Devo vs Splunk Enterprise Security comparison

Devo and Splunk are both solutions in the Security Information and Event Management (SIEM) category. Devo is ranked #36, while Splunk is ranked #1 with an average rating of 8.3. Devo holds a 1.1% mindshare in SIEM, compared to Splunk’s 9.2% mindshare. Additionally, 95% of Devo users are willing to recommend the solution, compared to 93% of Splunk users who would recommend it.

Devo

Read 22 Devo reviews

2,579 Views
1,754 Comparison Views

95% willing to recommend

Splunk Enterprise Security

Read 369 Splunk Enterprise Security reviews

23,960 Views
12,459 Comparison Views

93% willing to recommend

Devo

Splunk Enterprise Security

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jul 13, 2025

Splunk Enterprise Security and Devo both operate in the SIEM category. Splunk seems to have the upper hand in terms of feature depth and adaptability, while Devo is noted for its speed and cost-effectiveness.

Features:Splunk Enterprise Security offers powerful log mining capabilities, customizable dashboards, and seamless third-party tool integrations. Its advanced analytics help in preventing and responding to security threats efficiently. Devo is known for its fast real-time analytics, user-friendly interface, and customizable dashboards. Its ability to handle large data volumes efficiently is a standout feature.

Room for Improvement:Splunk users desire lower costs, easier setup, and better automation. Additionally, enhancements in analytics and simpler licensing are requested. Devo could improve by expanding its third-party system integrations, refining its UI, and offering more robust native parsers.

Ease of Deployment and Customer Service:Splunk operates across public, private, and hybrid clouds, requiring significant setup expertise for larger deployments. Its technical support is generally responsive, albeit with occasional delays. Devo, also available in cloud environments, boasts a straightforward setup and quick support response times, with a focus on user-friendliness post-deployment.

Pricing and ROI:Splunk, perceived as premium, offers extensive features but at a high cost, making it challenging for smaller entities despite its strong ROI in security threat responses. Devo provides a more budget-friendly alternative with fixed costs based on data ingestion, making it appealing to businesses seeking scalable solutions.

To learn more, read our detailed Devo vs. Splunk Enterprise Security Report (Updated: September 2025).

Buyer's Guide

Devo vs. Splunk Enterprise Security

September 2025

Download the complete report

Helped 870,697 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Devo

Ranking in Log Management

43rd

Ranking in Security Information and Event Management (SIEM)

36th

Ranking in IT Operations Analytics

11th

Average Rating

8.4

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

AIOps (20th)

Splunk Enterprise Security

Ranking in Log Management

2nd

Ranking in Security Information and Event Management (SIEM)

1st

Ranking in IT Operations Analytics

1st

Average Rating

8.4

Reviews Sentiment

7.3

Number of Reviews

369

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of October 2025, in the Security Information and Event Management (SIEM) category, the mindshare of Devo is 1.1%, up from 1.0% compared to the previous year. The mindshare of Splunk Enterprise Security is 9.2%, down from 11.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Information and Event Management (SIEM) Market Share Distribution
Product	Market Share (%)
Splunk Enterprise Security	9.2%
Devo	1.1%
Other	89.7%

Security Information and Event Management (SIEM)

Featured Reviews

Michael Wenn

CEO / Co-Founder at Aiops ltd

Has cloud-first architecture with SIEM technology to run security operations

When it comes to scale, they're architected quite well. They handle some of the biggest customers globally, with significant throughput on their platform, managing thousands of customers. One of the most impressive aspects of Devo is its customer community. A large majority, over 80 percent of their customers, actively participate on a Devo-specific community page. They're contributing to product development and support, events, and user group information, helping each other out. This high level of engagement is rare and demonstrates both the loyalty of their customer base and the quality of their product. They offer a range of small, medium, and large options to cater to everyone. I sold Devo products while working with them, focusing on enterprise solutions. However, as a small reseller, my customers were typically smaller businesses. I rate the solution's scalability a nine out of ten.

Read full review

Kyle Vernham

Threat Analyst at a manufacturing company with 10,001+ employees

Built-in searches and unified data access streamline alert investigation and boosts analyst efficiency

The two features I appreciate the most in Splunk Enterprise Security are the built-in searches, which have been very easy for us to get started with right out of the box, and the fact that it accesses all of our other systems. You can access it as a pane of glass rather than having to search individually. We also have the option to compare our analysts from our service to service. Splunk Enterprise Security helps our SOC team prioritize and investigate high-fidelity alerts more effectively by providing a more in-depth look and the ability to access a lot more of our data. Instead of jumping from several segmented systems, it allows us to have everything brought together in one place. For example, you have to move from our purview to our build system and to Splunk Enterprise Security, and it enables us to streamline that process. The built-in features of Splunk Enterprise Security, which we recently procured, have given us a good starting point and demonstrated the value of the product, providing an easy way to sell it to our company. The ease of getting everything into our purview helps us, and it serves as a good start for the investigation part in one location rather than what we usually have, which is jumping from system to system to system. Splunk Enterprise Security plays a role in our company's strategy to combat insider threats and advanced persistent threats by currently being in its technical test phase. We are still rolling it out, and it should help us find any insider threats based on information that our policy states should not be present in our system. Splunk Enterprise Security's risk-based alerting (RBA) has impacted our alert volume and analyst productivity because we've got many different systems feeding into it. However, it has helped to make it easier for our analysts to go through a set of events rather than 100 alerts. RBA allows us to streamline the process and customize it for our analysts. When it comes to leveraging Splunk Enterprise Security's dashboards and visualizations to communicate security posture to executives, it's pretty straightforward for any type of information. The visualization is easy to understand, but I haven't had any direct conversations with our executives.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The ability to have high performance, high-speed search capability is incredibly important for us. When it comes to doing security analysis, you don't want to be doing is sitting around waiting to get data back while an attacker is sitting on a network, actively attacking it. You need to be able to answer questions quickly. If I see an indicator of attack, I need to be able to rapidly pivot and find data, then analyze it and find more data to answer more questions. You need to be able to do that quickly. If I'm sitting around just waiting to get my first response, then it ends up moving too slow to keep up with the attacker. Devo's speed and performance allows us to query in real-time and keep up with what is actually happening on the network, then respond effectively to events."

"One of the biggest features of the UI is that you see the actual code of what you're doing in the graphical user interface, in a little window on the side. Whatever you're doing, you see the code, what's happening. And you can really quickly switch between using the GUI and using the code. That's really useful."

"The user experience [is] well thought out and the workflows are logical. The dashboards are intuitive and highly customizable."

"Devo provides a multi-tenant, cloud-native architecture. This is critical for managed service provider environments or multinational organizations who may have subsidiaries globally. It gives organizations a way to consolidate their data in a single accessible location, yet keep the data separate. This allows for global views and/or isolated views restricted by access controls by company or business unit."

"Devo helps us to unlock the full power of our data because they have more than 450 parsers, which means that we can ingest pretty much any type of log data."

"It centralizes security management within a business, functioning as a core system for a SOC."

"In traditional BI solutions, you need to wait a lot of time to have the ability to create visualizations with the data and to do searches. With this kind of platform, you have that information in real-time."

"Scalability is one of Devo's strengths."

More Devo pros

"The risk-based alerting (RBA) is one of the valuable features."

"We are using Microsoft 365 and we're using the Exchange Mail Service. It's good for monitoring that in particular."

"I would assess the stability and reliability of Splunk Enterprise Security as good, as I have not had any issues with it."

"The completeness of the solution is what we like the most."

"The most valuable features for us include its robust log management capabilities, which allow us to efficiently handle and retain logs for extended periods as needed."

"We can quickly search for almost anything across many log sources in seconds."

"The varied prebuilt feature is the most valuable because it ensures that we have complete coverage over all of the key questions."

"We are much faster finding and addressing issues with Splunk."

More Splunk Enterprise Security pros

Cons

"One major area for improvement for Devo... is to provide more capabilities around pre-built monitoring. They're working on integrations with different types of systems, but that integration needs to go beyond just onboarding to the platform. It needs to include applications, out-of-the-box, that immediately help people to start monitoring their systems. Such applications would include dashboards and alerts, and then people could customize them for their own needs so that they aren't starting from a blank slate."

"An admin who is trying to audit user activity usually cannot go beyond a day in the UI. I would like to have access to pages and pages of that data, going back as far as the storage we have, so I could look at every command or search or deletion or anything that a user has run. As an admin, that would really help. Going back just a day in the UI is not going to help, and that means I have to find a different way to do that."

"Their documentation could be better. They are growing quickly and need to have someone focused on tech writing to ensure that all the different updates, how to use them, and all the new features and functionality are properly documented."

"The Activeboards feature is not as mature regarding the look and feel. Its functionality is mature, but the look and feel is not there. For example, if you have some data sets and are trying to get some graphics, you cannot change anything. There's just one format for the graphics. You cannot change the size of the font, the font itself, etc."

"Some basic reporting mechanisms have room for improvement. Customers can do analysis by building Activeboards, Devo’s name for interactive dashboards. This capability is quite nice, but it is not a reporting engine. Devo does provide mechanisms to allow third-party tools to query data via their API, which is great. However, a lot of folks like or want a reporting engine, per se, and Devo simply doesn't have that. This may or may not be by design."

"From our experience, the Devo agent needs some work. They built it on top of OS Query's open-source framework. It seems like it wasn't tuned properly to handle a large volume of Windows event logs. In our experience, there would definitely be some room for improvement. A lot of SIEMs on the market have their own agent infrastructure. I think Devo's working towards that, but I think that it needs some improvement as far as keeping up with high-volume environments."

"Where Devo has room for improvement is the data ingestion and parsing. We tend to have to work with the Devo support team to bring on and ingest new sources of data."

"The biggest area with room for improvement in Devo is the Security Operations module that just isn't there yet. That goes back to building out how they're going to do content and larger correlation and aggregation of data across multiple things, as well as natively ingesting CTI to create rule sets."

More Devo cons

"Better directions on search head clusters."

"Splunk could have more built-in use case presets that customers can build on and customize."

"The GUI can be improved to include some of the capabilities that other BI solutions have."

"The presence of multiple layers creates a significant challenge for monitoring across cloud environments."

"One main change I would suggest is related to the incident board: when an incident is resolved, it should not appear on the incident board. It's just a rare occurrence that we open up the incident."

"It's missing some features that other solutions have, such as the ability to upgrade the endpoint and perform endpoint universal forwarders from a deployment server instead of using a third-party solution, such as Puppet or Ansible."

"The on-premise integration with SOAR could be more simple; the cloud version integrates with SOAR very easily, but the on-premise SOAR and on-premise Splunk Enterprise Security are really not that easy, so I would appreciate if that could be improved."

"Regarding room for improvement, I expect Splunk to provide information about new features on a regular basis, such as notifications about enhancements that may improve security posture."

More Splunk Enterprise Security cons

Pricing and Cost Advice

"It's very competitive. That was also a primary draw for us. Some of the licensing models with solutions like Splunk and Sentinel were attractive upfront, but there were so many micro-charges and services we would've had to add on to make them what we wanted. We had to include things like SOAR and extended capabilities, whereas all those capabilities are completely included with the Devo platform. I haven't seen any additional fee."

"We have an OEM agreement with Devo. It is very similar to the standard licensing agreement because we are charged in the same way as any other customer, e.g., we use the backroom."

"The way Devo prices things is based on the amount of data, and I wish the tiers had more granularity. Maybe at this point they do, but when we first negotiated with them, there were only three or four tiers."

"I rate the pricing a four on a scale of one to ten, where one is cheap, and ten is expensive."

"Devo is definitely cheaper than Splunk. There's no doubt about that. The value from Devo is good. It's definitely more valuable to me than QRadar or LogRhythm or any of the old, traditional SIEMs."

"Pricing is based on the number of gigabytes of ingestion by volume, and it's on a 30-day average. If you go over one day, that's not a big deal as long as the average is what you expected it to be."

"It's a per gigabyte cost for ingestion of data. For every gigabyte that you ingest, it's whatever you negotiated your price for. Compared to other contracts that we've had for cloud providers, it's significantly less."

"Devo is a hosted or subscription-based solution, whereas before, we purchased QRadar, so we owned it and just had to pay a maintenance fee. We've encountered this with some other products, too, where we went over to subscription-based. Our thought process is that with subscription based, the provider hosts and maintains the tool, and it's offsite. That comes with some additional fees, but we were able to convince our upper management it was worth the price. We used to pay under 10k a year for maintenance, and now we're paying ten times that. It was a relatively tough sell to our management, but I wonder if we have a choice anymore; this is where the market is."

More Devo pricing and cost advice

"It's a yearly subscription."

"My experience with the solution's setup cost, pricing, and licensing was really good."

"Splunk should be able to integrate with other product using the free version."

"In addition to the licensing fee, there is also a support and maintenance charge."

"Splunk Enterprise Security's pricing is competitive."

"Be upfront about your needs and expectations. Splunk is great to work with."

"Setup cost is cheap: It is free, it is user-friendly, and it is fast."

"The solution is a little expensive."

More Splunk Enterprise Security pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

870,697 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at Deloitte & Touche

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

16%

Computer Software Company

10%

University

Retailer

Computer Software Company

14%

Financial Services Firm

14%

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	7
Midsize Enterprise	4
Large Enterprise	11

By reviewers
Company Size	Count
Small Business	110
Midsize Enterprise	50
Large Enterprise	257

Questions from the Community

What is your experience regarding pricing and costs for Devo?

Compared to Splunk or SentinelOne, it is really expensive. I rate the product’s pricing a nine out of ten, where one is cheap and ten is expensive.

See all answers

What needs improvement with Devo?

They can improve their AI capabilities. If you look at some integrations like XDR or AI, which add to the platform to correlate situations in events, there are areas for enhancement. For instance, ...

See all answers

What is your primary use case for Devo?

Devo is a SIEM replacement technology used to run security operations. It centralizes security management within a business, functioning as a core system for a SOC. This system is the central cyber...

See all answers

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...

See all answers

What is a better choice, Splunk or Azure Sentinel?

It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...

See all answers

How does Splunk compare with Azure Monitor?

Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring information from different sources. Splunk is very good at alerting us if we...

See all answers

Comparisons

LogRhythm SIEM vs Devo

Compared 15% of the time

Microsoft Sentinel vs Devo

Compared 13% of the time

IBM Security QRadar vs Devo

Compared 13% of the time

OpenText AI Operations Management vs Devo

Compared 6% of the time

Datadog vs Devo

Compared 5% of the time

More Devo Competitors

IBM Security QRadar vs Splunk Enterprise Security

Compared 8% of the time

Dynatrace vs Splunk Enterprise Security

Compared 6% of the time

Wazuh vs Splunk Enterprise Security

Compared 6% of the time

Datadog vs Splunk Enterprise Security

Compared 5% of the time

Security Onion vs Splunk Enterprise Security

Compared 4% of the time

More Splunk Enterprise Security Competitors

Product Reports

Buyer's Guide

Devo

October 2025

Download Devo product report

Buyer's Guide

Splunk Enterprise Security

September 2025

Download Splunk Enterprise Security product report

Overview

Devo is the only cloud-native logging and security analytics platform that releases the full potential of all your data to empower bold, confident action when it matters most. Only the Devo platform delivers the powerful combination of real-time visibility, high-performance analytics, scalability, multitenancy, and low TCO crucial for monitoring and securing business operations as enterprises accelerate their shift to the cloud.

Devo

Splunk Enterprise Security delivers powerful log management, rapid searches, and intuitive dashboards, enhancing real-time analytics and security measures. Its advanced machine learning and wide system compatibility streamline threat detection and incident response across diverse IT environments.

Splunk Enterprise Security stands out in security operations with robust features like comprehensive threat intelligence and seamless data integration. Its real-time analytics and customizable queries enable proactive threat analysis and efficient incident response. Integration with multiple third-party feeds allows detailed threat correlation and streamlined data visualization. Users find the intuitive UI and broad compatibility support efficient threat detection while reducing false positives. Despite its strengths, areas such as visualization capabilities and integration processes with cloud environments need enhancement. Users face a high learning curve, and improvements in automation, AI, documentation, and training are desired to maximize its potential.

What Are the Key Features of Splunk Enterprise Security?

Log Management: Efficiently manages and organizes a vast amount of logs for better data handling.
Rapid Data Search: Quickly retrieves relevant data for fast decision-making.
Flexible Dashboards: Customizable dashboards provide clear data visualization.
Comprehensive Threat Intelligence: Offers detailed insights to preemptively defend against threats.
Real-Time Analytics: Analyzes data in real-time to enhance response times.
Integration with Third-Party Feeds: Streamlines information flow from multiple sources.

What Benefits Should Users Investigate in Reviews?

Efficient Incident Response: Enhances the ability to respond promptly to threats.
False Positive Reduction: Minimizes incorrect threat alarms, making monitoring more efficient.
Threat Detection Speed: Accelerates the identification and evaluation of security threats.
Cost-Effectiveness: Potential savings through better licensing options and operational efficiency.
User Adaptability: Enhancements in documentation and training resources aid in overcoming the learning curve.

In specific industries like finance and healthcare, Splunk Enterprise Security is instrumental for log aggregation, SIEM functionalities, and compliance monitoring. Companies leverage its capabilities for proactive threat analysis and response, ensuring comprehensive security monitoring and integration with various tools for heightened operational intelligence.

Splunk

Sample Customers

United States Air Force, Rubrik, SentinelOne, Critical Start, NHL, Panda Security, Telefonica, CaixaBank, OpenText, IGT, OneMain Financial, SurveyMonkey, FanDuel, H&R Block, Ulta Beauty, Manulife, Moneylion, Chime Bank, Magna International, American Express Global Business Travel

Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.

Buyer's Guide

Devo vs. Splunk Enterprise Security

September 2025

Free Report: Devo vs. Splunk Enterprise Security

Find out what your peers are saying about Devo vs. Splunk Enterprise Security and other solutions. Updated: September 2025.

DOWNLOAD NOW

870,697 professionals have used our research since 2012.

See our Devo vs. Splunk Enterprise Security report.

See our list of best Security Information and Event Management (SIEM) vendors, best Log Management vendors, and best IT Operations Analytics vendors.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.