Splunk Cloud Platform Reviews

Splunk Cloud Platform is used to monitor everything, as we have multiple applications from which we get multiple data and multiple logs. We centralized our logging system, centralized our APIs, and everything into it. If any APIs fail, we created multiple alerts over there. We use it for that purpose.

The best features of Splunk Cloud Platform are the ecosystem that has been created. We do not have to worry about many small things or many big things because the cloud gives infrastructure that is handled on their end. That makes it very easy for us to get used to it. The main beneficial case for us is the dashboards, alerts, stability, cloud scalability, and everything.

The search capability is pretty good because we have been using it for the last one year and it works very smoothly. The search functionality works very smoothly with us. Recently, we faced one issue, and with this feature, we got to know from which end this problem occurred. We directly dived into it and solved that thing. It is useful.

The alerting mechanisms work very proactively because that is the main use case of Splunk Cloud Platform. One of our application APIs got shut down because of some random issue or error. Because of the alert message, during our peak time, we got to know something was wrong. We directly fixed it and the rest of the things worked easily.

The ingestion and visualization feature of Splunk Cloud Platform is very good. It helps us a lot to create multiple reports and multiple dashboards because visualization can help us create multiple things into it.

Splunk Cloud Platform is almost a nine out of ten, but the main improvement point is the user manual. Recently, we got stuck somewhere in an error, but because of the less documentation available in ChatGPT or in any LLM, we had to go through every documentation and then we got the result. If Splunk can provide some LLM or any AI tool for error solving, it would be better.

The deployment of Splunk Cloud Platform is easier. If we get a better user manual, it can be even easier, but it is quite easy.

We have been using Splunk Cloud Platform for almost one year.

Per our use case, Splunk Cloud Platform is very stable because we use multiple platforms. Even in high volume and high traffic, it works very stably.

Splunk Cloud Platform is more scalable and a very scalable thing. We used it in high volume during peak hours of our traffic, and it runs smoothly.

The technical support is pretty good. Whenever we get stuck, we have used it two or three times, and it is pretty good.

Splunk Cloud Platform is compared to other solutions because previously we were using DataDog for the same thing. The ecosystem provided by Splunk, the support they provide, better dashboards, better alerts, and everything is why we moved to Splunk Cloud Platform.

It took almost one hour to deploy Splunk Cloud Platform, or one or two hours.

In our organization, three people use Splunk Cloud Platform.

Using Splunk Cloud Platform saves us time because previously we took two to three hours troubleshooting any problem, but now we get to know which particular area of the API is throwing an error and everything. Almost one and a half hours, or almost two hours, are reduced by using Splunk Cloud Platform.

The pricing did not come under me, it is from the management department. We think it is more reliable to move with it, which is why we shifted from DataDog to Splunk Cloud Platform.

Splunk Cloud Platform rates as a nine out of ten, or 9.5.

We are a customer in our relationship with the vendor.

We have not used the machine learning tools yet.

The integration with third-party applications is pretty good. We have integrated our mail application into Splunk Cloud Platform. Whenever the alert comes, we get to know and we can work on it 24/7.

We highly recommend Splunk Cloud Platform. If you are working with any data or any APIs from any logging system, or any log you have to track, Splunk Cloud Platform is a very good platform to work with. The overall review rating is 9 out of 10.

We have an internal solution and we are working for our own enterprise solution. I'm working in Principal Financial Group where we have our in-house security operations center, so we do not have any clients; we are conducting our security monitoring for our own infrastructure.

Our major focus is on User Behavior Analytics, UBA. We are focusing on integration of all security controls that we have, meaning the log collection from all the security controls and all the servers. The use cases we are focusing on are MITRE framework, phishing, and User Behavior Analytics, UBA.

UBA is a great application within Splunk Cloud Platform.

That feature gives us behavioral analytics within the logs, so we do not need to write complex queries. By using UBA, we achieve threat detection without needing complex correlation rules; UBA gives us a perfect output from it.

The log ingestion is very good, and the visualization part is also very good. I can create multiple dashboards from the logs we are receiving; it is similar to other SIEM solutions.

Splunk Cloud Platform is good, but sometimes it lags. When I run a very simple query with a perfectly created query in the search bar, it gives a good result, but if I create a very simple query without index and source types, it takes too much time to draw the visuals.

It is somewhat complex because Splunk Cloud Platform has multiple components like heavy forwarders and indexers. There are multiple integration approaches that we use, for example, syslog and for Windows, it is WMI. For most of the applications, we are using API integration, which is very good, but for syslog and other WMI kind of configurations, first, I need to integrate them so they start sending logs to the heavy forwarders. On heavy forwarders, I have to configure syslog-ng, and there are multiple configuration files that I have to configure for each data source.

The improvement part is that I have worked on multiple SIEM solutions, starting with RSA NetWitness, QRadar, ArcSight, and Splunk Cloud Platform. All SIEM solutions have the same issues; at the time of POC, the vendors tell us that they have many features, but at the time of implementation, we find minor issues everywhere, from integration to querying logs and deploying configuration files. There are minor issues that need fixing for more operational efficiency.

I have been working with Splunk Cloud Platform for around one and a half years.

Splunk Cloud Platform is stable and reliable with no issues, though sometimes minor issues happen; it is not as though the system goes down or anything.

The more I scale, the more I have to pay for Splunk Cloud Platform. I have to properly fine-tune the logs, filtering them for what I want to take into Splunk Cloud Platform for security monitoring. Only the logs required for security monitoring should be taken into Splunk Cloud Platform; if we have compliance requirements to just store logs, then Splunk Cloud Platform is not the right platform.

I am not that happy, but they provide timely responses. They are available at the time of need; however, there are a few things like issues with log parsing that they will not cover in normal support calls. I needed to create an ODS, On-Demand Service, for those kinds of issues.

Pricing is too high for Splunk Cloud Platform. Nowadays, people are using Cribl solution that we host just before Splunk Cloud Platform. From a heavy forwarder, logs go to Cribl, and there is a filter mechanism available in Cribl, so we can only send the events of interest to Splunk Cloud Platform, which reduces our pricing heavily. Otherwise, when collecting logs from devices such as Linux, Windows, and firewalls, we get debug logs as well, and Splunk Cloud Platform charges based on the ingestion—how much data we ingested into Splunk Cloud Platform.

We are currently working with Splunk Cloud Platform only. We are exploring machine learning tools, but they are not deployed yet, so there is currently a POC going on.

Splunk Cloud Platform does what it has to do but nothing extraordinary; it is a simple dashboard application like other SIEM solutions.

There are multiple support cases because we have a very large architecture of Splunk Cloud Platform. We have eight heavy forwarders and thousands of log sources integrated with Splunk Cloud Platform, so from time to time, I observe issues related to integration, applications, and the internal workings of Splunk Cloud Platform. Thus, we need to raise support cases to troubleshoot those.

Overall, I would rate this review a 7 out of 10.

I have experience with Splunk Cloud Platform. We use it for log monitoring, debugging, and various other purposes.

Since I joined as a software developer, I have been working with Splunk Cloud Platform for around two years. It is the main tool we use during production issues. We monitor it not only in production issues, but also when we move code to UAT, QA, or XAT environments. We first monitor and check Splunk logs to ensure everything is functioning correctly and to identify what is going wrong.

Splunk Cloud Platform helps in analyzing logs from different services, not just one service, and identifying errors. Especially during production issues, it is our primary platform for understanding where everything goes wrong and determining the root cause. The main feature I appreciate is the Search and Processing Language, which we call SPL. It allows us to query and filter logs efficiently. We can filter by time, whether for a few minutes or hours, and we can filter by various other parameters, such as which user has made the most requests, user-wise breakdowns, specific error patterns, exceptions, or failures. We can use time-based filtering and keyword searches to narrow down on the relevant logs we wish to see at any particular point in time.

I use the alerting mechanisms present in Splunk Cloud Platform. Without Splunk, we would have to manually go to production logs and search for various things manually, which could be very time-consuming. When we use Splunk, these mechanisms are automated. We only need to change the query sometimes because we search for different mnemonics and different teams. If we adjust the region or the team and then provide the particular keyword we are searching for, this helps us change the logs and see what we really need.

Splunk Cloud Platform helps in analyzing logs from different services, not just one service, and identifying errors. Especially during production issues, it is our primary platform for understanding where everything goes wrong and determining the root cause. The main feature I appreciate is the Search and Processing Language, which we call SPL. It allows us to query and filter logs efficiently. We can filter by time, whether for a few minutes or hours, and we can filter by various other parameters, such as which user has made the most requests, user-wise breakdowns, specific error patterns, exceptions, or failures. We can use time-based filtering and keyword searches to narrow down on the relevant logs we wish to see at any particular point in time.

I use the alerting mechanisms present in Splunk Cloud Platform. Without Splunk, we would have to manually go to production logs and search for various things manually, which could be very time-consuming. When we use Splunk, these mechanisms are automated. We only need to change the query sometimes because we search for different mnemonics and different teams. If we adjust the region or the team and then provide the particular keyword we are searching for, this helps us change the logs and see what we really need.

One unique feature with Splunk Cloud Platform is that it can be used not only for log creation but also for creating dashboards. I have created one dashboard myself for visually representing data. This dashboard checks various clients and services to see how many hits we have seen. I made it as a pie chart, and when we click on one of those sections, we are able to see how many hits that service has received. For that particular service, we can check how many users have contributed to that hit. When we send that visualization to higher management, they make decisions based on what service to focus more on. The decisions matter and vary according to management priorities.

The Search Processing Language of Splunk Cloud Platform has a steep learning curve. To extract the correct amount of logs needed, you must understand the exact mnemonics. Writing efficient SPL queries requires time to become accustomed to the language. Only after you have a good grasp of the basics of Splunk Cloud Platform and understand how to trace logs will you be able to use it perfectly.

Handling a large volume of logs requires proper filtering strategies. Logs keep coming in very large quantities, but you need to know how to properly filter them. Proper filtering strategies must be understood and implemented.

The setup and configuration for Splunk Cloud Platform is complex, especially from a developer perspective. Although it was relatively easy for me, the setup and configuration were handled by the platform team, which had to deal with the complexity in the initial phases.

The initial onboarding process when I first started using Splunk Cloud Platform was not very complex. When Splunk was initially onboarded to the company, I understand that was a complex process. Since I joined, the process has been fairly simple. We just had to submit an access request for a particular mnemonic or for a particular team and we are able to check the logs for that mnemonic once we get access. The approval process is a bit tedious in our organization. We have an approval process for every tool, not only Splunk Cloud Platform. Once you receive approval, you should be good. However, we can only check for that particular team or mnemonic. If we wish to check for other services, we have to submit a request form again, and that goes through several layers of approvals before we are able to see the logs.

Splunk Cloud Platform does not require any maintenance on my end as a developer. We only use it for checking logs. Maintenance is handled by the platform team. Sometimes Splunk experiences downtime for a few minutes, which we are notified about via email, sometimes during weekends. I am not certain what happens during those phases, but as developers, we are unable to use it for that short period of time, sometimes around half an hour during midnight hours on weekends. Otherwise, it functions well.

I have been using this solution for two years.

Splunk Cloud Platform has fairly good stability. However, I have noticed that the Show Source feature, which displays detailed versions of logs, sometimes takes a little time. Whenever the system needs to show 100 lines or 1,000 lines, that takes some time usually. When a large number of logs sometimes enter the system, we sometimes see lag. Especially during the Show Source function, when checking the detailed logs of any particular log, I have seen this issue sometimes. Otherwise, everything is fine.

Splunk Cloud Platform is quite scalable. All services and event-based streaming, such as Kafka, have all logs flowing through Splunk Cloud Platform. We have seen that it handles this well and is great at scaling to meet our needs.

I have not contacted the technical support of Splunk Cloud Platform yet. Even when we are unable to get something resolved, we have our seniors and experts in our team and adjacent teams who help us understand where we are going wrong with the queries and other issues. I have not personally contacted the technical support yet.

The initial onboarding process when I first started using Splunk Cloud Platform was not very complex. When Splunk was initially onboarded to the company, I understand that was a complex process. Since I joined, the process has been fairly simple. We just had to submit an access request for a particular mnemonic or for a particular team and we are able to check the logs for that mnemonic once we get access. The approval process is a bit tedious in our organization. We have an approval process for every tool, not only Splunk Cloud Platform. Once you receive approval, you should be good. However, we can only check for that particular team or mnemonic. If we wish to check for other services, we have to submit a request form again, and that goes through several layers of approvals before we are able to see the logs.

I have not used any alternatives to Splunk Cloud Platform since I joined my organization. We have been using Splunk only for observability and tracking and monitoring. So far there are no other alternatives that we have tried out in our organization.

From a developer perspective, I am involved in coding, checking logs, monitoring, observability, and other related tasks. The platform team takes care of the setup and configurations, which is complex initially. The pricing aspect is handled by management and not something I am directly involved in. I would rate this product a 9 out of 10.

The main use cases for Splunk Cloud Platform involve forwarding logs from our application database using Splunk Forwarder to the Splunk tools so that we can have dashboards to check in case of any production issues, vulnerabilities, or incident cases.

What I appreciate about Splunk Cloud Platform is that observability is strong, and we can have real-time data with fast time to value. We can conduct advanced searches by leveraging the search processing language, and AI assistants are available to query and analyze data sets. This makes it excellent for unified observability and advanced searches.

Splunk Cloud Platform improves the way the organization functions by being used during SIEM and ITSM tickets to enhance infrastructure monitoring so that we can have customizable dashboards, interactive visualization, and out-of-the-box reporting for all stakeholders, whether technical or non-technical. Through this, we can achieve unified observability and full-stack visibility.

I would like to see Splunk Cloud Platform become more user-friendly compared to others. For example, Grafana is very user-friendly where you can easily create graphs.

Regarding missing features or functionalities, I believe index management and performance optimization should be enhanced so that we can optimize the SPL queries instead of using transactions whenever feasible.

I have been working in my current field and in the industry for around 13.5 years.

I find Splunk Cloud Platform to be stable overall.

Regarding the platform's ability to scale aligning with my organization's demand fluctuations, scalability requires some changes to our architecture involving planning related to the framework so it can adapt to growing data volume and user demands. Every day MFT and integration demands are increasing, so we must choose the right topologies for a scalable architecture, and role distribution should be in place. We need to use load balancing and capacity planning. We should take advantage of what Splunk Enterprise is providing by reviewing components such as Splunk Enterprise deployment, distributing indexing and searching so that we can use that platform to manage all user objects and data storage.

I evaluate customer service and technical support from Splunk to be good. On a scale of one to ten, I would rate the technical support about nine.

Currently there are no IBM solutions in use, but earlier I worked on App Connect Enterprise and IBM Integration Bus, which are integration-related technologies.

The setup process of Splunk is straightforward. If we can provide the process document, it is easy. We conducted some development depending on the forwarder. By using the universal forwarder, we collected logs. We have to set up the indexes and search heads for medium enterprises. For large enterprises, the setup is more complex because we need clustering mechanisms such as load balancing, search head cluster, and index cluster. We can accomplish this by using the universal forwarder and indexes; Splunk will manage the indexes, storage, and upgrades, but as a customer we must manage the universal forwarder, data onboarding, and dashboards. These parts depend on the skill sets we have available.

My company has a business relationship with Splunk as we are a customer, and they onboard the vendor as per their policy. We are managing them and are not part of that setup.

I find Splunk Cloud Platform to be cost-effective. If we optimize it, we can achieve ROI by seeing reduced downtime and improved operational efficiency. We can make changes in one go by having perfect compliance automation related to GDPR and PCI DSS.

The key differences and strengths of Splunk Cloud Platform in comparison to other technologies indicate that Splunk Cloud provides consolidated capabilities such as SIEM, log management, reporting tools, and monitoring dashboards that deliver better performance in monitoring. Depending on cost, if we optimize that very effectively, we can achieve good ROI by reducing ingested data volume, using data retention tiers, or summary indexing. Through this approach we can improve Splunk Cloud Platform ROI and use that tool very effectively.

Regarding the pricing aspect, setup cost, and licensing of Splunk Cloud Platform, I have not directly joined that process, but it depends on the ingestion volume. It is based on the volume of data ingested per day, so we have to exclude unnecessary data sources and remove duplicate events to optimize cost improvement areas. We can establish data retention policies depending on hot and warm data so that the data will have summary indexing and reduce infrastructure cost and storage cost. We should have the right size infrastructure, and we have to monitor that license usage.

The key differences and strengths of Splunk Cloud Platform in comparison to other technologies indicate that Splunk Cloud provides consolidated capabilities such as SIEM, log management, reporting tools, and monitoring dashboards that deliver better performance in monitoring. Depending on cost, if we optimize that very effectively, we can achieve good ROI by reducing ingested data volume, using data retention tiers, or summary indexing. Through this approach we can improve Splunk Cloud Platform ROI and use that tool very effectively.

The main drawbacks of Splunk Cloud Platform include that while it removes the infrastructure management overhead, it has limitations such as volume growth becoming expensive. The licensing is typically based on ingestion volume or workload, so we must optimize that, and there is no direct access to the underlying server; we must use forwarding tools. Some advanced configurations are needed to support tickets or manage change processes. These are dependencies where we have to rely on vendor dependencies for maintenance windows. Data residency and compliance concerns also exist, where scenarios such as GDPR, banking, and healthcare have strict regulations regarding where data must be stored, so we have to consider that concern when making the decision.

Generally, most enterprises find that Splunk Cloud Platform is reducing operational overhead, and we should focus more on security. It is a good choice when needing a managed service or for cloud-first organizations. For security and compliance, when custom scripts and third-party add-ons are needed, there are restrictions, and for very large volumes of multiple terabytes, it is not advisable because the licensing cost is very high and optimization will be critical. If complete administrative control is needed, we can avoid using Splunk Cloud Platform. I would rate this review overall as a seven out of ten.

My usual use cases for Splunk Cloud Platform include data, data integration, and dashboards. I currently have three use cases.

I find the features and capabilities of Splunk Cloud Platform to be highly valuable because of how customizable it is for my view and the data we need to put into it. The ability to organize the data and set up different views is particularly useful.

I also appreciate how easy it is to work with coworkers on the platform to collaborate on the same issues.

The tangible benefits I've observed since starting with Splunk Cloud Platform are significant. It's pretty much the standard for what we use it for. If we're working with a consultant or we bring in someone new, most people know the platform or at least have been exposed to it. This exposure and the platform's big name and familiarity make it easy to direct people around in it, show them the data, and collaborate.

I'm not quite sure how Splunk Cloud Platform could be improved or enhanced. I would suggest keeping what works. Sometimes it can feel slightly slow in what it brings up, but I don't know if a lot of times that's on our end with the data that's getting in. Staying up to date with current trends and technologies will be good enough for me. It's already a good platform, and I wouldn't recommend too many changes or tweaks.

The major thing that could be optimized is the speed, so it could be a bit faster.

I've been working with Splunk Cloud Platform for about three years.

Splunk Cloud Platform has been living up to my expectations regarding reliability and stability so far.

I think we rarely ever have Splunk Cloud Platform crash or error out where we're not able to bring up the site and access what we need to do in it. Usually, in the rare case that it does happen, it's usually back up within 20 to 30 minutes. Stability-wise, sometimes it'll get slow, but usually, if we are patient, it pulls up everything we need it to.

I believe Splunk Cloud Platform scales pretty well. We use it for quite a bit of the data and things that we house and have coming in, and it's usually pretty snappy. Every once in a while, we may have to reload something or have trouble putting in data, but this happens maybe once every couple of days or so, which is expected for how heavy we use it. For the most part, it's pretty smooth.

I do not often communicate with the technical support of Splunk Cloud Platform. I've never communicated with their support.

I did not use a different solution for the same use cases before Splunk Cloud Platform.

I did not evaluate other options before choosing Splunk Cloud Platform; it was recommended.

Once everything was set up better for me, Splunk Cloud Platform provides pretty good visibility into the different data we put into it. I would rate the visibility and ease at about a seven out of ten.

I measure that ease by looking at failure rates, how long it takes to update anything, and the UI and how easy it is. I am confident and happy with these metrics.

I would rate the scalability level of Splunk Cloud Platform at about an eight.

I have not used the zero-setup feature for AI models in Splunk Cloud Platform. We have not really integrated that feature at all.

I decided to go with Splunk Cloud Platform because it is an industry widely used platform. It was vetted by the US government as a right to use, and that compliance is needed for the work I do. It's a vetted, trusted platform to move and organize very sensitive data.

I believe there was some Splunk training through a link. I'm not sure if it was on the website, training, documentation, and videos and things on just best use cases and features. That was a little while ago, though.

The materials I felt were surface level, good-to-know information. They were helpful, but very basic.

It was a while ago, and that was just my impression of it back then. I'm not exactly sure if I would want them to provide more detailed information at this stage.

I don't deal with the pricing side of it. I wouldn't know how the subscription model impacts my financial planning for data platform investments.

I prefer native models in Splunk's environment. I prefer it because it keeps me in control more and keeps the data local.

This preference influences my data strategy because it'll allow us to be within our own environment, not have to obfuscate or change the way we would use a model that wasn't local to us. Instead of having to navigate around or omit or change details, we can upload what we need to and know that the data won't go past our service.

My overall rating for Splunk Cloud Platform is an eight out of ten.

Splunk Cloud Platform is used for our cybersecurity use cases.

We have alerting set up that is used in tandem with our SOAR platform, which is Tines, to pull the alerts and send them over to SOC. Security-related logs such as Windows, Okta logs, cloud-based AWS, and Google Cloud are all being sent to Splunk Cloud Platform in order to allow for cybersecurity incident investigation, alerting, and threat hunting.

Because we are a cybersecurity team, we rely on logs sent from our business units. We operate our Cyber Splunk on a model that allows access from business units. Each business unit has their own set of indexes. We control access this way so that it is self-serve for businesses while cyber still retains control and overview of all content that goes into our Cyber Splunk.

The best features are the ease of use because platform maintenance is abstracted from us. We do not have to worry about that aspect. I also appreciate Splunk Cloud Platform licensing model, which allowed us to not worry about our daily ingest so much as basically tweak retention based on our current needs, which is very flexible. I also value the storage model of Splunk Cloud Platform where we could split our logs between active storage and archive storage and restore from archive as needed for investigations or audit purposes.

One of the logs that we are sending to Cyber Splunk is CrowdStrike, but they are very large. It is very noisy and chatty. So, we only keep around 35 days of logs in active storage. That satisfies our current alerting needs and day-to-day investigations and threat hunting. However, there are sometimes incidents that require us to look further back. In those cases, we can restore back up to 90 days going back. That was a very easy process and very straightforward.

It has simplified our cyber operations. It has helped us respond to threats and investigations much quicker than with our previous SIEM. It is honestly less headache for me as an admin and it is much easier because a lot of people in the industry in cyber know Splunk already. So there is no entry barrier. It is much easier to start using Splunk Cloud Platform right away. There is a wealth of information available, including training materials and documentation on the web. So for us, it has just made everything easier.

Building stronger capability to use federated searches to make this process easier would be beneficial. I also think that the current iteration of Splunk Cloud Platform's AI assistant is not great. I did not have much success using it. So, I think that should be improved upon.

The AI assistant that we are using right now does not seem to be very accurate. Although, this may simply be because it needs more time to learn about our data. I am not certain, but we had mixed results with that.

We have been using Splunk Cloud Platform for about three years.

We have experienced stability issues.

I do not think that it has any negative impact. We have not experienced any scalability issues. Scaling was seamless. We do not really notice it at our scale. Our Splunk Cloud Platform footprint is relatively small. So we simply did not experience any impact at all.

To us, it is easy. It scales with our needs. It is easy to request additional licensing. So I do not have any complaints about it. It is an all-positive experience.

Customer support is very good.

We used Devo before that.

Devo did not provide the same level of availability and resilience as Splunk Cloud Platform. It was not as polished and well-developed a product as Splunk Cloud Platform. So it did not have the same capabilities.

Splunk Cloud Platform is a public cloud deployment.

We purchased through our vendor.

I do not have any metrics from different departments handling that. I can say that we definitely have fewer resources needed to manage the platform. We definitely have fewer support tickets open than with our previous SIEM platform. Overall, our spend is about the same for much better capabilities. That is really what I can say about it.

It was a very good experience. Pricing is relatively clear and easy to understand. That is something that worked well for us.

We did not evaluate alternate solutions.

It is quite easy to manage apps. Because there are so many apps, it is sometimes difficult because Splunk apps are generally the most well-behaved apps, but there are also third-party and vendor apps that sometimes do not follow best practices. So managing them may be sometimes challenging, but overall, I would say it is a very easy and good process.

I think that the advice is to use Splunk Cloud Platform because it is a great platform and it is much easier to maintain than on-premises Splunk, or it is really the best product out there. I cannot really say much else; it is way ahead of the competition. I would rate this platform a 10 out of 10.

The main use case is for logs monitoring to get a clear vision about all the products and all the services that we have. We are giving multiple APIs to multiple platforms, and we have multiple services to maintain everything. We have created multiple logs to identify what is the root cause, which is taking much higher CPU usage and everything.

The favorite feature of Splunk Cloud Platform is the infrastructure that has been provided to us, and the pricing that has been given to us is very low and very fit within our budget where we were looking at that point. The main feature is the reduction in time and manpower.

My thoughts about the overall app ecosystem in Splunk Cloud Platform are that it is very good. We don't have to think about where the error has occurred or where we have to solve it; we don't have to spend two to three hours just to find where the error is. It is very easy to get out of it.

The dislike about Splunk Cloud Platform is the learning resources and the learning materials that they have. In the starting of my phase with Splunk Cloud Platform, I was very new to this, and I was not able to understand each and everything. We don't have much of a resource from where we can learn things about Splunk Cloud Platform, but if there is a specific platform from where we can learn things from, it would be great if we get a platform to learn how we have to use it.

I would like to see better training material or something like that for Splunk Cloud Platform.

I have been involved in Splunk Cloud Platform for the last six months, but our company has been using it for eight to nine months.

My thoughts on the stability of Splunk Cloud Platform, regarding lagging, crashing, and downtime, are that earlier we faced this issue on a very large scale of logs. However, because we were very new at that time, we didn't know much about things, but now we do. The things are not too tough for us anymore.

Splunk Cloud Platform is very scalable. We are scaling right now in our multiple applications, and it is very scalable.

We have contacted the technical support for Splunk Cloud Platform many times to get out of issues and have raised many issues with them. If I were to put the support of Splunk Cloud Platform on the scale from one to ten, I would give it a nine, because every time we are getting very decent support from them that is very reliable and very good.

Earlier, we were using a 24/7 monitoring solution as an alternative to Splunk Cloud Platform. We had built our own dashboards with Python scripts and everything to manage each platform, with each platform having their individual platform in their domain with Python, and we created all that, but it was very messy to handle in the end.

The initial deployment of Splunk Cloud Platform is difficult. It was difficult because we were very new to Splunk Cloud Platform and everything. Earlier we were thinking to buy DataDog, but then we skipped that and had an eye on Splunk Cloud Platform. It was tough to get to know about things at first, but now we are good at this and know more about it.

Splunk Cloud Platform does not require any maintenance on my end. We have four applications where we have integrated this platform, and the last time I maintained it was around two to three months back. Once everything has been set in any particular area, we don't have to maintain it every time; it is very reliable.

The return on investment from Splunk Cloud Platform is substantial. I don't know how much investment is being put into it, but the return is very high and very good.

I don't know much about the pricing of Splunk Cloud Platform, but I know that it is very less as compared to what we thought to manage this platform. It is very less, but I don't know the exact number; that is on the management side.

In Splunk Cloud Platform, the updates and everything are very easy. We don't have to worry about any other things, so it is not that difficult; it is easy. Splunk Cloud Platform can handle their own problems.

Regarding AI models in Splunk Cloud Platform, I think we are not using any specific ones.

We have used the zero setup feature for AI models in Splunk Cloud Platform. Splunk Cloud Platform is giving us a Machine Learning Toolkit, MLTK, and we are now learning about it. We are also evolving our things on it, and it is good to know that it is helpful very much.

We are just a customer of Splunk Cloud Platform, not in any partnerships.

I would give Splunk Cloud Platform an overall score of 8.5 out of 10.

The main use cases for Splunk Cloud Platform include data collection, parsing activities, use case building, data ingestion, and creating dashboards and reports. My clients use it for similar purposes.

The best thing about Splunk Cloud Platform is that you can bring any data and store it in one place. You can build meaningful insights from it, have the same data ingested, create beautiful insights, have alerting done on it, and have dashboards and reports built on top of it.

Splunk Cloud Platform's ingest and visualization features do not bind you with a limitation in the volume you want to ingest. Since we are using the compute-based licensing feature of Splunk Cloud Platform, there is no limitation to the volume of data we ingest on the platform. All Splunk Cloud Platform instances are also Smart Store supported, so that eases storage utilization concerns.

One of the best advantages of using Splunk Cloud Platform is that there are lots of proactive alert notifications from Splunk support if anything goes down on the infrastructure end or if there is anything wrong with your environment. Splunk support is on top of things, notifying you beforehand if something is going wrong and that their team is already aware and working on a fix.

I don't see any new requirements in terms of improvements for Splunk Cloud Platform at this time. Splunk's dashboarding, reporting, and visualizations are evolving at a larger scale with the new Splunk Dashboard Studio in place. There were some limitations with the classic dashboard where you had to be aware of different HTML, CSS, and custom JavaScript for better visualizations. That's being migrated towards Splunk Dashboard Studio, which is evolving at a great pace, providing similar functionalities. I have not faced any current challenges regarding Splunk Cloud Platform's limitations. I still think, however, that better configuration and customization options for workload management could be enhanced, but that applies to Splunk Enterprise as well. It's just my understanding and what I foresee, but I'm not sure if it will be a priority right now, as even without workload management, a lot can be done, and the product team might have a different roadmap.

I have been working with Splunk Cloud Platform for almost six years.

My feedback remains that you have your designated account manager who helps navigate all the cases. Sometimes, the support team may not be fully knowledgeable about the challenge you face, but through their internal escalation structure, they manage to find viable solutions sooner or later or provide updates on when issues will be fixed. I think their support is pretty good on that part.

Positive

The best thing about the initial setup process of Splunk Cloud Platform is that you don't have to deploy your own Splunk Cloud Platform deployment; Splunk handles it for you. For the on-premises setup, you do need the initial configuration for end devices to send logs to Splunk Cloud Platform, but it's straightforward. It's just one package that you install on your end device, and after restarting, everything is sorted. There is no hassle in configuring Splunk Cloud Platform or getting on-premises devices to send data to it.

We do use Splunk Cloud Platform's alerting mechanism. We have set up hundreds and thousands of alerts for different use cases. For example, if any of the data sources stop the ingestion or the volume has been relatively quite down, we have set up alerting for that. It creates a ServiceNow incident that falls under our team's responsibility and sends an email as a notification that this alert has been triggered, such as when XYZ feed has gone down or the data from XYZ feed has decreased up to 80% or 70%, whatever the threshold set. We definitely use all the different alerting mechanisms and alert actions provided by Splunk Cloud Platform.

Whenever we see a situation where we don't want to be reactive, we attempt to do a predictive analysis of the data ingested in our Splunk Cloud Platform. This analysis depends on an alert-to-alert basis. For instance, when talking about a data source going down, if the situation arises, we should be triggered at a threshold of around 80% decrease. In that situation, we keep a buffer of 10% and alert ourselves to notify at a 70% decrease in the feed so that we can take preemptive measures to ensure that the feed comes back online before the situation escalates.

In terms of machine learning, we are using the Splunk-supported machine learning toolkit that also has new features for artificial intelligence. We do use them for outlier detection and predictive analysis in terms of different alerting we have enabled in our environment.

To predict trends in our data, the example I shared previously involves understanding if the volume is going down or not. We do this using the machine learning toolkit itself. We have our data ingested into Splunk Cloud Platform, and each index and source type has some dedicated volume getting ingested daily. We create an average of the total volume ingested over the past 60 days, 45 days, and 90 days, and then we identify the volume ingested yesterday. We compare it with the average of the last 45 days and try to detect any deviation. All of this is part of the machine learning toolkit application itself. That's how predictive analysis and outlier detection work, and we're using that in our daily operations as well.

With different vendors, there is no problem having Splunk Cloud Platform integrated with them. For example, we already have our alerting enabled so that whenever any alert gets triggered, an incident is created in ServiceNow. I have also worked on integrating Jira and other different Atlassian products with Splunk Cloud Platform. It's user-friendly and straightforward to integrate Splunk Cloud Platform with different vendors without much issue.

For any organizations looking to configure Splunk Cloud Platform, I believe it's a simple process. It's just important to stick to the fundamentals and understand how Splunk Cloud Platform operates. The documentation is quite clear. One notable advantage of Splunk Cloud Platform is the Ingest Processor and Edge Processor, which help optimize data before feeding into Splunk Cloud Platform. We've seen a reduction of around 40% to 60% in the total volume ingested using efficient data pipelines. We provide services for optimizing data pipelines and feeds, and those tools can be quite helpful. But if you're looking to configure Splunk Cloud Platform for on-premises servers, downloading the universal forwarder package from the Splunk Cloud Platform search head is all you need.

I would rate this product a 9 out of 10.

Currently, our main use cases for Splunk Cloud Platform involve using dashboarding and alerting most of the time.

We also have scheduled reports that run daily to feed data into those dashboards, and we are actively using alerts to notify in the Webex channels about any issues that have occurred in production on a real-time basis.

I appreciate the fact that you can quickly click and create dashboards and alerts without having to spend too much time writing SPL queries to get your results.

Additionally, the fact that it is so much faster than Splunk Enterprise allows us to see things churn quickly.

Since the time I joined this organization, Splunk has been a very important tool for collecting the logins and the events. My organization has been using Splunk Enterprise for a very long time, and very recently, we migrated from Splunk Enterprise to Splunk Cloud Platform. My role has been as an end user of Splunk to see how all the migrations have completed successfully. Now in my current role, I am responsible for creating alerts and dashboards in Splunk Cloud Platform to assist with all the monitoring in the production environment.

I cannot say what improvements can be made right now because we have just migrated to Splunk Cloud Platform. I wish I could say more.

I have been using Splunk Enterprise for almost seven years. With Splunk Cloud Platform, we have recently migrated, and it has been just over a month.

We have not seen benefits right away because we have just started to migrate to Splunk Cloud Platform.

We have been using Splunk Enterprise for a very long time, which has had its benefits, and now we want to migrate to the cloud to see how that can help us.

Splunk Cloud Platform's ability to scale is a very important feature because it aligns with our demand fluctuations, which is why we migrated to Splunk Cloud Platform.

Splunk Enterprise was not scaling as the demand for Splunk usage grew, leading us to face issues that encouraged our migration to Splunk Cloud Platform to support the additional usage from multiple users.

We now expect it to scale and help all additional users benefit from Splunk Cloud Platform.

I rate the customer service technical support for Splunk Cloud Platform at seven, primarily because we have been getting answers from a Splunk POC who has been on-premises helping us out.

However, we have had some delays in getting answers to certain issues we faced during migrations, which has taken some time and resulted in some churn to get resolutions.

Our team has primarily been using AWS services, and the entire team has been using it for all of the seven years we have been here.

Currently, our workloads vary from a very low client headcount early in the day to peak times during the evening hours when people are using more of the network.

Our top priority for using AWS Cloud includes having a lot of different advantages, one of the primary ones being the serverless concept. Instead of having fixed VMs where everything is being hosted, we are now hosted on the cloud, which alleviates worries about scaling our performance at scale. There are many different advantages for which we migrated from on-premises to cloud, including avoiding issues with failovers, which has been facilitated by using AWS.

For cloud migrations, you have to really be aware of what you need to migrate. You need to prioritize everything that you need to work with and also take into account everything that is being done step by step to ensure a smooth transition from your current on-premises resources to the cloud.

You need to start with prioritizing what you really need to migrate, beginning with a prioritizing list. From that point on, you take small steps to migrate whatever is important, followed by migrating the less critical jobs or aspects. Once the migration is done, you verify everything to ensure that your business-critical aspects are taken care of, and you are not missing anything.

My experiences with deploying Splunk Cloud Platform are relatively new, but I can discuss Splunk Enterprise, which has really benefited us significantly. We have been able to do a lot of analysis using Splunk, and we have gained a lot of insight into our applications through it.

Something interesting that happened at the conference before we started is that I went into a session not knowing what to expect, and I went into a completely wrong session that was about edge processor, which is not what I intended to attend.

When I checked my schedule, I realized this is not where I was supposed to be, and I did not even know how to configure Splunk edge processor, so it was a completely different session than what I planned.

Splunk Cloud Platform is used for enterprise logging, including infrastructure logs, application logs, and networking logs. It serves the entire enterprise with substantial ingestion coming in from different sources onto the platform.

Splunk Cloud Platform offers logging and Autologs specializations. Cloud logging is embedded as a birthright within Splunk Cloud Platform, so anything which is onboarded as a new asset, whether a device, an application, or a server, is getting enabled through Splunk Cloud.

Splunk Cloud Platform is deployed in the organization on public cloud. AWS is used as the cloud provider. Splunk Cloud Platform was purchased directly through a vendor.

The organization has everything within all the environments including cloud, on-premises, and a mix of other tools as well.

Splunk Cloud Platform offers logging and Autologs specializations. Cloud logging is embedded as a birthright within Splunk Cloud Platform, so anything which is onboarded as a new asset, whether a device, an application, or a server, is getting enabled through Splunk Cloud.

It has impacted positively because the entire enterprise logging is enabled within Splunk Cloud Platform, whether from servers, applications, network devices, and logs coming from other application tools or platforms.

Improved security has been achieved because a lot of security logs are ingested to Splunk Cloud Platform, where they are being used to identify security vulnerabilities and checkpoints. Splunk Cloud Platform does provide a lot of governance and security because many enterprise security teams are involved in using it.

Provisioning MCT access for all the application users and ensuring open telemetry is embedded with the AI-assisted capabilities in Splunk Cloud Platform will go a long way. The AI assistant for Splunk Cloud has just been started and looks promising, but more exploration is needed.

Splunk Cloud Platform has the ability to transform as the organization scales, but better visualization is needed to see how the data is being ingested, the volume that is being traversed, and the data management overall for the indexes.

The integrations need to be more proactive within Splunk Cloud Platform so that the organization can get into the data strategy and employ the broader teams.

Splunk Cloud Platform has been used for a couple of years.

Splunk Cloud Platform is stable because the organization is on the SaaS.

Splunk Cloud Platform is very much scalable.

The customer support is quite good, and the right level of engagement has been achieved.

Splunk Cloud Platform is the only solution being used for the logs.

The setup is easier because all the logs can be poured in one place and the queries can be indexed to get through with all those positions.

Time is saved because index queries can be provided to the application team, helping them see the logs during any troubleshooting.

Pricing for Splunk Cloud Platform is on the higher side, but the setup is very much acceptable, and it is good that observability cloud will be available in a few months.

No other options were evaluated before choosing Splunk Cloud Platform.

There is no major impact on financial planning for data platform investments, as there is a three-year deal with Splunk, so the organization should be good. The review rating for Splunk Cloud Platform is eight out of ten.