips from experienced pros
sharing their opinions.
Updated: August 2024
Product Categories
Security Information and Event Management (SIEM) Log Management IT Operations AnalyticsPopular Comparisons
CrowdStrike Falcon
Microsoft Power BI
Microsoft Sentinel
SentinelOne Singularity Complete
Microsoft Defender XDR
Azure Monitor
IBM Security QRadar
Elastic Security
AppDynamics
Buyer's Guide
Download our free Splunk Enterprise Security Report and get advice and tips from experienced pros
sharing their opinions.
Quick Links
Learn More: Questions:
- What are some of the best features and use-cases of Splunk?
- What SOC product do you recommend?
- Splunk as an Enterprise Class monitoring solution -- thoughts?
- What is the biggest difference between Dynatrace and Splunk?
- IBM QRadar is rated above competitors (McAfee, Splunk, LogRhythm) in Gartner's 2020 Magic Quandrant. Agree/Disagree?
- What are the advantages of ELK over Splunk?
- How does Splunk compare with Azure Monitor?
- New risk scoring framework in the Splunk App for Enterprise Security -- thoughts?
- Splunk vs. Elastic Stack
- What is a better choice, Splunk or Azure Sentinel?
i am agree with splunk user who are saying splunk faster then other product.