Try our new research platform with insights from 80,000+ expert users

Snare vs Splunk Enterprise Security comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Apr 6, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Snare
Ranking in Log Management
41st
Ranking in Security Information and Event Management (SIEM)
42nd
Average Rating
8.0
Reviews Sentiment
7.4
Number of Reviews
3
Ranking in other categories
No ranking in other categories
Splunk Enterprise Security
Ranking in Log Management
2nd
Ranking in Security Information and Event Management (SIEM)
1st
Average Rating
8.4
Reviews Sentiment
7.6
Number of Reviews
312
Ranking in other categories
IT Operations Analytics (1st)
 

Mindshare comparison

As of June 2025, in the Security Information and Event Management (SIEM) category, the mindshare of Snare is 0.4%, up from 0.3% compared to the previous year. The mindshare of Splunk Enterprise Security is 9.5%, down from 12.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Information and Event Management (SIEM)
 

Featured Reviews

Frank Eargle - PeerSpot reviewer
A highly scalable solution that is easy to manage and super easy to set up
We use Snare for picking up Windows logs, and we used to use it for SQL as well. We had used it for Linux once or twice. We're mainly using it for Windows and Windows flat files The most valuable feature of Snare is flexibility or the ability to filter all things you don't want and don't have…
ROBERT-CHRISTIAN - PeerSpot reviewer
Has many predefined correlation rules and is brilliant for investigation and log analysis
It is very complicated to write your own correlation rules without the help of Splunk support. What Splunk could do better is to create an API to the standard SIEM tools, such as Microsoft Sentinel. The idea would be to make it less painful. In ELK Stack, Kibana is the query language with which you can search log files. I believe Splunk has also a query language in which they search their log files, but once you have identified the log file that you want to use for further security correlation, you want to very quickly transport that into your SIEM tool, such as Microsoft Sentinel. That is something that Splunk could make a little bit less painful because it is a lot of effort to find that log file and forward it. An API with Microsoft Sentinel or a similar SIEM tool would be a good idea.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The best thing about Snare is its format and consistency."
"The most valuable feature of Snare is flexibility or the ability to filter all things you don't want and don't have security value."
"Snare has good agents, especially for Windows."
"The stock analysts and security people use one single dashboard (one single location) to check our logs."
"The Splunk user community and forum are most valuable."
"Splunk has a wide range of features that customers use to find and analyze all kinds of logs."
"The reporting aspect is good and it does what I need it to do."
"It has a big user base, so the community is useful."
"Splunk gives my clients the ability to bring multiple, disparate types of data together, then correlate and report on them."
"The user interface is excellent, and since I'm using Splunk as a power user, it's easy to create dashboards."
"The connections to the database are very good and updating the data files is simple to do. The dashboards are useful and user-friendly."
 

Cons

"Users will initially find it difficult to identify the event types and installation in Snare."
"The solution is now developing a SIEM-like feature on Snare Central Server, but it's not complete yet."
"Snare should modernize its GUI a little bit."
"There's been a big push for SBC compute over the ingestion model, which will hamper us."
"The default threat intel feeds create many false positives and noise, which is counterproductive."
"The access and identity features could be improved. For example, let's say we have onboarded 65 logs. Now, we can identify the various processes, but we run into trouble when we're updating the processes for AWS CloudTrail, EDR, MDR, and XDR."
"Its user interface for everything other than the charts can be improved. Some parts of it can be simplified a bit, such as when importing documents that have the network traffic. When you're going through the information about the network traffic, you have to have the expertise, but even if a program is supposed to be for IT support, it is good to make it user-friendly because it gets easier to train people. When something goes wrong, the more difficult a program is in terms of UI, the harder it is to fix the issue."
"Sometimes the communication with support happens with multiple staff. They should reduce the time to resolution."
". Having a trial version or more training on Splunk would be helpful."
"The pricing can be better."
"I would like some additional AI capabilities to provide additional information about things going wrong and things going well."
 

Pricing and Cost Advice

"On a scale from one to ten, where one is cheap, and ten is expensive, I rate Snare's pricing a four out of ten."
"Snare has reasonable pricing."
"Snare is a cheap solution because a lot of customers are using it."
"I work on the technical side, so I don't know precise figures. However, I know that Splunk is a premium product, so it's somewhat costly. Still, you get a lot of unique features for the money."
"Splunk's cost is very high. They need to review the pricing. They have to go back and totally readdress the market."
"Splunk is definitely not a cheap solution. It is an expensive product."
"From what I have seen so far, Splunk has multiple cost models. The one that we are using is pretty good when it comes to ingesting data into the environment. It has worked out pretty well."
"The pricing could be made more competitive."
"Splunk Enterprise Security is expensive. I would rate the cost an eight out of ten with ten being the most expensive."
"Splunk is really expensive."
"I think the price could be improved."
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
856,873 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Computer Software Company
15%
Financial Services Firm
14%
Manufacturing Company
12%
Government
7%
Financial Services Firm
15%
Computer Software Company
15%
Manufacturing Company
8%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What do you like most about Snare?
The best thing about Snare is its format and consistency.
What is your experience regarding pricing and costs for Snare?
Snare is a cheap solution because a lot of customers are using it.
What needs improvement with Snare?
Users will initially find it difficult to identify the event types and installation in Snare.
What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
What is a better choice, Splunk or Azure Sentinel?
It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...
How does Splunk compare with Azure Monitor?
Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring information from different sources. Splunk is very good at alerting us if we...
 

Overview

 

Sample Customers

Military, Defence and Security Agencies, Banking Finance and Insurance companies, Retail, Health and Utilities.
Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.
Find out what your peers are saying about Snare vs. Splunk Enterprise Security and other solutions. Updated: June 2025.
856,873 professionals have used our research since 2012.