Splunk Enterprise Platform Reviews

My team and I use Splunk Enterprise Platform for security monitoring, including collecting logs from firewalls, endpoints, servers, and cloud platforms, then compliance reporting, such as generating compliance reports for PCI DSS, SOC 2, and GDPR, log management including centralized logs from thousands of devices, infrastructure monitoring which includes monitoring CPU usage, memory utilization, disk space, and application monitoring including tracking application errors and response times, and various other purposes that arise day to day.

The most critical use case for Splunk Enterprise Platform is security monitoring and threat detection because we can detect cyberattacks in real-time, correlate logs from multiple sources including firewalls, EDR, IDS, IPS, and Active Directory, which enables SOC analysts to identify suspicious activity quickly. For example, about one week ago, an attacker tried to exploit a SharePoint vulnerability where Splunk Enterprise Platform detected multiple POST requests to suspicious SharePoint endpoints, then execution of powershell.exe by the SharePoint service, then the creation of unknown DLL files. We detected that potential SharePoint exploit affecting the server SP Web 01, with indicators including suspicious PowerShell execution, web shell creation, and multiple failed authentication attempts.

Every day, we use Splunk Enterprise Platform to check security dashboards by logging into the platform and reviewing SOC dashboards for critical alerts, failed login trends, and malware detections, then monitor real-time alerts by continuously watching for alerts such as multiple failed login attempts, privilege escalation, or data exfiltration. When an alert is triggered, we investigate it by searching logs and identifying the affected user or device, and we follow up by reviewing authentication logs and correlating events. Instead of looking at one log source, we correlate multiple sources including VPN logs, DNS logs, and CrowdStrike EDR. We also conduct threat hunting by proactively searching for suspicious behavior when there are no alerts, respond to incidents by creating or updating an incident ticket, inform the incident response team, isolate the affected endpoint, and continue monitoring and generating reports as part of our day-to-day workflow.

Splunk Enterprise Platform handles massive petabyte-scale environments well, but asserting strict data sovereignty such as complying with localized regulations that prohibit data from crossing borders requires deliberate architectural planning. The strengths I can mention include decoupled storage, and by leveraging smart store, we can separate our high-compute indexer nodes from our storage tier to allow us to scale to multi-petabyte levels without inflating our compute costs and ensures our cold data resides within our approved geographic borders. There is also distributed search, allowing us to query vast quantities of historical data stored in different geographic nodes or sites without needing to centralize all the raw data into one massive physical repository. The challenges we face include the complexity of cross-border queries; while we can keep data locally sovereign, querying datasets across international or inter-regional boundaries can strain bandwidth and increase search latency while relying on distributed federated searches.

The use of Splunk's Federated Search has evolved from a troubleshooting fix into a deliberate architectural strategy for reducing ingestion costs and managing compliance constraints. Initially, it served as a way to occasionally bridge distinct geographical Splunk Enterprise Platform clusters, but today it acts as an active data fabric layer that queries multi-cloud data lakes and external remote environments in place without moving raw data.

My experiences with maintaining granular control over data using a trusted control plane within Splunk Enterprise Platform reflect a major architectural shift, moving data governance from a retrospective cleanup activity to an in-flight policy enforcer. In-flight governance at the edge uses a centralized cloud control plane executed locally on-premises or within region-specific infrastructure which allows us to control data before it leaves our boundaries, employing granular filtering, masking, and smart in-flight routing. My experience with provider-level access control for Federated Search involves using granular control to manage data sovereignty; Splunk Enterprise Platform's introduction of provider-level role-based access control enhances our experience and data management capabilities.

In consideration of new use cases including agentic AI architectures, Splunk Enterprise Platform's governance and RBAC transition from a passive security checklist into active execution guardrails. The crucial role they play in managing access to operational data for these use cases involves limiting the blast radius. An agent utilizes the permissions of the service accounts assigned to it. Strict RBAC ensures an agent designed for network troubleshooting cannot access sensitive HR logs or financial transactions. Governance structures prevent LLMs from scanning unvetted data sources, stopping attackers from using prompt injection to trick an agent into exposing restricted system data. Access to operational data is managed through least privileged service accounts, whereby agents are assigned to highly specialized Splunk Enterprise Platform roles mapped to narrow indexes and limited data models. Real-time data masking using Splunk Enterprise Platform algorithms or ingest-time transformations strips PII and credentials before data hits the index, ensuring agents cannot interact with forbidden raw strings.

Among the best features that Splunk Enterprise Platform offers are real-time incident monitoring, real-time threat detection, the ability to investigate endpoints, a powerful Search Processing Language (SPL) which allows analysts to search and investigate huge amounts of data quickly, real-time alerts, dashboards, and data visualizations that greatly convert raw logs into graphs, charts, and reports. It also supports scalability, handling terabytes to petabytes of daily log data. It provides role-based access control which restricts data access based on user roles. It also features a machine learning toolkit that allows users to perform anomaly detection and predictive analytics. These features are critical for SOC analysts.

The most important feature for Splunk Enterprise Platform is SPL, which is the Search Processing Language, because it helps us search billions of events within seconds. It powers threat hunting and forensic investigations. It is used to create dashboards, alerts, and reports and almost every advanced feature relies on SPL. Strong SPL skills are among the most sought-after abilities for Splunk Enterprise Platform administrators and SOC analysts. For example, when a user reports that their account is compromised, with SPL we can quickly find all login events for that user, check failed login attempts, identify source IP addresses, see which systems were accessed, correlate activity with firewall, VPN, and endpoint logs, and build a timeline for the incident. A single SPL query can answer questions that would otherwise require checking multiple systems manually.

There are some useful features that Splunk Enterprise Platform users sometimes overlook, including data model acceleration which speeds up searches on large datasets, and this is very useful for SOC teams that need quick investigation results. There are also scheduled searches and automated reports which automatically run searches at set intervals and deliver reports to stakeholders without manual effort. Scalability is also important; whether we ingest a few GB or several TB of logs per day, Splunk Enterprise Platform's distributed architecture allows it to scale with enterprise needs. Role-based access control allows different teams to access only the data they need, which improves both security and compliance. These features highlight the capabilities that distinguish Splunk Enterprise Platform from basic log management tools and show its practical value in enterprise environments.

Splunk Enterprise Platform has had some of the biggest positive impacts on our organization, including improvements in incident response time. Before using Splunk Enterprise Platform, analysts needed to manually search logs across multiple systems, but with Splunk Enterprise Platform, we can centralize logs with real-time alerts and dashboards which improved our incident response times to be 50 to 80% faster in many SOC environments. In terms of threat detection, before using Splunk Enterprise Platform, threats were detected after a significant delay, but Splunk Enterprise Platform helps us continuously monitor and correlate rules detecting attacks within minutes which impacts earlier containment and reduces business impact. In terms of efficiency, we used multiple tools and manual log collection before Splunk Enterprise Platform, but with Splunk Enterprise Platform we have a single platform we can use for searching, monitoring, and investigations, allowing us to investigate more incidents with less effort. For compliance and auditing metrics, before using Splunk Enterprise Platform we needed to manually collect evidence and compile auditing reports, but with Splunk Enterprise Platform we can automate reports for compliance frameworks which save hours of manual work and improve audit readiness. These are the key improvements we have seen with using Splunk Enterprise Platform.

While Splunk Enterprise Platform is widely regarded as a powerful SIEM and observability platform, users across enterprises commonly report recurring challenges including licensing and data ingestion costs. Splunk Enterprise Platform's licensing is often based on the volume of data ingested, and as our organization grows, costs can increase significantly, and our teams may need to carefully decide which logs to ingest, which can limit visibility. A suggested improvement would be more flexible licensing options, better built-in recommendations for optimizing data ingestion, and smarter data compression or tiered pricing. There is also a steep learning curve where beginners can find SPL difficult. A suggested improvement would be more AI-assisted SPL generation, interactive tutorials, and guided dashboard creation with additional pre-built templates for common SOC use cases. These are the main areas for improvement that I can see: licensing flexibility, reducing the learning curve for new users, simplifying development, improving performance for very large datasets, and providing more AI-assisted features to reduce manual effort.

In terms of adding more improvements, there are frequently discussed areas including easier third-party integrations. While Splunk Enterprise Platform supports many integrations, onboarding new security tools sometimes requires custom configurations or add-ons. A suggested improvement would be more plug-and-play integrations, faster support for new vendors, and then simplified administration. Administrators often manage indexes, forwarders, user roles, and cluster health, so a suggested improvement would be easier administration dashboards and automated health checks. These are suggestions that acknowledge Splunk Enterprise Platform's strengths while highlighting areas where many enterprise users see opportunities for further improvement.

The primary areas for improvement that I see are licensing flexibility, simplifying administration, expanding plug-and-play integrations, and adding more AI-driven assistance for searches and investigations. These improvements would significantly simplify our tasks and help us solve more incidents in a lesser amount of time, making it flexible even for beginners.

I have been working for about 15 to 16 months in my current role, in the same project, in the same security domain only.

In my experience, Splunk Enterprise Platform has been a stable and reliable platform for day-to-day security monitoring and log analysis. It has consistently handled large volumes of data. The dashboards, searches, and alerting capabilities have performed reliably, though occasional issues such as slow searches or delays during peak data ingestion can occur. Overall, the platform has been dependable for security operations.

Splunk Enterprise Platform is highly scalable in my experience, efficiently handling increasing volumes of log data, users, and security events by scaling horizontally with additional indexers and search heads. As our environment grows, the platform continues to perform well with the right infrastructure configuration, but scaling requires proper planning for storage, compute resources, and licensing to maintain optimal performance.

I have not needed to contact Splunk Enterprise Platform support directly as the platform has been stable in our day-to-day operations. Most routine issues are handled internally by our team using Splunk Enterprise Platform's documentation and knowledge resources. Based on my current experience, I have not encountered major problems that required escalation to Splunk Enterprise Platform support.

Splunk Enterprise Platform delivers a measurable ROI by reducing manual effort, minimizing downtime, and improving security operations. When it comes to time saved, security analysts spend significantly less time searching logs and investigating incidents. In terms of employee productivity, the same SOC team can handle more alerts due to automation, dashboards, and correlation searches. Money saved includes faster incident detection and response, reducing the cost of security breaches, data outages, and compliance failures. For our enterprise, the key impact areas are generally time saved in investigations, higher analyst productivity, lowered costs of security incidents due to faster detection and response, and reduced manual reporting effort.

Regarding my experience with Splunk Enterprise Platform's pricing, it is a powerful but premium platform requiring deliberate optimization to manage high upfront costs, including high initial setup costs and then complex shifting licensing. While unit costs are high, the platform's ability to consolidate siloed tools into a single pane of glass provides immense value justifying the premium cost if the architecture is tightly managed.

I would recommend others to highly use Splunk Enterprise Platform because of its day-to-day usability, alert investigation capabilities, the time saved, and its highly accurate, scalable, and reliable support in day-to-day SOC operations. Splunk Enterprise Platform has greatly assisted in our day-to-day activities, and I would like to thank the Splunk Enterprise Platform team for providing us with a highly accurate and reliable platform that facilitates the maintenance of our day-to-day SOC operations. I would rate my overall experience with Splunk Enterprise Platform as a nine out of ten.

Splunk Enterprise Platform is used for creation of dashboards and monitoring of numerous use cases that could be specific to certain products. These segregated use cases are distributed across different teams, but primarily focus on security, log monitoring, and correlation. I use it to understand end-to-end information about a service and track the number of incidents. I have observed many use cases for Splunk Enterprise Platform, but for security, I have extensively used it for endpoint monitoring, incident response, incident tracking, ServiceNow tracking, and many other functions.

For a specific security scenario, I have used Splunk Enterprise Platform for email injection monitoring. I collect all logs related to whatever emails are going through and whatever activity users are doing over email, and I create correlation rules to identify gray listing or spam emails. In this case, I use Splunk Enterprise Platform extensively to monitor email activity from our email gateway or email tools. Endpoint telemetry is very crucial, and I ingest all logs and create dashboards. I use Splunk Enterprise Platform to identify which users or endpoints are deviating from standards or which endpoints have users not behaving according to our policy. This includes identifying users clicking links or downloading blocked items, as well as identifying endpoints that have older versions of specific software or endpoint solutions. I also use this for monitoring internal applications, which include specific applications for threat intelligence and user behavior monitoring.

I have enabled many correlations in Splunk Enterprise Platform that are worth mentioning. At times, there is a breakage from firewall, proxy logs, and endpoint logs. Over the last five to six years, I have been working toward achieving many correlations. For instance, if somebody is hitting from an external IP and I am getting many failed login attempts, I try to correlate that. I ingest a lot of Azure telemetry and cloud logs into Splunk Enterprise Platform, and I correlate any kind of notable threat intelligence feeds with the logs ingested to identify observables that can assist our threat intelligence team.

Many use cases, such as user behavior analysis, were not being monitored via a dashboard previously, which created a missing link in our incidents. Once I created analytics for user behavior and ingested telemetry from endpoints, proxies, and firewalls into Splunk Enterprise Platform, I gained many customizable outputs that strengthened our enterprise security posture. This significantly helped me reduce investigation time, which made our threat hunting and SOC teams more efficient. Additionally, day-to-day operational tasks, governance, and compliance activities operate smoothly since I started using Splunk Enterprise Platform for all these use cases.

I tracked compliance metrics and noticed that I was dealing with a lot of technical debt. After implementing Splunk Enterprise Platform and creating dashboards around the servers and technology I was using, I discovered that I had many obsolete or vulnerable products. The compliance dashboard helped me conduct a gap analysis and gradually bridge that gap, mitigating the findings. Over time, my compliance dashboard became greener, which is the desired state for a security-focused organization.

Another aspect is that endpoints play a crucial role in incident response or investigation, as many incidents stemmed from user actions. I established logs for user activities and created dashboards to visualize these incidents, leading to a significant reduction in user-centric incidents over six to eight months. I found that email and endpoint attacks were our main vectors, and after setting up dashboards around user email behavior, our security response improved drastically over time.

Splunk Enterprise Platform offers many features centered around creation of easy queries, requiring less learning curve compared to other counterparts. At times, what eases my work is the fast querying capability. It has excellent log collection and data ingestion that helps me create very granular, customizable dashboards, assisting my security team for monitoring and threat detection. Specifically for large enterprises, Splunk Enterprise Platform caters to the kind of scalability that I need because I am not centered around small deployments. I have many logs to ingest, and I need a lot of storage, indexing, and clustering, all of which this product supports.

It also has integration with other ecosystems like ServiceNow, Jira, and firewalls, with support for hybrid and multi-cloud environments. Real-time monitoring and alerting provide me visibility for security events or operational issues. Additionally, it has flexible deployment options, such as on-premises, private cloud, or even in isolated air-gapped environments. Splunk Enterprise Platform has matured enough because of the large community, extensive documentation, and strong ecosystem that assist me in deploying it effectively.

I find querying output quickly to be one of the most valuable features. When I write a customizable query, I need low-latency output as it assists me in my investigations. The second thing that appeals to me is the extensive integration capabilities. It integrates with a wide range of security, cloud, and endpoint application platforms. This large ecosystem simplifies data onboarding and ingestion. These are a few of the strongest aspects of Splunk Enterprise Platform, and because of its flexible search capabilities and extensive integration ecosystem, I find many use cases centered around using this product and deriving value from it.

Feature-wise, I often need many customizable queries from the data I already have, which is crucial in threat hunting scenarios. I can customize and structure the data for my investigations and operational troubleshooting. A lot of structuring and filtering is created by Splunk Enterprise Platform search processing language, which I refer to as SPL. I have also used KQL, and based on my work experience, I find it easier to work with Splunk Enterprise Platform than to struggle with other query language platforms, which add complexity to my investigations and operations.

The output accuracy and reliability of Splunk Enterprise Platform greatly depend on prompts, but I find it to be fairly accurate. Splunk Enterprise Platform provides capabilities to search and optimize queries effectively, aiding analysts to identify relevant data sources, execute searches, and summarize findings. This reduces investigation times and lowers the learning curve for new users. The AI capabilities offer natural language to SPL conversion, helping my SOC team perform AI-assisted threat hunting, optimize SPL, and conduct automated search analyses with some agent-based workflows that enable faster insights.

Splunk Federated Search allows me to search data residing in remote Splunk Enterprise Platform deployments or external repositories without needing to ingest all that data locally. The benefits include cost optimization, unified visibility, and the capability for cross-environment investigations. It also reduces data duplication since searching without complete ingestion avoids redundant copies. However, the limitations include the complexity of configuration due to trust relationships, permissions, and governance, which consume time. Troubleshooting can also be more challenging compared to a single Splunk Enterprise Platform deployment.

Maintaining granular control over data using the trusted control plane within Splunk Enterprise Platform ensures specific access and provides a centralized governance layer that secures communication, policy enforcement, and authentication. The benefits derived from the trusted control plane include consistent authentication and authorization controls, helping me meet compliance requirements and operational security standards, particularly in hybrid and multi-cloud deployments.

There is a lot of scope for improvement. One issue I often encounter is unpredictability of costs as telemetry volume grows. I find it hard to identify pricing and renewal costs, which is a key concern for me. I need features to assist me in making my usage of Splunk Enterprise Platform more efficient so I do not exceed cost thresholds. Additionally, when I have heavy workloads, I experience performance degradation; during high concurrency, CPU or compute becomes a bottleneck. I need solutions to optimize resource use effectively and guide me in scaling my workloads to prevent performance degradation. Integration struggles arise with several connectors that do not function as expected, needing more specialization and learning curves. I also want support for capacity planning to identify current and future needs, and I desire AI tools to assist in creating user-friendly dashboard experiences.

Documentation often feels generic and not tailored to my needs, which is an area needing improvement. AI assistance that can cater to my specific needs or scenarios would be beneficial. Regarding support, I sometimes struggle to identify the right person to assist me, particularly during integrations and with outputs. I have encountered situations where many concurrent sessions were unresponsive, leading to slower query mechanisms. While most interactions with Splunk Enterprise Platform support yield prompt and professional assistance, it varies depending on the engineer.

Regarding the AI capabilities of Splunk Enterprise Platform, I perform extensive investigations and understand that I am ingesting a lot of logs without clarity on the exact guardrails available. Governance is a concern as I must establish a proper governance layer before AI agents can use my information to assist me. While AI-powered search analysis has assisted me, transparency in guardrails is essential, especially in data masking to prevent the unintended exposure of sensitive information.

My association with this product spans seven to eight years.

Splunk Enterprise Platform is stable. It is a mature platform that offers streamlined log management, threat detection, security monitoring, investigation, and incident response capabilities. When conducting SPL-based analysis, I experience stable and fast search performance, even in AI-assisted investigations, which effectively correlate security events across endpoints and networks.

Splunk Enterprise Platform demonstrates robust scalability. When scaling, I utilized indexer clustering and deployed multiple components to enhance scalability. It scales horizontally effectively by adding dedicated components such as search heads, indexers, and forwarders. My data ingestion volume meets scalability needs, and Splunk Enterprise Platform provides workload management capabilities that facilitate resource allocation according to search and ingestion needs, maintaining performance while demand grows.

Customer support has struggled at times when accessing the right engineer, leading to instances where issues were not appropriately addressed. Despite this, most interactions yield competent support; the team's capability is evident. It is challenging when engineers lack familiarity with my environment and struggle to provide timely input.

In my previous company, I was using a solution that was costly and lacked flexibility and scalability.

Splunk Enterprise Platform's return on investment is largely reflected in my improved security posture. Many times, I considered hiring external managed service providers to handle logs and provide real-time investigations or correlations. Instead, with Splunk Enterprise Platform, I manage these processes in-house, saving costs and significantly enhancing my capabilities in incident response and threat hunting, expanding visibility into actionable data.

Without Splunk Enterprise Platform, hiring an external provider would have been more expensive, but I have built a more robust in-house team with various levels of engineers who can gather detailed insights for different operational needs.

While I use various external vendors to optimize cost in Splunk Enterprise Platform usage, the context of non-indexing demonstrates that SPL investigation adds value beyond merely storing and correlating data. I also engage external tools to minimize operational costs associated with Splunk Enterprise Platform.

Pricing, setup costs, and licensing remain areas of concern as I ingest large volumes of telemetry or data. I seek optimization around pricing scalability as I utilize significant public cloud storage. The amounts of ingested data lead to cost concerns, and I strive to determine strategies for reducing pricing while identifying logs that do not need ingestion. This remains a challenge as I explore efficient usage of Splunk Enterprise Platform.

Before choosing Splunk Enterprise Platform, many options were evaluated, as primarily open-source tools providing similar capabilities were assessed.

I rate Splunk Enterprise Platform a seven out of ten because I am happy with the value that it has delivered. However, there is always room for improvement. Cost is a major factor, and performance degradation hinders me from considering it as a more scalable option. Despite these concerns, Splunk Enterprise Platform delivers what my security team needs and provides value in compliance, incident response, and threat hunting.

Splunk Enterprise Platform is deployed in a hybrid model; I host some workloads in the cloud and have a few instances on-premises. I utilize AWS and Azure as my cloud providers for hybrid deployment.

My impression of Splunk Enterprise Platform's capability to manage data sovereignty at a petabyte scale centers around privacy considerations. I have a limited security context, understanding the metadata and user usage information available for AI features and the associated guardrails. Regarding data sovereignty in cloud workloads, it can be customizable to certain regions, but all indexing must comply with data privacy standards, which my oversight teams monitor closely.

My advice for others considering Splunk Enterprise Platform is to utilize professional services upfront. Planning your workload, setup, and capacity for two to three years is crucial for effective scaling and indexing. It is also vital to educate end-users on utilizing Splunk Enterprise Platform efficiently to avoid inefficiencies that can slow down capabilities.

My main use case for Splunk Enterprise Platform is for doing data analysis. I can give you an example of how I use Splunk Enterprise Platform for data analysis. We are monitoring the infrastructure of the client, such as what systems they are using. It could be network devices, or it could be Windows or Linux servers. We get the infra-related data in Splunk Enterprise Platform environment, such as CPU, memory, and host status, and based on that, we do the configuration at our end. If any issues are there, we are generating the ticket. For example, if a disk is occupying more than 90% of its space, then based on that, we are triggering an alert. If any host is not responsive, we generate an alert such as 'host reporting no data'.

We are having multiple ways to use Splunk Enterprise Platform day-to-day. We have multiple environments, such as a high availability environment and a low availability environment. Based on the client's budget, we set up Splunk Enterprise Platform infrastructure. For example, with a high availability environment, the cost will be more, but the availability of the monitoring tool will be high. That is called the clustered environment. If a client has a low budget and they have a smaller number of servers to monitor, then we will go for a distributed environment.

The best feature of Splunk Enterprise Platform is data insights. The data is very quickly searchable. The data is stored in an index. If you have a very large amount of data and you put it in Excel, it will take a lot of time to work on it and get the insights, such as the exact error logs. But in Splunk Enterprise Platform, data is stored in a TSIDX file. We have an index to get the data, so you can quickly get a look at your environment's data. The visibility is very high.

Suppose a thousand servers are under monitoring. All the data from those thousand servers is ingested into Splunk Enterprise Platform. If any of the servers go down, it will quickly create an alert, irrespective of how many. Even if a thousand servers go down, it will create the alert quickly. The investigation is very easy. We have a set of indexes where data will be stored. We will have log files, we will have the log data, so the analysis is very easy.

We also have vendor support. If my environment is not working or is showing an error, the vendors provide support on time. The security level is also very good. Whenever any vulnerability is detected, the vendor will inform us, and they will come up with the latest version so that we can do the upgrades. The documentation part is everything very transparent.

Whatever problem the client comes up with, for example, 'My environment has this many servers, and we cannot do it because it is at different locations,' it cannot be manually monitored. There should be a one-stop destination so that we can monitor all the environments. In that way, Splunk Enterprise Platform is playing a very important role in our organization to serve clients better.

The response time is reduced because within 5 to 15 minutes, if any issue occurs with the server, it will generate an alert. If the system comes back up, there is an automation process, so the ticket will auto-resolve as well. However, the footprint will always be there. It will show exactly when the issue happened. It is saving time also because whatever data we are getting, it is taking less time to parse, index, and process the data and give us the ticket.

Regarding improvement for Splunk Enterprise Platform, compatibility is needed. They are coming out with a newer version every two months, and there is the vulnerability part. When they are releasing any version, they need to check it from a security point of view completely. The remediation they are providing is in the newer version. In the existing version itself, they can review it and provide the fixes so that every two or three months, we do not need to go for upgrades, because upgrades take some time.

The Splunk experts are there who are involved and have the knowledge to do the integration. Everything is fine. The only thing is the vulnerability part, which is the only flaw I observed.

I have been using Splunk Enterprise Platform for the last five years.

Splunk Enterprise Platform is stable.

The scalability of Splunk Enterprise Platform is very good. If we are talking about the cluster setup, you can add more indexers, more search heads, and more heavy forwarders. You can add more components based on your requirements. Scalability is very easy in Splunk Enterprise Platform.

Customer support is also top-notch. We are getting the support. They have on-call support and email support.

Multiple options are available, such as Dynatrace and DataDog, but Splunk Enterprise Platform is the leading one nowadays because it provides security features as well. Splunk Enterprise Platform was acquired by Cisco, and Cisco is a big player in security. Splunk Enterprise Platform is a good one, and it is also cost-saving. It is not charging more. It is charging based on indexing the data only, so we are good with Splunk Enterprise Platform.

Governance and security within Splunk Enterprise Platform is good. Whenever they find any vulnerability, they immediately inform their customers, telling them to stop using something and providing the fixes. They come up with it immediately. Splunk Enterprise Platform itself was bought by Cisco, so from a security point of view, they are getting better now.

Directly, as of now, we are not integrated with agentic AI, but we are using agentic AI for the troubleshooting part. It will take some time to integrate it, but these things will be there. However, everywhere, human intervention will always be there. It cannot allow the AI to go and change the configuration without the permission of a human being.

Splunk Enterprise Platform has high capability. It is capable of handling that much data. It will use more resources, but it can handle it.

We have used the federated search feature of Splunk Enterprise Platform because the client had location-related security requirements. We have the option and the feature where we can hold the data there, and it can be searched from one location. The data will be stored in a different location, but it can be searchable from one destination. It is very helpful. The environment is providing a very reliable solution to us.

Splunk Enterprise Platform has a very good feature. You can mask the data while indexing it. If you are talking about the access part, we have multiple access levels available. If you want to limit the access to particular data for a particular team, we have that option. We can create a customized role, and it also has in-built roles. Based on that, a dedicated user can only access the dedicated data.

Nothing is missing because Splunk Enterprise Platform has very strong capabilities with multiple roles, and we have customized roles as well. For the login process, we can use SAML and LDAP. It is a very good platform that provides you with a way to maintain data security. The governance tools provided by Splunk Enterprise Platform are very good.

The cost saving is a shared resource for multiple projects. We can work for 10 to 12 or 15 projects with Splunk Enterprise Platform skill set. I am working as an admin and developer, so that part comes under the architect team. We have a dedicated team that decides the pricing, cost, and licensing based on the client's requirements, such as how many servers are under monitoring. For a thousand servers, it should go with a clustering environment and high availability. It totally depends on the demand of the client.

Because we have 10 to 12 projects and 10 to 12 associates, there is no dependency. If someone goes on leave, everyone else has access to all the projects, so there is no dependency. Everyone can work on any of the projects, so it is good. You do not need to put two dedicated people there, and if those two people are not there, then who will work? There is no such issue. With shared responsibility and shared resources, it is working very nicely with less cost.

I would rate this review an 8 overall.

My usual use cases for Splunk Enterprise Platform involve all NOC and SOC activities, where SOC-related alerts will be aggregated with NOC-related alerts, allowing for correlation between them, including use cases such as abnormal travel and anomaly detection, all of which are detected by Splunk Enterprise Platform.

For instance, if there is a DDoS attack indicated by an anomaly in the traffic when WAF is integrated, an alert is generated in Splunk Enterprise Platform, which our L1 and L2 teams will then visualize and remediate based on the alert.

I do not use Splunk Enterprise Platform's Machine Learning Toolkit directly, but my team utilizes it.

Splunk Enterprise Platform's Machine Learning Toolkit has helped us with predictive analytics in our organization significantly, as it automates the anomaly detection that previously required our L1 and L2 teams to spend three to four hours on.

It immediately triggers alerts upon detecting patterns such as WAF spikes or suspicious login behavior, allowing our L1 to avoid manual analysis and triaging. The predictive analysis reduces false positives, enabling our analysts to close tickets swiftly—previously taking two to three days, and now they close them before breaching the SLA due to effective pattern discovery and outlier detection.

Splunk Enterprise Platform's Machine Learning Toolkit is efficient in detecting abnormal login attempts and brute force attacks, effectively aiding our proactive defense planning through advanced analytics and anomaly detection.

Splunk Enterprise Platform's most valuable features include its integration with AI, as Cisco, which has taken Splunk Enterprise Platform recently, is building up AI functionalities, enhancing remediation capabilities and the orchestration part in the market. Additionally, Splunk Enterprise Platform shows the correct logs at the correct time, and inventory management is very good.

I assess the effectiveness of Splunk Enterprise Platform in detecting anomalies and preventing system outages as very strong; for over two to three decades, it has provided centralized log visibility, real-time monitoring, and analytics correlation, which is robust for threat detection and incident investigation.

Splunk Enterprise Platform's machine learning capability of the toolkit predicts trends and reduces many false positives, making Splunk Enterprise Platform an essential tool for both SOC and network operations, where it effectively detects anomalies that other SIEM tools cannot.

Splunk Enterprise Platform's personalized dashboards are superb, as I have been experimenting with them extensively, and new features have enhanced their quality, making them particularly effective for presentations to leadership, including direct engagement with the CISO.

In terms of improvement for Splunk Enterprise Platform, as more companies embrace AI, adding more AI automations is crucial and could parallel what competitors such as Xplain are doing. Managing duplicate alerts efficiently can optimize costs, as the current license-based data ingestion can quickly escalate if duplicate data is fed.

Better filtering of unnecessary log sources could greatly interest clients by demonstrating cost efficiency. From an architectural standpoint, data onboarding, normalization, performance, and scalability improvements would be beneficial, particularly in optimizing search speed and query execution to handle larger searches efficiently.

I have been working with Splunk Enterprise Platform for the last 10 years as a Splunk certified power user and advanced user, and along with Splunk Enterprise Platform, I am using Palo Alto's Cortex XSOAR and Azure Sentinel continuously for over 10 and 12 or more years.

I evaluate the stability and reliability of Splunk Enterprise Platform as very high; we utilize it for both SOC and NOC operations, and our L1 and L2 teams get real-time alerts and query the SPL effectively without delays that other SIEM solutions may impose.

Splunk Enterprise Platform is scalable; we have already adapted it from SOC to NOC operations while maintaining good indexing practices that prevent overload and ensure clear searches, maximizing performance in large SPL queries.

My L1 team regularly communicates with Splunk Enterprise Platform's technical support, which is very helpful.

I would rate the technical support from Splunk Enterprise Platform around eight on a scale from one to ten, where one would be the worst and ten would be the best.

Before using Splunk Enterprise Platform, I utilized Azure Sentinel in my previous company at Deloitte, prior to leaving.

Although I did not participate in the initial setup, I provided mentoring for the team under me who managed the implementation because I have spent 14 years in the industry, which included hands-on implementations earlier in my career.

Splunk Enterprise Platform's implementation is very straightforward; I do not feel there is a significant difference from the implementation point of view, as everything is clearly documented by Splunk Enterprise Platform.

We are a customer of Splunk Enterprise Platform, currently at Aramex, and we bought a vendor from Capgemini who has actually implemented Splunk Enterprise Platform for us, so we are not directly linked with Splunk Enterprise Platform but rely on our vendor to use Splunk Enterprise Platform for us.

Splunk Enterprise Platform's dashboards significantly improve data interpretation, providing immediate real-time visibility on top trending alerts and live data without needing to run queries repeatedly. They aggregate metrics and highlight trends such as threat overviews and MITRE ATT&CK mapping, which reduces the workload for our L1 and L2 teams.

Pre-built alerts for anomalies in login attempts, failed attempts, or geolocation mapping are very visible in Splunk Enterprise Platform's dashboard, which plays a critical role in providing real-time visibility into security events and network activities.

Splunk Enterprise Platform's application management feature enhances end-user experiences by providing organized dashboards that monitor application usage and configurations, facilitating faster detection and query execution. It logs metrics into applications that reveal usage patterns, anomaly detections, and attack occurrences, while also ensuring proper governance and versioning of applications.

I consider Splunk Enterprise Platform an expensive tool because budget constraints from license-based data ingestion costs are significant. Costs can escalate rapidly when duplicate data is processed, which Splunk Enterprise Platform can identify to help clients save directly on unnecessary spending.

I leverage Splunk Enterprise Platform for advanced threat detection, which is critical for our SOC operations. Threat intelligence and detection are vital, especially since Cisco's acquisition of Splunk Enterprise Platform has integrated Talos into it, enhancing our ability to monitor for IP reputation and potential attacks, while also keeping an eye on advisories regarding application vulnerabilities. I would rate this product overall at a nine out of ten.

My main use case for Splunk Enterprise Platform is security monitoring. Over the past 13 years, I have performed a variety of different roles relating to Splunk, covering ITSI, IT Ops, and Enterprise Security, but predominantly at the moment, my focus is on security monitoring use cases.

I typically use Splunk Enterprise Platform for security monitoring to identify insider threats and unusual behaviors with internal actors as well as external customers who use our services. There is a variety of different use cases within that scope, but the main security focus is on identifying insider threats, using a variety of data sources such as AWS logs and Azure logs, correlating different things between logins, activity, and proximity.

Splunk Enterprise Platform has positively impacted my organization by giving us access to the security monitoring tooling that we need to operate. We are also able to use a lot of that same data for other purposes. For example, data coming in from the website can also be used for IT Ops monitoring of the website, which we can leverage for security and IT Ops. For other source types such as authentication from Entra ID or Okta, we are able to diagnose issues and assess the frequency of usage within the team, alongside security use cases. It gives us many options for using that same data.

In my opinion, the best features Splunk Enterprise Platform offers are its flexibility and ability to accomplish a variety of different things depending on the requirement. There are thousands of apps on Splunkbase which are very good for extending the capabilities. I do quite a lot of app development myself, contributing back to the community from that perspective.

From an app development perspective, there has been a significant push in the last couple of years on new ways of working and building apps with Splunk's provided tooling. The UCC app builder is quite good for starting with a barebones app and building it out. Additionally, there is good new technology around Splunk UI toolkit which allows developers to build richer visual apps. I believe that this empowers developers and enables them to build premium looking and capable products within Splunk Enterprise Platform, facilitating companies' closer integration with Splunk Enterprise Platform.

The extensibility of it is excellent, and it is easy to integrate with, access data, and dashboards from anywhere, including mobile. It is versatile from that front, and the type of apps that can be built on it range massively between dashboards and custom REST interfaces that can be integrated to other systems.

Certain parts of Splunk Enterprise Platform, such as the KV store, are quite monolithic and tightly coupled into Splunk Enterprise Platform. It would be beneficial to deploy Splunk Enterprise Platform while using different KV stores and technologies; for example, if we are running in the cloud, it would be beneficial to leverage cloud vendor turnkey services and abstract them away from Splunk Enterprise Platform. This would let us tie it into existing systems and benefit from the scaling involved.

I have been using Splunk Enterprise Platform for 13 years.

Splunk Enterprise Platform is stable.

It scales very well, and I have never had any issues with the scaling.

Customer support is good. I have always worked well with the account team to ensure that anything needing escalation gets addressed. However, in the last couple of years, the support staff do not necessarily understand the problems I report and sometimes simply regard them as bugs. They expect me to provide diagnostics rather than testing them upfront, which is frustrating, but otherwise, support is very good.

We have typically used tools such as Grafana for metrics, AWS CloudTrail, and AWS CloudWatch logs for viewing logs, but now we have everything centralized in Splunk Enterprise Platform.

I work with partners, but I am not myself a partner. I deliver consultancy work via other partners, but we are not partners ourselves.

I do not have specific metrics about return on investment, such as fewer employees needed, money saved, or time saved.

I do not get too involved in the licensing, so I do not really have much of an opinion on that. However, regarding setup cost, the reference hardware is provided and seems to be overkill for some of the host types. I believe it would be beneficial to understand where savings could be made by running slightly smaller compute for things such as license servers since I do not think the reference hardware is always necessary and could reduce setup and operational costs.

I would advise others to use the free training available initially so they can start using Splunk Enterprise Platform on the right foot. This allows running better, cleaner searches with fewer resources and easier platform navigation. Building a team of skilled individuals to handle data onboarding, search writing, and platform management is essential, along with implementing governance around data ingestion to avoid overloading the system.

With the use of SmartStore, we have been able to reduce our storage usage, which I believe has also saved us money. I do not have specific numbers on how much that has saved, but by moving to SmartStore, we run fewer fast disks that are ultimately more expensive, pushing data to SmartStore and leveraging its capabilities.

I have not worked at anything to the petabyte scale. I have worked at the terabyte level but not at the petabyte level, so I am not fully aware of what kind of problems we might encounter. The scaling work I have done in the past has been quite seamless, scaling very well linearly. I have confidence in the capabilities of other petabyte-level customers, so I believe it could be achieved.

We have not actually explored federated search to S3 yet, but we have done federated search between Splunk Enterprise Platform instances in the past, and that worked very well. I hope federated search for S3 will let us ingest less data and store more directly in S3 from the source, saving us on workload and resources required for ingestion and storage on disk, as we can leverage cheaper S3 storage.

In my organizational context, the AI workload inputs and functionality is managed in the same role-based access control methods as the existing knowledge objects, API endpoints, and capabilities. I would hope that what the AI agents can access is managed in the same way, ensuring specific roles only access necessary data. Splunk Enterprise Platform's role-based access control model works well for knowledge objects and indexes, and I hope that extends equally to AI.

We are able to use single sign-on for login in our private network, which helps. Everything done within the platform is in the audit index, which we regularly monitor and manage to understand what our users are doing. I would rate this product a 9 out of 10.

Splunk Enterprise Platform is primarily used to onboard data from a myriad of sources, including logs from various network devices such as computer workstations, switches, routers, and any network-connected device. This data is onboarded for a SIEM tool to use and for analysts to set up detections.

One specific example involved onboarding data from Windows workstations on the network to track authentication activities and flag unusual activity dealing with administrator credentials.

Our specific infrastructure uses Splunk on AWS, where we have Splunk instances, indexers, forwarders, and search heads operating as a whole cluster. This cluster is tied into S3 for data storage.

Splunk Enterprise Platform's best features include data analysis, especially for logs that could be overwhelming to review individually. It makes our data easily searchable and easily analyzed, allowing us to focus on things that are of concern and the things that are important to us. This enables us to narrow down and react as quickly as possible.

Splunk Enterprise Platform has improved our reaction time and investigation time for troubleshooting events and finding security issues within our network, which is a huge time-saver and also a huge reduction in the amount of resources that we would typically need within my organization to address such issues and solve computer issues within our network.

Another feature that stands out is ingest actions, which is available on Splunk forwarders. This is an easier way to reroute data to other places, normalize the data on the heavy forwarder before routing it, and limit the sort of data that you want to send out or fork out to other destinations.

Resource consumption could be streamlined further. Although the integration with S3 makes it a little cheaper and more reasonable to store large volumes of data, it still does not address the issue of keeping data in warm and hot buckets. Keeping a significant amount of data in warm and hot buckets does not work well with S3, as data stored there is typically in cold buckets. Whenever that data needs to be retrieved, it must be thawed before it can be used. It would be improved if we were able to retain higher volumes of data in hot and warm buckets to be readily available to analysts, which would help tremendously. Storage cost is one of the huge issues for us.

With the emergence of AI and its prevalence now, Splunk is moving in the right direction with integrating AI. However, currently, that is mostly tied into the cloud environment. If there could be more on-premises offerings and AI solutions geared to customers that are in isolated environments where they want their data and all their systems to be on-premises and not tied into the cloud, that is somewhere Splunk can make some improvements to serve those customers.

I have been using Splunk Enterprise Platform for the whole ten years, but exclusively for the past five years.

Splunk Enterprise Platform is stable.

Splunk Enterprise Platform scales very well with the use of heavy forwarders and indexers. By its nature of giving the ability to have sites and clusters, it is highly scalable.

Splunk's customer support is very responsive and very good.

In my current environment, there was not any solution specifically to do exactly what Splunk is used for now. However, in previous environments that I have worked in, ArcSight had been replaced with Splunk.

One of the platforms that was evaluated in those environments was Elastic.

I do not have a full experience with the initial setup, but I do know that for pricing and setup cost, we use Splunk partners that we interact with for that.

I do not have a full experience with the implementation team, but I do know that for pricing and setup cost, we use Splunk partners that we interact with for that.

As I mentioned before, a troubleshooting or incident that used to involve a headcount of ten now takes a headcount of four. As far as specific dollar figures, I do not have that information.

I do not have a full experience with that, but I do know that for pricing and setup cost, we use Splunk partners that we interact with for that.

Regarding staffing, the headcount for the number of staff that we would need typically to respond to an incident or event has been significantly reduced. An incident or event that used to take ten people to triage, respond to, and remediate accordingly has been reduced to where that job is now handled by four people.

There has only been one use case for federated search within my environment, which provides search capability to another organization into my environment. It is good because it allows us to limit what data is available to that customer and limit it to a specific index. We can limit the kind of access and the kind of role that is assigned to the federated search users as they access our environment. It is very good because it helps us avoid crashing our entire environment if a rogue search or a search that is not well-structured is executed by that customer. It has worked for us to limit the search quota for that customer so they do not crash our entire environment and our broader environment is not impacted.

Splunk's use of RBAC, role-based access control, has worked very well for us as we can limit certain roles to specific search quotas. We can limit index access to certain roles and app access to certain roles. This has actually worked very well and is well-implemented within Splunk.

Splunk's approach is very good and is on a great track on a private network because for customers like us with on-premises instances, it lets us keep all our data within our network and do whatever we do within our environment without worrying about that data getting out to the public or outside of our environment.

Since the implementation of Splunk, we have significantly reduced our TCO in maintaining data and collecting logs. In partnership with AWS and in some implementations with S3, that has really brought down TCO because we do not need to maintain so many hardware and data centers to be able to meet the same need.

For others looking to use Splunk Enterprise Platform, my advice would be to get familiarized with the product. Even if you are just a customer and not supporting, implementing, or maintaining the environment yourself, it is really good to get educated on the software and its use cases. I would advise organizations to send their employees to get at least some Splunk training and use whatever credits they have to make sure their workforce stays updated on the new changes within Splunk. I would rate this product a nine out of ten.

As an analyst, I use Splunk Enterprise Platform for monitoring, investigating, and analyzing and responding to alerts in a 24/7 environment.

In my daily work, we receive alerts in Splunk Enterprise Mission Control where we monitor our alerts. For example, if I receive any malware-related alerts, I will use Splunk and check the logs from different log sources such as host, proxy, and DNS. I check these logs from Splunk, analyze them, and based on that analysis, I write my analysis in Splunk.

For specific use cases, such as the malware example I mentioned, if any malware-related alert is triggered in an environment, I check the logs of the host, identify who the user is, determine what happened, understand what actually occurred in that alert, and identify which file or process that alert was triggered for with the help of Splunk.

Splunk Enterprise Platform features such as risk-based alerting, which is the most important one, and advanced search, search processing language (SPL), along with the new add-on of Splunk AI that is integrated in Splunk Enterprise Platform, leverage analysis and writing Splunk queries. Additionally, the real-time alerting and scalability that Splunk Enterprise Platform provides if you want to scale it to a larger space are impressive.

Regarding risk-based alerting, it adds risk to any identity such as a host, IP address, or user, quantifying how many alerts trigger on that user, and adding a risk score to the particular entity, which I believe is a good feature. For SPL, we use it daily for analyzing logs, and Splunk Enterprise Platform's three modes—verbose, smart, and fast mode—speed up our process or provide detailed insights based on our requirements.

Splunk Enterprise Platform has drastically improved our monitoring capability in a 24/7 environment. I used other tools such as ArcSight, which is not as effective compared to Splunk Enterprise Platform, where everything is in one place, whereas ArcSight requires different tools for logging and monitoring alerts, showcasing Splunk Enterprise Platform's superior scalability.

One improvement for Splunk Enterprise Platform would be to slightly lower the licensing cost, which I believe is quite high. If possible, making SPL queries a bit easier would be beneficial, though the introduction of Splunk AI helps in writing queries automatically. Performance and scaling are also areas to consider.

I have been working in this current field for 2.6 years.

Splunk Enterprise Platform is stable.

Splunk Enterprise Platform offers excellent scalability, perfectly handling data growth and allowing us to scale from gigabytes to petabytes as our business expands.

Customer support is very good. I had one query that was resolved within 24 hours.

I have used ArcSight previously, but I did not switch. Rather, I transitioned to a different project where I began using Splunk Enterprise Platform, and I prefer Splunk Enterprise Platform for its comprehensive features that offer everything in one place.

We have seen a return on investment with Splunk Enterprise Platform, which is expensive but pays for itself through preventing costly downtime and security breaches.

We saved one ransomware alert in our organization.

My experience with Splunk Enterprise Platform's pricing is that it has a high overall cost. Licensing fees require a large budget commitment, and traditional volume-based pricing can become unpredictable and expensive as data grows, alongside the costly setup for building infrastructure requiring specialized staff.

I advise others looking into using Splunk Enterprise Platform to consider its great user interface, comprehensive features, superior scalability compared to other products, and the growing integration of AI into the platform, making it a compelling option over other products. I would rate this product a 10 out of 10.

Splunk Enterprise Platform serves as our primary solution for centralized log management and security monitoring. We collect logs from multiple systems and security devices into a single platform to investigate incidents, troubleshoot issues, monitor suspicious activity, and create dashboards and alerts for better operational visibility. The platform also helps us correlate events from different log sources, making investigation faster and more efficient.

For example, an organization received an alert about suspicious PowerShell activity on a Windows endpoint. Using Splunk Enterprise Platform, the analyst searches for the affected hostname and username, then correlates Windows Event Log, Active Directory authentication log, firewall log, and endpoint security log. The timeline shows that the user logged in from an unusual IP address or executed a PowerShell command and then attempted a connection to multiple internal servers. Because all relevant logs are available in one place and can be correlated by timestamp, username, and host, the analyst can quickly understand the sequence of events and determine the scope of the incident without manually checking multiple systems.

Splunk Enterprise Platform's Search Processing Language, real-time search and alerting, and customizable dashboards are the most valuable features I have found. The Search Processing Language makes it easy to search and analyze large volumes of log data to quickly identify issues or security events. The real-time alerting capability has helped us detect critical events as they occur, allowing for faster response. I appreciate the flexibility of dashboards, which can be customized to display key metrics and operational insights for different teams. Additionally, Splunk Enterprise Platform's ability to ingest data from a wide range of sources and correlate events across multiple systems provides a comprehensive view of the environment, making troubleshooting and incident investigation much more efficient.

The Search Processing Language is the feature I rely on the most in Splunk Enterprise Platform. It allows me to quickly search and analyze large volumes of log data, filter relevant events, and identify the root cause of issues much faster than manually reviewing logs. Whether I am investigating a security alert or troubleshooting an operational problem, the Search Processing Language helps me pinpoint relevant information efficiently, making it the most valuable feature in my day-to-day work.

Overall, the feature set of Splunk Enterprise Platform is comprehensive and flexible. The combination of centralized log management, powerful search capability, customizable dashboards, and real-time alerting enables teams to monitor their environment, investigate incidents, and troubleshoot issues from a single platform. The extensive integration support also makes it easy to bring together data from different systems, providing better visibility across IT and security infrastructure.

Organizations commonly report that Splunk Enterprise Platform improves visibility across their IT and security environments by centralizing logs from multiple systems. This can help security and operations teams investigate incidents more quickly, reduce the time spent troubleshooting issues, and identify potential problems through real-time monitoring and alerting. Many organizations also use dashboards and reporting to gain operational insights, support compliance activities, and make more informed decisions based on machine data.

One area where Splunk Enterprise Platform could be improved is its licensing model, as costs can increase significantly with higher data ingestion volumes. The initial deployment and data onboarding process can also be complex, especially for large environments. Additionally, there is a learning curve for new users when working with the Search Processing Language and building advanced dashboards. Simplifying administration, improving the onboarding experience, and providing more built-in templates and guided analytics would make the platform easier to adopt and manage.

Another area of improvement would be performance optimization in very large environments where complex searches can take longer to execute if they are not properly optimized. It would also be beneficial to have more artificial intelligence-driven analytics, automated recommendations for search optimization, and pre-built dashboards and use cases.

I have been working in this field for approximately four and a half years.

Splunk Enterprise Platform is highly stable.

Splunk Enterprise Platform is highly scalable and is designed to support organizations ranging from small deployments to large enterprise environments. It can ingest and analyze increasing volumes of data by adding indexers, search heads, and other components as requirements grow. The distributed architecture allows organizations to expand capacity while maintaining performance and reliability. Proper infrastructure planning, data management, and search optimization are important to ensure the platform continues to perform efficiently as the environment scales.

Splunk Enterprise Platform was our primary log management and analytics platform, so we did not migrate from another SIEM or log management solution. We selected it because of its powerful search capability, scalability, broad integration support, and ability to centralize logs from multiple systems for monitoring.

We did not conduct a formal evaluation of multiple solutions before adopting Splunk Enterprise Platform. The decision was primarily based on its strong reputation for log management and analytics, extensive integration capabilities, powerful search functionality, and its ability to scale to meet enterprise security and operational requirements.

Before implementing Splunk Enterprise Platform, I clearly define my use cases, identify the log sources I want to onboard, and estimate my expected data volume to plan licensing and infrastructure appropriately. I invest time in learning the Search Processing Language and designing an efficient ingestion strategy, as these have a significant impact on performance and usability. It is also a good idea to start a phased deployment, build dashboards and alerts around your highest priority use cases, and establish governance for user access and data retention from the beginning. This approach will help me get the most value from the platform while keeping the deployment manageable.

We have seen operational benefits, although we did not formally measure ROI with specific metrics. Splunk Enterprise Platform helped reduce the time required to investigate incidents by centralizing logs and providing powerful search capabilities. This improved analyst productivity and troubleshooting efficiency. The biggest return has been better visibility and faster access to relevant data, rather than a measurable reduction in headcount or quantified cost savings.

The pricing for Splunk Enterprise Platform for large volumes is on the higher side compared to some alternatives, especially for organizations that ingest large volumes of data. The initial setup requires investment in implementation, but once deployed, the platform provides strong value through its scalability and extensive capabilities. The licensing model is straightforward but requires careful planning to manage data growth and costs. For organizations that prioritize security and IT operations, the overall value generally justifies the investment.

My organization has tracked TCO metrics for the non-indexing analytics approach to evaluate the success of reducing TCO with Splunk Enterprise Platform's non-indexing analytics approach.

Splunk Enterprise Platform provides useful artificial intelligence-assisted capabilities that can help improve security operations and data analysis. From a governance and security perspective, I think it is important that artificial intelligence features respect existing role-based access control, maintain audit logs, and protect sensitive data. Organizations should also have clear policies around how artificial intelligence is used, what data it can access, and how artificial intelligence-generated insights are validated before taking action. Overall, the artificial intelligence capabilities are promising, but strong governance, transparency, and data protection are essential for enterprise adoption.

Artificial intelligence capabilities in an enterprise security platform can significantly improve productivity by helping summarize data, identify patterns, and assist with investigation. However, the accuracy and reliability of the output depend on the quality of the underlying data and configuration. Artificial intelligence-generated insights should be treated as decision support rather than definite answers, and they should always be validated by security analysts before taking action. I provided this review with an overall rating of nine out of ten.

In terms of using Splunk Enterprise Platform, we use it for our SOC environment where we have an ES setup separately. We collect logs from various sources like AWS, EDR logs, firewall logs, WinEvent logs, Linux logs, application logs, and specific service logs.

We gather that and based on that, we are providing users dashboards, searches, and alerts.

In terms of my favorite features of Splunk Enterprise Platform, it has vast customizability. It is very customizable. I can customize it according to my use case. Or if I have any restrictions in my environment or client environment, I can customize it according to my requirements. It is not something where I need to go with the straightforward way.

For a specific feature of Splunk Enterprise Platform, I appreciate the custom commands and custom endpoints by using which I can build my Splunk apps.

When concerning the cost of Splunk Enterprise Platform, the license cost can be a factor. The pricing is based on limited factors. There are two types of pricing where we have licensing based on the data or logs which we are indexing by size.

It can also be based on if we are purchasing the cloud platform, then it can be based on multiple factors such as how much data we are searching daily or a limit on that. Usually for 10 GB of license and two years of retention, it costs around $20,000 to $30,000.

Based on my thoughts about Splunk Enterprise Platform, I would rate it a seven or eight because the only thing I'm keeping in mind is the licensing cost. Otherwise, the overall product is good, its features, its customizability, and scalability are all excellent. The only factor is the licensing.

If they were providing a license to small customers, if they target small customers, it would be really great.

If they provide a small license to small customers, or if they bring some new licensing for small customers for the specific use case on top of Splunk Enterprise Platform, that would be beneficial.

My experience with Splunk Enterprise Platform is approximately two and a half years.

In terms of Splunk Enterprise Platform stability, I would rate it nine out of ten.

When considering scalability, Splunk Enterprise Platform is very scalable. I would rate it nine out of ten.

I have contacted support for Splunk Enterprise Platform multiple times. For our architecture specifically, we have contacted Splunk support. The add-on which is being provided by Splunk support was generating an error in our environment. For that, we contacted support and they were able to provide us with the solution which is currently working fine.

Regarding alternatives to Splunk Enterprise Platform, I have tried to use other tools, but they are very specific to some use cases only. I have preferred to use Splunk because it works with all my use cases and all the log or source types. I tried Dynatrace and DataDog, which provide observability, but that was not as useful to me.

In terms of ease of use with Splunk Enterprise Platform, it is very easy and straightforward. All the steps are mentioned in their documentation. All the guides which are required or the prerequisites that must be there before installing or setup, are in their documentation. The community is also very good. We have enough description about the installation steps, which is what makes it easiest.

Using Splunk Enterprise Platform requires maintenance. In terms of maintenance, it will be specific. If we are making any changes, then we must schedule maintenance because it will restart its services and we must accept the downtime. If we are upgrading our environment or any specific apps that are present in our environment, then we must have maintenance for it.

I would rate this review an eight overall.

My main use case for Splunk Enterprise Platform is payments monitoring from a business monitoring perspective, where I use Splunk to monitor different payment journeys.

A specific example of how I use Splunk for payments monitoring is monitoring whether each payment reaches its logical end state. For instance, I monitor whether a payment that is supposed to go through fraud check actually goes through fraud check, or if a payment that is supposed to go through sanction check actually does, and whether accounting for those payments has been completed.

In addition to my main use case with Splunk Enterprise Platform, I also use it to trigger different automation. I have created applications including custom alert actions, which I use to trigger third-party automation through Splunk.

Splunk Enterprise Platform offers several best features for me, including customization, which I appreciate since most of my use cases are very challenging. For example, I have an in-house tool that is monitored by operators 24/7, and I needed to integrate that system with Splunk, so I wrote a custom alert action for that purpose. Similarly, for different use cases, I use custom commands and custom apps for data ingestion. Customization of Splunk Enterprise Platform environment is what is most beneficial for my team.

Customization has helped my team by enabling integration of a system monitored by operators 24/7 with Splunk using a custom alert action. Regarding features, I recently started exploring UI Toolkit, which looks great.

Splunk Enterprise Platform has impacted my organization positively in that I rely on it mainly for alerting purposes. Splunk Enterprise Platform is very integrated into my whole ecosystem, and I am able to catch even a simple blip with it, making it really beneficial.

To improve Splunk Enterprise Platform, it needs more AI capabilities. Although I know Splunk is heavily investing in AI-related technologies, I would like to see more AI capabilities in the future.

Regarding needed improvements for AI capabilities, governance should be on different guardrails, with monitoring of the AI models that Splunk is using, so informed decisions can be made. Regarding the accuracy and reliability of Splunk Enterprise Platform's AI output, I have not used it because I am still exploring that area, so I am unable to comment on it.

My impression of Splunk Enterprise Platform's capability to manage data sovereignty at a petabyte scale within my environment is a solid ten.

My use of Splunk's Federated Search for querying data in place has evolved. The main use case nowadays is that I have data in Cisco data fabric, and Splunk reaches out to that data using federated search, which is a game-changer. I would like to see improvements on the performance side where federated search is not slowing me down.

Maintaining granular control over data using the trusted control plane within Splunk Enterprise Platform is generally handled by my admin team, as I am mostly on the Splunk COE team, Center of Excellence team.

As my organization explores new use cases including agentic AI, Splunk Enterprise Platform's governance and role-based access controls play a role in managing access to operational data. I govern the role-based access control for knowledge objects, which should be similar for AI capabilities.

My impression of Splunk Enterprise Platform's approach to managing governance within a private network environment has been really good.

I have been using Splunk Enterprise Platform for almost ten years.

I can confidently say that Splunk Enterprise Platform is very stable.

Splunk Enterprise Platform's scalability is really good in terms of data and knowledge objects.

Splunk Enterprise Platform's customer support is perfect. I would rate the customer support a ten.

I have seen a return on investment in that I am saving time. I am able to generate alerts on time or sometimes before time, and I can take action on them.

My experience with pricing, setup cost, and licensing has been good, as my account manager has been able to handle everything seamlessly.

My advice to others looking into using Splunk Enterprise Platform is that they need to first define what they want to achieve with it, as there could be two different use cases: advanced AI analytics or alerting and taking actions from a perspective standpoint. First define that, determine the need in terms of data, and then use Splunk Enterprise Platform accordingly. I would rate Splunk Enterprise Platform a nine on a scale of one to ten.