Splunk Enterprise Security vs Splunk Observability Cloud comparison

Splunk Enterprise Security vs. Splunk Observability Cloud

May 2023

Download the complete report

Helped 885,376 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

ROI

Sentiment score

6.2

Splunk Enterprise Security is valued for automation, efficiency, and comprehensive visibility, despite high costs for smaller enterprises.

Sentiment score

6.7

Splunk Observability Cloud boosts workflow efficiency by over 75%, enhancing visibility, reducing downtime, and cutting costs for IT and DevOps.

The documentation for Splunk Enterprise Security is outstanding. It is well-organized and easy to access.

Akif Arayici

DevOps&Cloud Engineer Mentee at CertDirectory.io

We couldn't calculate what would have been the cost if they had actually gotten compromised; however, they were in the process, so every investment was returned immediately.

Dennis Mohn

Business Development Manager at Axians Germany

On average, my SecOps team takes probably at least a quarter of the time, if not more, to remediate security incidents with Splunk Enterprise Security compared to our previous solution.

Michael Waite

IT Orchestration Architect at Penn State University

For more quotes and insights, download the Splunk Enterprise Security report

Using Splunk has saved my organization about 30% of our budget compared to using multiple different monitoring products.

For more quotes and insights, download the Splunk Observability Cloud report

Senior Manager at Bank of America

Anyone working in front-end management should recognize the market price to see the true value of end-user monitoring.

EdwardShim

General Manager at MOCOMSYS

I have definitely seen a return on investment with Splunk Observability Cloud, particularly through how fast it has grown and how comfortable other teams are in relying on its outputs for monitoring and observability.

Taiwo Ige

IT Operations Engineer at ABC Supply Co. Inc.

Customer Service

Sentiment score

6.2

Splunk Enterprise Security support gets mixed reviews with praise for responsiveness but critique for delays and tiered issues.

Sentiment score

7.2

Splunk Observability Cloud's customer service is praised for responsiveness and effectiveness despite some needing improved response times and personalization.

We have paid for Splunk support, and we’re not on the free tier hoping for assistance; we are a significant customer and invest a lot in this service.

reviewer2746377

Senior System Administrator at a tech services company with 5,001-10,000 employees

I have had nothing but good experiences with Splunk support, receiving timely and helpful replies.

Adam Santilli

Cyber Security Associate at SAP

We've had great customer success managers who have helped us navigate scaling from 600 gigs to 30 terabytes.

MatthewSnyder

Principal Engineer at Aviatrix

For more quotes and insights, download the Splunk Enterprise Security report

On a scale of 1 to 10, the customer service and technical support deserve a 10.

reviewer2755917

Systems Administrator at a insurance company with 1,001-5,000 employees

They have consistently helped us resolve any issues we've encountered.

Juan Baez

Software Engineer at UKG

They often require multiple questions, with five or six emails to get a response.

For more quotes and insights, download the Splunk Observability Cloud report

Splunk Observability Expert

Scalability Issues

Sentiment score

7.3

Splunk Enterprise Security is scalable and effective for large data, excelling in cloud but challenging on-premises.

Sentiment score

7.2

Splunk Observability Cloud is scalable and flexible for large operations, but costs and performance require careful management.

We currently rely on disaster recovery and backup recovery, which takes time to recover, during which you're basically blind, so I'm pushing my leadership team to switch over to a clustering environment for constant availability.

David-Alfonso

IT Security Engineer at a financial services firm with 201-500 employees

It is one of the things that separates it from other tooling, and if not, it is the most scalable solution out there.

reviewer2778402

Systems Development Engineer at a tech vendor with 10,001+ employees

They struggle a bit with pure virtual environments, but in terms of how much they can handle, it is pretty good.

ROBERT-CHRISTIAN

CTO at a tech vendor with 10,001+ employees

For more quotes and insights, download the Splunk Enterprise Security report

We've used the solution across more than 250 people, including engineers.

Splunk Observability Expert

As we are a growing company transitioning all our applications to the cloud, and with the increasing number of cloud-native applications, Splunk Observability Cloud will help us achieve digital resiliency and reduce our mean time to resolution.

Lalatendu Swain

Application Developer at UMB Financial

I would rate its scalability a nine out of ten.

For more quotes and insights, download the Splunk Observability Cloud report

Senior Manager at Bank of America

Stability Issues

Sentiment score

7.5

Splunk Enterprise Security is stable and reliable, with occasional performance issues and bugs quickly resolved with proper setup.

Sentiment score

7.7

Splunk Observability Cloud is stable with minor issues, generally rated highly, though user-specific environments may affect performance.

They test it very thoroughly before release, and our customers have Splunk running for months without issues.

reviewer2701950

Splunk System Engineer at a non-tech company with 11-50 employees

Splunk has been very reliable and very consistent.

MatthewSnyder

Principal Engineer at Aviatrix

We need more SMEs, and there is no mechanism to tell us about indexer or search head issues.

For more quotes and insights, download the Splunk Enterprise Security report

Senior Manager at Bank of America

When downtime occurs, it raises concerns about how we measure and receive alerts, as everything needs to be in place.

reviewer2800332

Aws Dev Ops Engineer at a consultancy with 10,001+ employees

I would rate its stability a nine out of ten.

Muhammad M

Head of DevOps at a tech services company with 1-10 employees

We rarely have problems accessing the dashboard or the page.

For more quotes and insights, download the Splunk Observability Cloud report

Splunk Observability Expert

Room For Improvement

Splunk Enterprise Security requires enhancements in visualizations, ease of use, AI integration, and improved documentation and training.

Splunk Observability Cloud requires better usability, pricing transparency, tool integration, search performance, and enhanced documentation, training, and customization.

Improving the infrastructure behind Splunk Enterprise Security is vital—enhanced cores, CPUs, and memory should be prioritized to support better processing power.

Mustafa Ameen

Resident Consultant (Security Analyst) at helpag

Splunk Enterprise Security is not something that automatically picks things; you have to set up use cases, update data models, and link the right use cases to the right data models for those detections to happen.

reviewer2704098

Security & Risk Analyst at a computer software company with 1,001-5,000 employees

For any future enhancements or features, such as MLTK and SOAR platform integration, we need more visibility, training, and certification for the skilled professionals who are working.

Madhu Gurindapalli

Security Consultant at Matiq

For more quotes and insights, download the Splunk Enterprise Security report

The out-of-the-box customizable dashboards in Splunk Observability Cloud are very effective in showcasing IT performance to business leaders.

Taiwo Ige

IT Operations Engineer at ABC Supply Co. Inc.

The next release of Splunk Observability Cloud should include a feature that makes it so that when looking at charts and dashboards, and also looking at one environment regardless of the product feature that you're in, APM, infrastructure, RUM, the environment that is chosen in the first location when you sign into Splunk Observability Cloud needs to stay persistent all the way through.

Sarah Van Zee

Systems Monitoring Engineer II at a government with 10,001+ employees

There should be a solution to update OTeL agents from Splunk Observability Cloud itself.

HrishikeshNavkar

Senior Software Engineer at WorldPay US

For more quotes and insights, download the Splunk Observability Cloud report

Setup Cost

Splunk Enterprise Security is costly but valued for its extensive functionality, appealing mainly to larger enterprises with flexible licensing.

Splunk Observability Cloud offers valuable features but faces criticism for its higher pricing compared to alternatives like Dynatrace and AppDynamics.

I saw clients spend two million dollars a year just feeding data into the Splunk solution.

ROBERT-CHRISTIAN

CTO at a tech vendor with 10,001+ employees

The platform requires significant financial investment and resources, making it expensive despite its comprehensive features.

Hamada Elewa

System Engineer - Security Presales at Raya Integration

I find it to be affordable, which is why every industry uses it.

Swayam Sopnic Nayak

Vice President Research And Development at OSINT Ambition

For more quotes and insights, download the Splunk Enterprise Security report

Splunk is a bit expensive since it charges based on the indexing rate of data.

For more quotes and insights, download the Splunk Observability Cloud report

Senior Manager at Bank of America

It is expensive, especially when there are other vendors that offer something similar for much cheaper.

Ernesto Gutierrez

Solutions Architect at Ikusi

I can confidently say our availability improved by forty percent, and downtime was reduced by approximately seventy to eighty percent.

Jigar Hirani

Splunk Engineer at Data Elicit Solutions Pvt. Ltd.

Valuable Features

Splunk Enterprise Security enhances threat detection and response with risk-based alerting, integration, and advanced visualization for cybersecurity teams.

Splunk Observability Cloud offers customizable dashboards, real-time monitoring, AI analytics, integration capabilities, and scalability for enhanced operational efficiency.

This capability is useful for performance monitoring and issue identification.

GautamKar

Staff Performance Engineer at ServiceNow

I assess Splunk Enterprise Security's insider threat detection capabilities for helping to find unknown threats and anomalous user behavior as great.

reviewer2701950

Splunk System Engineer at a non-tech company with 11-50 employees

Splunk Enterprise Security provides the foundation for unified threat detection, investigation, and response, enabling fast identification of critical issues.

Ashiq Ashraf

Specialist-Infrastructure Opertions at Allianz Technology

For more quotes and insights, download the Splunk Enterprise Security report

Splunk provides advanced notifications of roadblocks in the application, which helps us to improve and avoid impacts during high-volume days.

Senior Manager at Bank of America

For troubleshooting, we can detect problems in seconds, which is particularly helpful for digital teams.

For more quotes and insights, download the Splunk Observability Cloud report

Splunk Observability Expert

It offers unified visibility for logs, metrics, and traces.

Mary Vasantha Golleru

Administrator at a tech vendor with 10,001+ employees

Categories and Ranking

Splunk Enterprise Security

Average Rating

8.4

Reviews Sentiment

7.3

Number of Reviews

381

Ranking in other categories

Log Management (2nd), Security Information and Event Management (SIEM) (1st), IT Operations Analytics (1st)

Splunk Observability Cloud

Average Rating

8.2

Reviews Sentiment

6.9

Number of Reviews

Ranking in other categories

Application Performance Monitoring (APM) and Observability (6th), Network Monitoring Software (8th), IT Infrastructure Monitoring (7th), Cloud Monitoring Software (6th), Container Management (5th), Digital Experience Monitoring (DEM) (2nd)

Mindshare comparison

While both are Application Lifecycle Management solutions, they serve different purposes. Splunk Enterprise Security is designed for Security Information and Event Management (SIEM) and holds a mindshare of 7.2%, down 9.8% compared to last year.
Splunk Observability Cloud, on the other hand, focuses on Application Performance Monitoring (APM) and Observability, holds 2.4% mindshare, up 1.6% since last year.

Security Information and Event Management (SIEM) Mindshare Distribution
Product	Mindshare (%)
Splunk Enterprise Security	7.2%
Wazuh	5.8%
IBM Security QRadar	5.3%
Other	81.7%

Security Information and Event Management (SIEM)

Application Performance Monitoring (APM) and Observability Mindshare Distribution
Product	Mindshare (%)
Splunk Observability Cloud	2.4%
Dynatrace	6.0%
Datadog	5.2%
Other	86.4%

Application Performance Monitoring (APM) and Observability

Featured Reviews

Helps us detect cyber threats quickly and integrate multiple feeds effectively

Senior Manager at Bank of America

Overall, the product is good, but when it comes to some infrastructure issues, we have to dig into more logs. There is no straightforward indication of an issue. Health check kind of dashboards are not available. More AI would help us, and more optimization, since security products run more queries. The AI module could suggest solutions, optimizing queries or workload balancing. If the product itself advises on running queries during peak times, it would be similar to what ChatGPT currently offers. We see quite a few issues on stability. Even last week, we faced something, and identifying bottlenecks is not easy. We need more SMEs, and there is no mechanism to tell us about indexer or search head issues. Self-monitoring dashboards could be beneficial. The technical support still requires more improvement. Often, primary support takes a lot of time and forwards most solutions to the engineering side. The primary support team has very limited knowledge to provide.

Read full review

Taiwo Ige

IT Operations Engineer at ABC Supply Co. Inc.

Alerting improves incident response across teams and enables faster awareness before customer impact

Splunk Observability Cloud could be improved in terms of integrations with more technical add-ons, such as Zoom. Although they have one with Zoom, it's not available in the cloud, so having that feature would be beneficial. Essentially, Splunk should continue expanding to create easier ways to ingest logs from different products. The out-of-the-box customizable dashboards in Splunk Observability Cloud are very effective in showcasing IT performance to business leaders. However, there are aspects that could be improved, such as linking dashboards to one another. While IT leaders may not drill down, it's crucial to create levels of dashboards for technical users to find root causes, making it effective for stakeholders.

Read full review

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

885,376 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

12%

Computer Software Company

Manufacturing Company

Government

Financial Services Firm

11%

Computer Software Company

10%

Manufacturing Company

Retailer

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	112
Midsize Enterprise	50
Large Enterprise	267

By reviewers
Company Size	Count
Small Business	24
Midsize Enterprise	10
Large Enterprise	53

Questions from the Community

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...

What is a better choice, Splunk or Azure Sentinel?

It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...

How does Splunk compare with Azure Monitor?

Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring information from different sources. Splunk is very good at alerting us if we...

What do you like most about SignalFx?

The most valuable feature is dashboard creation.

What needs improvement with SignalFx?

Regarding dashboard customization, while Splunk has many dashboard building options, customers sometimes need to create specific dashboards, particularly for applicative metrics such as Java and pr...

What is your primary use case for SignalFx?

The solution involves observability in general, such as Application Performance Monitoring, and generally addresses digital applications, web applications, sites, and mobile applications. I worked ...

IBM Security QRadar vs Splunk Enterprise Security

Comparisons

Compared 9% of the time

Sentinel vs Splunk Enterprise Security

Compared 5% of the time

Wazuh vs Splunk Enterprise Security

Compared 4% of the time

Dynatrace vs Splunk Enterprise Security

Compared 3% of the time

Elastic Security vs Splunk Enterprise Security

Compared 3% of the time

More Splunk Enterprise Security Competitors

Avantra vs Splunk Observability Cloud

Compared 4% of the time

Kentik vs Splunk Observability Cloud

Compared 3% of the time

Datadog vs Splunk Observability Cloud

Compared 2% of the time

Cribl vs Splunk Observability Cloud

Compared 2% of the time

Observe vs Splunk Observability Cloud

Compared 2% of the time

More Splunk Observability Cloud Competitors

Product Reports

Splunk Enterprise Security

March 2026

Download Splunk Enterprise Security product report

Splunk Observability Cloud

March 2026

Download Splunk Observability Cloud product report

Also Known As

No data available

Splunk Infrastructure Monitoring, Splunk Real User Monitoring (RUM), Splunk Synthetic Monitoring

Overview

Splunk Enterprise Security delivers powerful log management, rapid searches, and intuitive dashboards, enhancing real-time analytics and security measures. Its advanced machine learning and wide system compatibility streamline threat detection and incident response across diverse IT environments.

Splunk Enterprise Security stands out in security operations with robust features like comprehensive threat intelligence and seamless data integration. Its real-time analytics and customizable queries enable proactive threat analysis and efficient incident response. Integration with multiple third-party feeds allows detailed threat correlation and streamlined data visualization. Users find the intuitive UI and broad compatibility support efficient threat detection while reducing false positives. Despite its strengths, areas such as visualization capabilities and integration processes with cloud environments need enhancement. Users face a high learning curve, and improvements in automation, AI, documentation, and training are desired to maximize its potential.

What Are the Key Features of Splunk Enterprise Security?

Log Management: Efficiently manages and organizes a vast amount of logs for better data handling.
Rapid Data Search: Quickly retrieves relevant data for fast decision-making.
Flexible Dashboards: Customizable dashboards provide clear data visualization.
Comprehensive Threat Intelligence: Offers detailed insights to preemptively defend against threats.
Real-Time Analytics: Analyzes data in real-time to enhance response times.
Integration with Third-Party Feeds: Streamlines information flow from multiple sources.

What Benefits Should Users Investigate in Reviews?

Efficient Incident Response: Enhances the ability to respond promptly to threats.
False Positive Reduction: Minimizes incorrect threat alarms, making monitoring more efficient.
Threat Detection Speed: Accelerates the identification and evaluation of security threats.
Cost-Effectiveness: Potential savings through better licensing options and operational efficiency.
User Adaptability: Enhancements in documentation and training resources aid in overcoming the learning curve.

In specific industries like finance and healthcare, Splunk Enterprise Security is instrumental for log aggregation, SIEM functionalities, and compliance monitoring. Companies leverage its capabilities for proactive threat analysis and response, ensuring comprehensive security monitoring and integration with various tools for heightened operational intelligence.

Splunk

Splunk Observability Cloud offers sophisticated log searching, data integration, and customizable dashboards. With rapid deployment and ease of use, this cloud service enhances monitoring capabilities across IT infrastructures for comprehensive end-to-end visibility.

Focused on enhancing performance management and security, Splunk Observability Cloud supports environments through its data visualization and analysis tools. Users appreciate its robust application performance monitoring and troubleshooting insights. However, improvements in integrations, interface customization, scalability, and automation are needed. Users find value in its capabilities for infrastructure and network monitoring, as well as log analytics, albeit cost considerations and better documentation are desired. Enhancements in real-time monitoring and network protection are also noted as areas for development.

What are the key features?

Log Searching: Efficiently search and analyze logs from various sources.
Data Integration: Seamlessly integrate with multiple environments.
Dashboard Customization: Tailor dashboards to specific monitoring needs.
Monitoring Capabilities: Provides comprehensive insights into application performance.
Security Features: Analyze and address security threats across systems.
Visualization Tools: Enhance data analysis and system performance optimization.

Why consider this for ROI?

Comprehensive Visibility: Gain complete insights into IT infrastructure.
Performance Optimization: Improve overall system performance and efficiency.
Rapid Deployment: Quick setup to meet organization demands swiftly.
Enhanced Security: Strengthen security measures through detailed analytics.

In industries, Splunk Observability Cloud is implemented for security management by analyzing logs from detection systems, offering real-time alerts and troubleshooting for cloud-native applications. It is leveraged for machine data analysis, improving infrastructure visibility and supporting network and application performance management efforts.

Splunk

Sample Customers

Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.

Sunrun, Yelp, Onshape, Tapjoy, Symphony Commerce, Chairish, Clever, Grovo, Bazaar Voice, Zenefits, Avalara