Splunk Cloud Platform Reviews

In my daily work as an SOC L1, my use cases involve using Splunk Cloud Platform primarily for centralized log management and real-time incident detection. It acts as our central nervous system for security data. We stream logs from our other tools such as Wazuh directly into Splunk Cloud Platform, and the biggest use case for us is the speed of investigation. When an alert comes in, I can search through a massive amount of data in seconds to trace exactly what happened. It helps us to visualize the attack chain and prioritize what actually needs attention.

The biggest thing I appreciate about Splunk Cloud Platform is the stability of this platform. It is always up, and I have never had to worry about maintenance or downtime interrupting my shift. Search performance is another huge advantage, allowing me to query massive data sets in seconds when I am hunting for a specific log.

Since we are using Splunk Cloud Platform, the initial deployment is easy because we do not have to deal with the back-end infrastructure, which is a huge relief. It is a true SaaS experience, so you are not spending time patching servers or worrying about hardware capability. For me as an L1, the deployment part is really about onboarding our data sources. Once you have the connector set up pulling the logs from device endpoints and other tools such as Wazuh, it is fairly smooth.

For me as an analyst, maintaining Splunk Cloud Platform is really about keeping the data pipeline healthy. My focus is on making sure our Universal Forwarders are pushing data properly from our endpoints or other tools. I also keep an eye on index health and manage our retention policies so we do not exceed our storage systems.

About the app ecosystem within Splunk Cloud Platform, instead of us having to spend hours or days manually figuring out how to parse logs or map them to a common information model such as CIM, we can usually grab the right app from Splunkbase, and it does the heavy lifting for us, normalizing the data so that when I run a search, the fields are already in a structured and searchable format. It saves me so much time in day-to-day investigations, and because I do not have to worry about whether the log format is broken, the app handles that translation.

About visibility within Splunk Cloud Platform, the hybrid visibility is actually one of its strongest points. Since we handle a mix of environments for our clients according to their requirements, being able to pull everything into one central place is critical for us. We use Universal Forwarders on our on-premises servers to securely stream logs up to the Splunk Cloud Platform instance. For me, it effectively erases the boundary between on-premises and cloud. It does not matter if the log is coming from a server in our local data center or a cloud-hosted app. It all lands in that same single pane of glass.

The biggest downside about Splunk Cloud Platform for me is the cost. It is definitely on the expensive side, and you have to be very careful about what you ingest from sources. We are always mindful of our log volume because if you are not constantly tuning your filters or managing what data goes in, the cost can add up fairly quickly.

In terms of scalability, Splunk Cloud Platform is one of the things that makes my L1 task much easier. As we onboard more devices or increase our log ingestions and stay ahead of threats, I never have to worry about the platform hitting the wall. With Splunk Cloud Platform, it just handles it. I have noticed that even when we ramp up the data from other tools such as Wazuh or add new endpoints, the search speed remains really consistent. It does not get sluggish or slow down, which is huge when I am in the middle of an investigation.

We have a team to contact for technical support for Splunk Cloud Platform. I have not really been involved in that technical support phase, and I do not have much knowledge about that process or what is going on in the background. I would give around an eight out of ten for technical support for Splunk Cloud Platform.

I have not currently used any alternatives to Splunk Cloud Platform. I have not gained hands-on experience with other cloud platforms.

I would give Splunk Cloud Platform an 8.5 overall rating for everything. We are a customer of Splunk Cloud Platform.

Public Cloud

Correlation searches and search indexing queries in Splunk Cloud Platform are very valuable and quite useful for my daily work.

Splunk Cloud Platform's search capabilities are quite effective in uncovering operational insights. I was searching for one of the accounts related to backup, and I was not able to search in any other tool. Since we are collecting data from all different sources, I was able to trace this out. It was a request made from the customer because we reported a notable event from Splunk, and they asked us to check this account if we were able to see it, as they had checked from their end and were not able to search it. Using the indexing, I pulled the account details and shared them, and we concluded it was a false positive.

I do use Splunk Cloud Platform's alerting mechanisms. The alerting mechanisms have helped in proactive issue resolution because we receive alerts directly to our SOC mailbox, which we have fine-tuned based on our findings and customer involvement. Initially, we received a lot of notables that were not fine-tuned well, but now we receive approximately twelve to fifteen notables, and once we get alerted, we work on them. For instance, when we detected suspicious activity on a backup account, we responded back to the customer within three minutes, which they found interesting. We were able to dig further into a unique account and provide them with the necessary information, which was corroborated by their technician.

Splunk Cloud Platform's search capabilities are quite effective in uncovering operational insights. I was searching for one of the accounts related to backup, and I was not able to search in any other tool. Since we are collecting data from all different sources, I was able to trace this out. It was a request made from the customer because we reported a notable event from Splunk, and they asked us to check this account if we were able to see it, as they had checked from their end and were not able to search it. Using the indexing, I pulled the account details and shared them, and we concluded it was a false positive.

I do use Splunk Cloud Platform's alerting mechanisms. The alerting mechanisms have helped in proactive issue resolution because we receive alerts directly to our SOC mailbox, which we have fine-tuned based on our findings and customer involvement. Initially, we received a lot of notables that were not fine-tuned well, but now we receive approximately twelve to fifteen notables, and once we get alerted, we work on them. For instance, when we detected suspicious activity on a backup account, we responded back to the customer within three minutes, which they found interesting. We were able to dig further into a unique account and provide them with the necessary information, which was corroborated by their technician.

Splunk Cloud Platform's integrations with third-party tools have had quite an easy impact on my daily operations. Initially, the outdated threat intelligence led to notable IP addresses going undetected. However, after integrating Talos and VirusTotal, we can quickly determine whether an investigation requires immediate attention or a deeper analysis, which has saved us considerable time. When we implement the SOAR solution in August, I expect we can provide even more details about integration with third-party intelligence platforms.

Splunk Cloud Platform's user interface is quite simple and needs to be updated; it feels as if I am using a platform from two thousand fifteen. However, I do appreciate the new feature for starting investigations, which allows us to save our work for later analysis.

I would like to see improvements in the UI, and while I recall that Cisco has acquired parts of Splunk, I would love to see more integration with threat intelligence platforms like VirusTotal, which are widely used. Currently, to implement VirusTotal, we have to purchase it, whereas we use Talos, but we mostly rely on AbuseIPDB and VirusTotal in the SOC.

I have been dealing with Splunk Cloud Platform for two and a half years.

I have no problems with technical support at all. We connect with them often, and when we have issues, we raise a ticket and schedule a call. Generally, we find a resolution during that same call, which is quite efficient.

I would rate their technical support as eight out of ten.

There is still some room for improvement regarding response time and first-level support quality. While responses are typically received the same day, the analysis process can take time.

Initially, the setup was tough for us, but now that we have become familiar with Splunk Cloud Platform, I find it quite simple. However, newcomers may still face difficulties.

Regarding Splunk Cloud Platform's machine learning tools, we are not currently exploring the XDR solution or SOAR solution part but are planning to move from SIM to SOAR this coming August. We have implemented Cisco Talos as a threat intelligence platform, and we also included VirusTotal.

I have created approximately one hundred reports for different users since we fetch data from various sources. Each team has different requirements, whether it is for Trend Micro, M365, Zscaler, or Okta, and I have organized these reports on a dedicated dashboard. It is quite useful for them, and they regularly come up with new requests that we incorporate into the dashboard.

When it comes to pricing, I would say it is a bit more than fair—more than competitive. Compared to Microsoft, which is cheaper, Splunk Cloud Platform is a bit expensive. However, relative to Trend Vision One or CrowdStrike, the pricing is comparatively lower.

We have a lot of documentation available, which I feel is adequate. Each solution, including CrowdStrike and Trend Micro, has its documentation, and it is about how well one handles it based on their experience.

My overall review rating for Splunk Cloud Platform is eight out of ten.

Public Cloud

Other

I use Splunk Cloud Platform as our overall tool to gain insight from our platform, for our security use cases, and to build a framework that shows what is happening in our organization or what is happening in our applications, the current status, or if we are facing any issues with our systems. I ingest various types of logs from different systems to Splunk Cloud from our forwarders and build dashboards and alerts on top of that. My primary use case is to understand our architecture or our overall environment, including what is happening and whether there are any vulnerabilities, or to conduct analysis on our applications. If there are any performance issues, I can learn about them from the dashboards that we have built and can optimize our architecture or overall application performance.

What I like about Splunk Cloud Platform is that it gives me flexibility and freedom in that I do not need to worry about the actual architecture of Splunk. I do not need to install it anywhere manually, and I only need to worry about what data I need to ingest and how I will create a dashboard on top of that. It provides support so I do not need to worry about the platform. It functions as Software as a Service, so I can directly use it and if I am facing any issue, Splunk support is available to help me anytime.

I do not have any limitations with Splunk Cloud Platform. I can access it from my own private network or anywhere, and I can access it from the public network as it is on a cloud. That is also a plus point for me.

In terms of assessing the effectiveness of Splunk Cloud Platform's search capabilities in uncovering operational insights, its storage capability is excellent. Previously, we were managing it at an enterprise level, but it was costly to us because of data redundancy and the availability zones. With Splunk Cloud Platform, we do not need to worry about data backup, which is a very good point.

The alerts have helped us in proactive issue resolution. If we are currently getting any error, we will get notified in the next 15 minutes or 30 minutes according to the schedule of the search.

Splunk Cloud Platform's ingest and visualization features have helped improve our data reporting, truly the best available in terms of customizability. We have two options, classic and Dashboard Studio for dashboard purposes. In classic, we get options to build custom dashboards using custom JavaScript. We can insert our own graphics to provide better visuals where insights to our management team will not be dependent on the numerical base. We have charts to showcase our current situation, which will be really great for management.

In terms of benefits, if we were needing two persons for SAP to analyze if we have any issues, now we just need one person doing multiple tasks. We have built an automation system, or a dashboard, which gives us insight so that we do not need to go and look up every service. Splunk Cloud Platform really impacted our workflow and increased our productivity.

In Splunk Cloud Platform particularly, there is nothing specific that I would like to see improved or enhanced, but the cost is currently very high. If that part could get a little bit cheaper, then that would be really great.

In terms of enhancement for Splunk Cloud Platform, I would say if we could create add-ons or if we get the capability to build add-ons directly through cloud, not talking about the add-on builder framework, but something editor-like where we will directly edit our conf files from any specific app or TA provided by Splunk Cloud Platform itself. If we get that feature, it will be really beneficial. Instead of doing configuration from the UI, we would prefer to get access to back-end conf files and do it manually because when we were using enterprise, we had pretty much hands-on experience with that.

I have been using Splunk Cloud Platform for around two years.

I would evaluate customer service and technical support of Splunk as really good. They provide on-call support and they reply to cases that we open, so the support is really good and collaborative.

We have not previously used a different product. We have tried other tools, but they were very limited to the use cases that we are trying to capture. I chose to go with Splunk Cloud Platform because it has vast capabilities.

The initial setup with Splunk Cloud Platform was really straightforward because, as it is a cloud platform, Splunk provided us the complete package where we do not need to worry about our infrastructure or configuration. If we need any help, they are always available, so it was very straightforward.

The implementation was done by the Splunk team.

We evaluated products like Dynatrace or DataDog, which were very specific. They were providing us only observability-specific tasks. However, we have some VML logs or firewall logs for which we would not get that much analysis from those products. That is why we chose to go with Splunk Cloud Platform.

We use Splunk default alert actions and we have installed third-party integrations, such as ServiceNow integration, where we are creating ServiceNow incidents or ServiceNow tickets from our alerts.

The impact of Splunk Cloud Platform's integrations with third-party tools on our daily operations is very helpful for our overall infrastructure monitoring. We have third-party integrations, such as SAP or Dell Boomi. To ensure that our SAP and site integration are running smoothly and none of its API is getting high or something unusual, we can easily detect that instead of going into SAP and analyzing.

We have our own machine learning logic where we are creating alerts based on our machine learning algorithm. If we are missing any data from the forwarders, then we have a built-in threshold mechanism where if the data from the last seven days is coming around 80 GB, then the next day it should be getting related to that. If we are not getting that, then we will get alerts. I have not particularly used Splunk ML Toolkit.

From the features perspective, I would say if we were getting calls from back two or three months, I was waiting for the Otel feature in Splunk Cloud Platform. Now we have support of Otel in the current latest Splunk version, so we are planning to upgrade Splunk Cloud Platform to the latest. The feature that I was looking for is now currently available, so I do not have anything specific at the moment.

In terms of pricing, the cost is high, but we are getting pretty much value out of what we are paying and what should be available to us in the market. In terms of that, it is really good with no question on that.

My advice to other organizations considering Splunk Cloud Platform is to make sure you use it as much as you can. There is a really big community of Splunk that you can explore to see what data you can ingest. There is a possibility you are already using other services from which you can get logs into Splunk and build analysis on top of that. Do not limit yourself to any specific use cases. I have seen some organizations only ingest specific logs, such as firewall logs or DNS logs. But they have different types of machines and applications running for their infrastructure. They can ingest logs from those as well and build analysis on top of that. There are pre-built add-ons that provide that functionality to them and they do not need to worry about development. So use it as extensively as possible. Overall, I would rate this product a nine out of ten.

Public Cloud

Other

Splunk Cloud Platform serves as our main platform to bring all our log and machine data into one place so that we can easily monitor, troubleshoot, and investigate issues. On a daily basis, we collect data from different sources including applications, servers, security tools, and cloud services. Whenever an issue occurs, instead of checking multiple systems manually, we use Splunk Cloud Platform to search events, compare timelines, and understand exactly what happened. For example, if an application error or suspicious activity occurs, we can quickly check related logs, identify the affected systems or users, and take action faster. Beyond troubleshooting, we also use it for dashboards, alerts, security monitoring, and operational insights so that our team can detect problems earlier rather than reacting after users are affected.

The most valuable features I found in Splunk Cloud Platform are mainly the search capabilities, dashboards, and alerting system. The biggest advantage for me is the SPL search capability. When investigating issues, I can quickly filter millions of events, connect different logs together, and find the root cause without manually going through multiple systems. Another feature I really value is custom dashboards. We create dashboards for system health, security events, and application monitoring which give the team a quick overview of what is happening. Real-time alerting is also very useful because we do not have to continuously watch logs, and Splunk Cloud Platform automatically notifies us when unusual activity or failure happens. Since it is a cloud platform, we do not spend much time managing servers or upgrades, which allows us to focus more on analysis and solving issues.

The biggest benefit we have seen from Splunk Cloud Platform is that it has made troubleshooting and monitoring much faster. Previously, when issues happened, we had to check multiple systems separately to collect logs and understand the problem. Now with Splunk Cloud Platform, everything is available in one place so we can quickly search across different data sources and find the root cause. Another benefit is better proactive monitoring. With dashboards and alerts, we can identify unusual behavior or failure earlier instead of waiting for users to report problems. It has also reduced operational workload because Splunk Cloud Platform manages the cloud infrastructure, updates, and maintenance, allowing our team to spend more time improving security and reliability rather than managing the platform itself.

The overall experience is positive, but there are a few areas where I think Splunk Cloud Platform can improve. One area is the learning experience for new users. Splunk Cloud Platform is very powerful, but understanding SPL queries, data models, and advanced features takes time. More guided recommendations or AI-assisted query building would make onboarding easier. Another area involves cost visibility and optimization. Since the environment generates a lot of data, having simpler ways to understand usage patterns and optimize ingestion would help teams manage expenses better. I also feel that some advanced configuration and troubleshooting options could be made more self-service in the cloud environment so that teams can make changes faster without depending on support. These are not major issues, but improving them would make Splunk Cloud Platform even easier to adopt and manage.

I would not say that there are any missing functionality features, as Splunk Cloud Platform already covers most of our monitoring and analytics requirements. However, there are some areas that would improve the experience. One thing I would suggest is more built-in intelligence for query creation and troubleshooting. SPL is very powerful, but having more AI-based suggestions for building searches and optimizing queries would help users work faster. Another area is automated data optimization recommendations, such as suggestions on which logs are less valuable, which searches are expensive, or where we can improve performance. Additionally, more ready-made dashboards and use case templates for common scenarios would help teams get value faster without building everything manually. Overall, the core functionality is strong, but more automation and guidance will make Splunk Cloud Platform even better.

I have been working with Splunk Cloud Platform for around 1.5 to 2 years.

Overall, we have not faced any major performance issues with Splunk Cloud Platform. The platform has been stable and handles large amounts of data quite well. Search performance, dashboards, and alerts generally work smoothly even when working with high volumes of logs from different data sources. The only times performance can be affected is when searches are not optimized. Running very broad queries across a large time range can take longer, for example. However, this is usually improved by following best practices such as optimizing SPL queries, using the proper index, and managing data correctly. From my experience, performance depends not only on the platform but also on how well the data and searches are designed. Overall, it has been reliable for our cases.

From my experience, Splunk Cloud Platform scales very well as the organization grows. As we add more applications, users, or data sources, we can continue bringing that data into Splunk Cloud Platform without worrying about managing additional infrastructure. The platform allows us to expand gradually. We can start with important logs and later add more sources based on business needs. The biggest improvement we noticed is that even with increasing data volume, the team still has one central place to search, monitor, and analyze information, which helps maintain visibility as the environment becomes more complex. Because Splunk Cloud Platform manages the cloud-side capabilities and updates, scaling becomes much easier compared to maintaining everything ourselves.

My experience with customer service and technical support has been positive overall. The support team is knowledgeable, especially when it comes to troubleshooting platform issues, configuration questions, or best practices. The documentation and community resources are also very helpful because many common problems already have detailed solutions available. For normal issues, responses are usually quick and we are able to resolve things without much delay. For more complex technical problems involving custom configuration or deeper investigation, it can take a little longer and requires escalation to a specialized team. Overall, I would say the support experience is reliable, and the combination of official support, documentation, and community makes it easier to manage Splunk Cloud Platform.

I have also worked with and evaluated tools such as CrowdStrike Falcon LogScale and Elastic Stack for similar log management and analytics use cases. Falcon LogScale is very strong when it comes to fast searching and threat hunting, especially for security-focused work. It provides very quick performance and is lightweight for analyzing large amounts of data. Elastic Stack is also flexible and provides good search and visualization capabilities for teams looking for more customization. Where Splunk Cloud Platform stands out is its overall maturity, ecosystem, and ability to support multiple teams and use cases from a single platform. It is not only for security; we can use it for operations, application monitoring, troubleshooting, and business insights. The strong integration, dashboard, SPL capabilities, and managed cloud experience were the main reasons Splunk Cloud Platform was a better fit for our environment.

The initial setup of Splunk Cloud Platform was quite straightforward compared to traditional on-premises deployment. Since Splunk Cloud Platform manages the cloud infrastructure, we did not have to spend time setting up servers, storage, or handling backend maintenance. Most of our efforts focused on connecting data sources, configuring inputs, creating indexes, and setting up dashboards and alerts. The basic deployment was smooth, but the important part was planning the data onboarding properly, deciding what logs to collect, how to structure them, and setting permissions for different teams. There was a small learning curve in the beginning, especially around SPL queries and optimization. Once the foundation was ready, managing and expanding Splunk Cloud Platform became much easier. Overall, the setup experience was smooth and manageable.

We mainly handle Splunk Cloud Platform setup in-house with our internal team because it is a managed cloud platform. The infrastructure side is already handled by Splunk. Our team focused on the actual implementation work, including connecting data sources, setting up indexes, configuring dashboards, and creating alerts and managing user access. For some best practices and documentation, we referred to Splunk resources, but day-to-day configuration and customization we managed internally. Overall, having an in-house setup worked well because the cloud model reduced a lot of infrastructure complexity.

We looked at a few alternatives such as Elastic Stack, Datadog, and CrowdStrike Falcon LogScale before going with Splunk Cloud Platform. Each tool had its own strengths. Datadog was good for cloud monitoring, Elastic provided flexibility, and Falcon LogScale performed very well in high-speed log searches. The reason we preferred Splunk Cloud Platform was that it gave us a more complete solution. We needed something that could handle security monitoring, operational troubleshooting, dashboards, and analytics together instead of using different tools for different teams. Another important factor was Splunk's maturity and ecosystem. The availability of integrations, apps, documentation, and community support made this option more attractive. For our use case, Splunk Cloud Platform provided the right balance of scalability, reliability, and flexibility.

My advice would be to plan your data strategy before starting with Splunk Cloud Platform. Splunk Cloud Platform is very powerful, but the value you get depends on how well you organize your data sources, indexes, and use cases. Do not try to bring every log into Splunk Cloud Platform from day one. Start with the most important systems, create useful dashboards and alerts, and then expand gradually. I would also recommend investing some time in learning SPL and best practices because that is where you can really unlock the power of Splunk Cloud Platform. Overall, Splunk Cloud Platform is a great solution, especially for organizations that need strong visibility and analytics without spending time managing infrastructure. I rate this product a 9 out of 10.

I am also an end user of Splunk Cloud Platform. My usual use cases for Splunk Cloud Platform are to search logs and search data as I need for my security incidents. Searching logs and data for security incidents is my main use case.

The most valuable features or capabilities of Splunk Cloud Platform that I have found so far are mainly the search and the indexing engine, and I also find the data management of Splunk better. I have used both Splunk Enterprise and Splunk Cloud Platform, and I feel that the data management on Splunk Cloud Platform is handled by the Splunk team with much better expertise than its Enterprise Platform, where we had to manage storage and everything ourselves.

The effectiveness of Splunk Cloud's search capabilities in uncovering operational insights is pretty good. Once you know Splunk Query Language, or SPL, it is way better than any other data management tool, especially when analyzing and monitoring security logs, as it makes searching and minimizing threats much easier for me.

I use Splunk Cloud's alerting mechanisms to send alerts to my email, whether something happens in real-time or through scheduled Splunk query alerts for operational tasks like security incidents or operational warnings, such as when my storage is 90% full.

Splunk Cloud Platform's ingest and visualization features have helped me improve my data reporting significantly, as data ingestion and visualization are great, especially for creating dashboards from various sources like endpoints, firewalls, and web applications.

Operationally, Splunk Cloud Platform has provided wide observability where we had almost none before, significantly improving our security posture and our ability to defend the organization.

In my opinion, there isn't much to improve in Splunk Cloud Platform, but one suggestion would be to integrate AI or provide a more graphical query builder to reduce the learning curve for new users wanting to learn SPL.

I have been working with Splunk Cloud Platform for around eight months.

I rate Splunk Cloud Platform a ten out of ten for stability and reliability, as I have found it truly reliable while using it on AWS and as a SaaS platform, given the capability for high availability and multiple indexers ensuring data continuity.

I would rate Splunk Cloud Platform a nine out of ten for scalability. I think it's scalable due to the ease of integrating and deploying multiple indexers for data processing, although it does require some technical knowledge to configure properly for smooth operation.

I do not often communicate with the technical support of Splunk Cloud Platform. I often visit Splunk's documentation portal for troubleshooting and assistance with my queries, and I find it quite good. They offer videos to help users learn how to use Splunk and Splunk Query Language.

I feel that Splunk's documentation is highly maintained, regular updates seem to happen, and I don't have any suggestions for improvement as it is currently at its best.

Positive

I did not use a different solution for the same use cases prior to Splunk Cloud Platform. I only used Wazuh for security data logging but would not compare it to Splunk due to its broader capabilities.

I did participate in the initial setup and deployment of Splunk Cloud Platform, but I wasn't part of the decision-making aspect. The initial setup process for deploying Splunk Cloud Platform was quite easy as we only needed to identify our data sources and determine the appropriate ingestion method, followed by some technical configuration, assuming we knew how our data was structured.

I might not be the right person to comment on the return on investment in terms of cost, but operationally, Splunk Cloud Platform has provided wide observability where we had almost none before, significantly improving our security posture and our ability to defend the organization.

I did not evaluate other options or vendors before choosing Splunk Cloud Platform. I did not participate in the decision-making process for choosing Splunk Cloud Platform, as I have worked operationally with it but was not involved in procurement.

I have not used Splunk Cloud's machine learning tools. I do not personally integrate Splunk Cloud Platform with third-party tools; however, I know that my separate team has integrated quite a few tools, leveraging Splunk's vast library known as Splunk Enterprise Applications.

I have been working with Splunk Enterprise Platform, which is the on-premises version of Splunk Cloud Platform, and it is almost the same except for the maintenance efforts required and the deeper learning curve. I wouldn't say there's room for improvement in Splunk Enterprise Platform purely regarding the search engine, as it largely depends on the resources allocated to the indexer for its performance. I have been working with Splunk Enterprise Platform for approximately three to four months.

Public Cloud

Amazon Web Services (AWS)

My main use case for Splunk Cloud Platform includes observability, log management, alerting, dashboarding, and serving as a centralized logging platform.

We have multiple customers in the company that forward their logs to Splunk Cloud Platform, and I help them onboard their applications, as well as creating their dashboards and alerts on Splunk Cloud Platform. I also use the Model Context Protocol, the Splunk MCP server, so that they can use the Agentic AI, as well as their Q and Cloud CLIs to query the platform using MCP.

The best features Splunk Cloud Platform offers include accessibility, uptime, redundancy, availability, and ease of use.

I find myself relying on availability the most day-to-day, as well as the features that are available such as MCP.

Splunk Cloud Platform has positively impacted my organization because earlier we were an on-premise enterprise having issues with availability and management. The cloud platform has made availability much better, and customers love the experience as it is very quick and responsive.

Uptime has significantly improved since moving to Splunk Cloud Platform, as well as the support that we get from our support peers at Splunk and Cisco, which is very helpful. The availability of the platform in general has improved, and queries run faster.

Splunk Cloud Platform can be improved by providing dedicated documentation, especially regarding the edge processors and MCP, along with continuous updates. Sometimes the model we face gets updated without notifying us, so we need proactive notifications if something is being changed on the back end to notify customers before they see issues.

I have been using Splunk Cloud Platform for six months.

Splunk Cloud Platform is stable most of the time.

Splunk Cloud Platform is highly scalable.

The customer support is rated eight out of ten.

Earlier, we were using a fully on-premise solution, and therefore we had all our servers, search heads, and indexers managed by us. Now we have moved to the cloud.

We did not purchase Splunk Cloud Platform through the AWS marketplace because we already had a license with Splunk Cloud Platform running the enterprise license, and we just migrated it to the cloud.

I cannot share metrics, but we have seen a return on investment.

I did not evaluate other options before choosing Splunk Cloud Platform.

I would rate Splunk Cloud Platform a 10 out of 10.

I chose this rating because the issues we were seeing previously with the on-premise platform are now much better handled, and we do not see them anymore. We do see some new issues occur, but we are learning as we go.

Regarding Splunk Cloud Platform's AI capabilities, I have not used its governance and security features, but I have appreciated the ability to secure data.

The accuracy of Splunk Cloud Platform's output is very good, and the reliability is always also very good.

My impressions of Splunk Cloud Platform's visibility into multiple environments are that we are completely on cloud. Earlier, we were on-premise, and while I have not used Splunk Cloud Platform in a hybrid environment or an on-premise environment, we truly love the cloud environment as it enhances the availability and speed of the platform, and the support provided is very useful.

Regarding Splunk Cloud Platform's zero setup feature for AI models, it works in the best way possible because it is very quick.

My experience with Splunk Cloud Platform's app ecosystem is that it is very easy to manage updates within this ecosystem.

The platform's ability to scale aligns very well with my organization's demand fluctuations, and this has a positive impact on our IT resources as it is very scalable, allowing us to deploy apps very quickly. As the organization demand grows, we can make that happen very quickly too, so the turnaround for customers is very quick.

I use a hybrid of native models over third-party integrations in Splunk Cloud Platform's environment, as some third-party integrations are much more resilient and much more developed than Splunk Cloud Platform's native integrations.

I would highly advise Splunk Cloud Platform to all other users or customers. I recommend they ensure that their support with Splunk and Cisco folks has been confirmed and documented appropriately. Documentation needs to be improved, but the platform overall is very stable and very useful. My overall rating for Splunk Cloud Platform is 10 out of 10.

Public Cloud

Amazon Web Services (AWS)

My main use case for Splunk Cloud Platform is security operations. For security operations, we ingest all internal logging into Splunk Cloud Platform, and that's where we get and do all of our internal review for malicious activity.

The best features Splunk Cloud Platform offers include its overall usability, which is good, as well as the native connectors with other applications that help in getting data from major applications like Okta and more. Additionally, features related to identity and asset management are also beneficial.

Splunk Cloud Platform has positively impacted our organization by allowing visibility into our organization in a positive light. It has also provided a central logging source for many of our applications, which has been good. It has improved incident response time as our partnering SOC uses the platform to surface alerts, reducing time. In terms of compliance, it serves as a source of audit evidence and allows us to ingest and hold logs longer than other apps natively hold.

Splunk Cloud Platform is on the pricier side for ingest and storage costs. There are many different features and things to use, with many built well. However, certain areas could improve usability, making it more applicable across different companies and more adaptable to various situations rather than being targeted to a single use case. Usability could improve in certain areas, including AI feature enhancements, and I find myself gravitating towards using Claude rather than Splunk Cloud Platform app or UI itself. Ingesting and storing data within Splunk Cloud Platform is expensive.

From my experience with Splunk Cloud Platform, the accuracy and reliability of output are relatively low when creating SPL and using it to find trends within the ingested data. I have seen better accuracy with the MCP, but the native AI capabilities within the console are not very accurate.

Over the last three years since our last contract, we've gone from 100 gigabytes of ingest to 300 gigabytes of ingest. In terms of scaling with the company, we have repeatedly hit the issue of trying to get as much data in as possible while being cost-conscious. Therefore, we're at a borderline of it being able to scale and it not scaling.

I have been using Splunk Cloud Platform for two years.

I find Splunk Cloud Platform to be stable.

Splunk Cloud Platform is scalable.

The customer support is pretty timely. I would rate the customer support a seven out of ten.

I have not previously used a different solution.

I think we're on the verge of seeing a return on investment with AI capabilities, especially related to AI-generated AI SOC or replacing our SOC needs. In the past few years, the return on investment has been mainly observed in the visibility aspect, but I wouldn't say there's been much impact on human or job duty aspects so far.

I have not dealt with pricing, setup cost, or licensing myself, but I have heard secondhand about our involvement with pricing and our last license increase.

Before choosing Splunk Cloud Platform, I did not evaluate other options.

Regarding governance and security in Splunk Cloud Platform, I think it provides a reliable source for audit logs and allows evidence to be tied out for compliance items.

Splunk Cloud Platform is deployed in our organization using a public cloud. We use AWS as our cloud provider. I don't think we purchased Splunk Cloud Platform through the AWS Marketplace.

I can only speak to the visibility into cloud environments, as I don't have experience with on-premises or hybrid setups. I have not had any experience with the zero-setup feature for AI models in Splunk Cloud Platform.

Our perception of using native models over third-party integrations in Splunk Cloud Platform's environment is that we have specific models approved for our data, which is the main focus of our strategy.

My experience with Splunk Cloud Platform's app ecosystem is that updates are pretty simple, and I haven't had any issues with that. Overall, the experience is pretty fluid.

My advice for others looking into using Splunk Cloud Platform is to understand the data you want to ingest and also consider if there are other tools that could better search a large amount of data for your needs, as it depends on the size of the company and the overall staff. I would rate this product an eight out of ten overall.

Public Cloud

Amazon Web Services (AWS)

Currently, we are using dashboarding and alerting as our main use cases for Splunk Cloud Platform. We also have scheduled reports that run on a daily basis to feed data into those dashboards. We are actively using alerts to notify in Splunk Cloud Platform are monitoring, alerting, and all the notifications for the applications that we are hosting in production.

What I appreciate most about Splunk Cloud Platform is the ability to click and create dashboards and alerts very quickly without spending too much time writing SPL queries and getting results. Additionally, the platform is much faster than Splunk Enterprise, allowing us to see things churn quickly.

Splunk Cloud Platform's ability to scale aligns very well with our demand fluctuations, which is why we migrated to it. Splunk Enterprise was not scaling as our demand for Splunk usage grew, and we started experiencing issues with Splunk Enterprise. We migrated to Splunk Cloud Platform to support the additional usage from multiple users, and we are now expecting it to scale and help all the other additional users benefit from Splunk Cloud Platform.

I cannot provide detailed feedback on areas for improvement at this time because we have just migrated to Splunk Cloud Platform.

I have been using Splunk Enterprise for almost seven years, and for Splunk Cloud Platform, we have recently migrated approximately one month ago.

On a scale of one to ten, I would rate the customer service experience at seven because we have been receiving answers directly from a Splunk POC who has been on-premises helping us out. However, we have experienced delays in getting answers to some of the issues that we faced during migrations, and that has taken some time to get resolutions to, which is why I am rating it at seven.

Something interesting that happened at the conference before we started is that I went into a session not knowing what to expect, and I went into a completely wrong session. When I checked my schedule, I realized this was not where I was supposed to be.

The session was about edge processor, and I did not know how to configure Splunk edge processor. It was a completely different session than what I had planned.

Since I joined this organization, Splunk has been a very important tool for collecting logins and events. We have been using Splunk Enterprise for a very long time, and very recently, we migrated from Splunk Enterprise to Splunk Cloud Platform. My role has been as an end user of Splunk to see how all the migrations have been completed and everything has been done successfully. In my current role, I am responsible for creating alerts and dashboards in Splunk Cloud Platform to assist the production environment and all the monitoring in the production environment.

We have not seen benefits right away because we have just started to migrate to Splunk Cloud Platform. We have been using Splunk Enterprise for a very long time. Splunk Enterprise has had its benefits, and now we want to migrate to cloud to see how that can help us.

My experiences with deploying Splunk Cloud Platform are that it is relatively new for us, but I can speak about Splunk Enterprise. Splunk Enterprise has really benefited us. We have been able to do a lot of analysis by using Splunk, and we have gained a lot of insight into our applications by using it. I would rate this review at nine overall.

Public Cloud

Amazon Web Services (AWS)

We use Splunk Cloud Platform for security and want to implement it as a SIEM solution. We also want to replace our old legacy SIEM solution because we are adopting a cloud solution instead of an on-premises solution. Another use case is that we want to use this tool in our managed service offering. We do not use the solution to resell licenses to our customers, but rather to provide services to them. We appreciate the powerful integration that Splunk Cloud Platform offers, making it easy to integrate with any sources and any data. It is able to handle data that resides in an S3 bucket or elsewhere, not just ingested directly into the SIEM itself. We are also looking at Splunk Cloud Platform's strategy, which is very interesting because of the integration they will have regarding Agentic AI and automation. A unique solution for orchestration and automation, called SOAR in cybersecurity, combined with SIEM in a unique platform is a very interesting strategy from our point of view.

It is Enterprise Security in the cloud. This is a cloud solution.

Splunk Cloud Platform is a very mature solution and an enterprise-grade solution that brings the work we have to do with customers to an enterprise-grade level. It is something that we can manage from a single pane, and it is quite easy to deploy. I see a benefit that is not strictly related to the features that Splunk Cloud Platform offers, but it depends on the company belonging to Cisco now because we are a Cisco partner and Splunk Cloud Platform is a pillar, a vertical technology in the security area of the partnership. The benefit of partnering with Splunk Cloud Platform falls into the Cisco partnership and the benefits we can have in this important partnership we have as a company.

Compared to my previous situation, the first benefit of this solution is the speed and the effort reduction in terms of onboarding new customers and maintaining the entire platform. I will not have any more effort for system upgrades and infrastructure maintenance. This is one of the biggest benefits I can have from the solution. I save a lot of money because I do not have to spend resources anymore to maintain and operate the infrastructure and the systems.

I think it is really effective, and we are still at the beginning. The capability to search for insights is very powerful and also supported by AI and machine learning. The capabilities are increasing day by day, and new features are being released and will be released soon.

I am not able to answer right now, but I am confident they will be able to predict a trend because they promise they are able to do this using machine learning algorithms and Agentic AI features. They say they will be able to predict the behavior of your network or your infrastructure. I am really confident about this, and I hope it will be true because I need this.

There is something that they say will be improved, and I am still waiting for it. This is the Agentic AI elements inside the platform that I mentioned before. There is something present today, but the full feature is not released yet. From my point of view, it is a bit late. It is okay for me because we are adopting it and we can work on this, and it is acceptable for my timing. However, from a market perspective, they are a bit late. Competitors in some cases are earlier adopters. But I am sure they will release a very powerful tool, as per the Cisco approach. They want to win when they start doing something, and I am confident they will release a very powerful tool.

I have been working with it for one month.

It is still a bit early to answer. We have just seen it on paper, and we have to check it.

In my previous experience, I had enterprise security, but on-premises a few years ago, three years ago. It was integrated with another SOAR from another vendor.

It is something that we can manage from a single pane. It is quite easy to deploy.

Compared to my situation, it does not have any meaning because I have something legacy now. However, it is a good price on the market. It depends because if you look at the list price, it is a bit expensive from my point of view. But once you are in the partnership with Splunk Cloud Platform and with Cisco, you can have good discounts, you can make the deal and discuss, and they are willing to help you as a partner in finding the solution and finding your target. So it is good from my point of view. But if you look at the list price, it is expensive.

We evaluated QRadar, FortiSIEM, and Palo Alto SIEM. We chose Splunk Cloud Platform because of a combination of different aspects, not just for price or features. It is the whole combination of the features, the benefits, the cost, the partnership, and there is no one aspect leading the choice. It is a mix and a combination.

Today, we are working with the SIEM solution, which is quite a legacy term. Saying SIEM is not really effective. It is the Enterprise Security solution, and we are now in the process to implement it. We are adopting the solution and are at the beginning. We have studied a lot, we are training people, and we are changing and modifying our process as per what the technology allows us to do. We are also evaluating the observability solution. We are working on two different paths, and one is at a more mature stage, while the other one is at an evaluation stage.

We are setting up alerts as expected.

We are integrating Splunk Cloud Platform SIEM solution with our SOAR solution, which is today from another vendor and not Splunk Cloud Platform. Then we will see tomorrow what we want to do if we want to use the unique platform, the unique Splunk Cloud Platform with SOAR, Agentic AI, SOC automation, and everything, or if we want to keep using our actual SOAR. We are integrating Splunk Cloud Platform with this SOAR.

My recommendation is to look at the future and look at the strategy. Do not look at the features today but look at the features tomorrow and not just at the technical features but at the whole strategy to integrate in one single platform all the capabilities that a SIEM solution or a log gathering solution might have. Putting together orchestration, observability, security, this kind of strategy is what an integrator should evaluate in my opinion.

I would rate this product an 8 out of 10.

Public Cloud

Other

We currently utilize Splunk Cloud Platform for detection and response engineering. We utilize it for network and endpoint types of detections. Specifically for an endpoint, it would be similar to a CrowdStrike alert. Those logs are sent into Splunk Cloud Platform, and we set up a rule that alerts if there are any abnormal detections on that endpoint.

Our main use case is detection and response engineering. We have GitHub code for these detections and those are deployed into Splunk Cloud Platform.

Splunk Cloud Platform offers features that are easier to use than having Enterprise Security and other applications on top of it. The most significant advantage is not having to deal with on-premises server management.

This has affected my day-to-day work significantly, as we have only two Splunk engineers who manage Splunk Cloud Platform as a whole. It makes management much easier, especially considering how large our company is.

Splunk Cloud Platform has positively impacted our organization by maintaining very consistent detection speed across Splunk Cloud Platform and Splunk Enterprise. The focus has been on having more uptime on the server as a whole, particularly regarding the detection and response engineering aspect and how our team utilizes Splunk Cloud Platform.

There are no improvements needed at this time, as the focus is on purchasing other applications such as Enterprise Security if we want to mature our security team as a whole.

The pricing may change with the new Security Essentials program that just launched, and I believe that the AI benefit in Security Essentials will be very beneficial for onboarding people into that program.

We have been using Splunk Cloud Platform for about a year and a half.

Splunk Cloud Platform is stable.

Splunk Cloud Platform's scalability has been very suitable for our environment.

The platform's ability to scale aligns well with our organization's demand fluctuations, and we are not a large enough company for the volume of logs being sent to Splunk Cloud Platform to encounter issues at this time. It parses the data effectively, and we maintain consistent uptime.

Customer support for Splunk Cloud Platform has been good to our company.

My advice for others considering Splunk Cloud Platform is to think about what you are looking for in your company, whether you want more products and if the pricing model with on-premises is more beneficial to having more applications while managing that server. I am not familiar with the pricing model, so I cannot provide detailed information. I would rate this product an overall 8 out of 10.

Private Cloud

Amazon Web Services (AWS)