

Splunk User Behavior Analytics and One Identity Safeguard compete in the data analysis and security management space. Splunk holds the advantage in rapid data analysis and integration, while Safeguard is stronger in session monitoring and access management.
Features: Splunk excels with rapid data analysis, advanced threat detection, and customizable dashboards, offering advanced indexing and ease of integration with various technologies. One Identity Safeguard provides robust security features, focusing on session monitoring, transparent integration, and comprehensive auditing capabilities, which enhance its access management and session recording strengths.
Room for Improvement: Splunk could improve by reducing pricing complexity, enhancing dashboard flexibility, and integrating more real-time analytics features. Further integration with third-party solutions and simplified user-customized dashboards are desired. One Identity Safeguard can enhance its system integration, support for various protocols, and user interface. Improved session management and reduced storage demands are also required enhancements.
Ease of Deployment and Customer Service: Splunk offers flexibility across on-premises and public cloud environments with strong technical support and customer service. It is known for stability and satisfactory support. One Identity Safeguard primarily operates on-premises with limited private cloud support, and many users suggest improvements in customer support and deployment experience.
Pricing and ROI: Splunk's complex licensing model often leads to high perceived costs affecting budget predictability, yet it provides significant productivity gains over time. One Identity Safeguard, although costly as usage scales, offers a straightforward pricing model with structured licensing, aligning comprehensive security features with pricing.
We have seen a 12% return on investment with One Identity Safeguard, and we have saved a significant amount of money.
The time is reduced by nearly fifty percent for our audit preparation and compliance reporting compared to earlier.
I have seen a return on investment through reduced audit effort and fewer security incidents related to privileged access, along with significant time savings for IT and security teams by automating access control and password management.
The solution can save costs by improving incident resolution times and reducing security incident costs.
I sometimes need escalations to reach expertise.
Sometimes, I get a very helpful response and they address issues on a call.
When I have day-to-day incidents and problems, the response is good enough in terms of time and quality.
Mission-critical offering a dedicated team, proactive monitoring, and fast resolution.
From the responsiveness perspective, Splunk is very responsive with SLA-bound support for premium tiers.
I would rate their technical support as 8.5 out of 10.
The scalability of One Identity Safeguard is perfect, scoring ten out of ten.
We have a cluster of SPPs and a cluster of SPSs, and we can add a node to that cluster without much fuss.
I would rate it a nine out of ten for scalability.
Splunk User Behavior Analytics is highly scalable, designed for enterprise scalability, allowing expansion of data ingestion, indexing, and search capabilities as log volumes grow.
I would rate it a nine out of ten for stability.
In terms of stability, I rate One Identity Safeguard nine to ten out of ten.
One Identity Safeguard is very stable and can handle the workload easily; I have not seen any downtime.
With built-in redundancy across zones and regions, 99.9% uptime is achievable.
Splunk User Behavior Analytics is a one hundred percent stable solution.
Splunk User Behavior Analytics is highly stable and reliable, even in large-scale enterprise environments with high log injection rates.
For some configurations on the SPS side, if I need to make changes, such as for DNS servers, I must redeploy the machine.
There are many steps. We are still in the onboarding phase, and it seems very manual.
Another area for improvement could be the threat detection capabilities, like those seen in other PAM vendors.
Global reach allows deployment of apps and services closer to users worldwide, but data sovereignty concerns exist and region selection must align with compliance requirements.
I encountered several issues while trying to create solutions for this advanced version, which seem unrelated to query or data issues.
High data ingestion costs can be an issue, especially for large enterprises, as Splunk charges based on the amount of data processed.
It is one of those where the more you buy, the cheaper it is.
It is cheaper than CyberArk.
It is more expensive than Secret Server but way less expensive than CyberArk.
Reserved instances with one or three-year commitments offer lower rates, providing up to 70% savings.
Compared to all other products in the market, it is the most expensive one in all aspects including professional service and licenses, even the cloud version.
Comparing with the competitors, it's a bit expensive.
The auditing and approval mechanisms are features we did not have before and are greatly appreciated.
Automatic credential rotation helps our team by removing the need for manual changes to privileged passwords, reducing the risk of stale or shared credentials and ensuring that every access is controlled and compliant.
Just-in-time access has sped up admin task completion and improved our overall compliance reporting, allowing audits to be completed nearly half the time compared to earlier.
I also utilize it for anomaly detection and behavior analysis, particularly using Splunk's machine learning environment.
The dashboards themselves are nice, very good, and very helpful, but the accuracy of the data or the information that will be presented on the dashboard is something that needs to be questioned.
Features like alerts and auto report generation are valuable.
| Product | Market Share (%) |
|---|---|
| Splunk User Behavior Analytics | 6.0% |
| One Identity Safeguard | 2.5% |
| Other | 91.5% |

| Company Size | Count |
|---|---|
| Small Business | 29 |
| Midsize Enterprise | 17 |
| Large Enterprise | 19 |
| Company Size | Count |
|---|---|
| Small Business | 7 |
| Midsize Enterprise | 5 |
| Large Enterprise | 12 |
One Identity Safeguard manages and monitors privileged access, enhancing security with features like automatic session recording, real-time monitoring, and credential rotation. It integrates seamlessly, supports compliance with audit trails, and improves operational efficiency across organizations. This robust platform significantly bolsters security protocols while controlling sensitive operations.
Splunk User Behavior Analytics is a behavior-based threat detection is based on machine learning methodologies that require no signatures or human analysis, enabling multi-entity behavior profiling and peer group analytics for users, devices, service accounts and applications. It detects insider threats and external attacks using out-of-the-box purpose-built that helps organizations find known, unknown and hidden threats, but extensible unsupervised machine learning (ML) algorithms, provides context around the threat via ML driven anomaly correlation and visual mapping of stitched anomalies over various phases of the attack lifecycle (Kill-Chain View). It uses a data science driven approach that produces actionable results with risk ratings and supporting evidence that increases SOC efficiency and supports bi-directional integration with Splunk Enterprise for data ingestion and correlation and with Splunk Enterprise Security for incident scoping, workflow management and automated response. The result is automated, accurate threat and anomaly detection.
We monitor all User Entity Behavior Analytics (UEBA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.