Splunk Cloud Platform Reviews

We have used Splunk Cloud Platform for the past one year. We use Splunk Cloud Platform for system monitoring and alerts, and we have personal dashboards to monitor our activities. We ingest logs and monitor all of our operations. We also use AWS along with Splunk Cloud Platform.

The powerful search capabilities using SPL are what I appreciate about Splunk Cloud Platform. The second feature we value is its real-time monitoring and alerting.

The best feature is that Splunk Cloud Platform is handled by the Splunk team itself, including installation and all related tasks. We do not have to touch anything; we simply use it for our case.

SPL search capability is one of the primary tools we use every day. We have different search queries configured for alerts, dashboards, and all related functions. It is one of the major tools we use in our daily operations.

Overall, Splunk Cloud Platform is cost-efficient for us because we are Splunk partners, and it offers better performance. It has improved our faster query execution and includes an inbuilt dashboard with better dashboard performance. We gain more meaningful insights using Splunk Cloud Platform compared to other SIEM tools.

The initial learning curve should be more personalized for new users who just started using Splunk Cloud Platform. Additionally, the documentation should be more beginner-friendly.

I have been using Splunk Cloud Platform  for the past one year.

Splunk Cloud Platform is working fine for us; it is superb.

It is super scalable for us, whether you consider horizontal or vertical scaling. We are expanding in both directions, so it is highly scalable for us.

We have escalated questions regarding Splunk Cloud to Splunk. During the upgrade, we experienced some issues with our forwarders not coming up and some issues with our search head. All of the issues were resolved. We raised support cases and our issues were solved by the Splunk team itself. It has been good for us so far.

We directly use Splunk Cloud Platform.

The initial setup was straightforward.

It is super smooth; Splunk Cloud Platform integrates with ServiceNow smoothly. We have experienced no problems so far in that regard.

We have seen a return on investment with Splunk Cloud Platform at 30 to 40 percent.

We are Splunk partners, so in Splunk Cloud Platform, pricing is not an issue. It is balanced, and from a pricing perspective, it is good for us.

If you are looking for a SIEM tool that has all the capabilities, you should definitely opt for Splunk Cloud Platform. I would rate this solution a 9 out of 10.

My main use case for Splunk Cloud Platform is general Splunk usage. Instead of on-prem, we are using cloud.

A quick specific example of how I'm using Splunk Cloud Platform is application monitoring, security monitoring, and enterprise security. Specifically for security monitoring, I'm looking for application-related logging, trying to understand how the applications are progressing, and monitoring the status of the servers and other infrastructure.

The best features Splunk Cloud Platform offers include ease of use, good integration, and easy scalability.

Regarding how the integration works and how the scalability has helped my team, when SVC usage is high or if there is lots of data coming in, the scalability is helping us with indexer clustering.

Splunk Cloud Platform has positively impacted my organization by reducing a lot of time, reducing a lot of incidents, and helping in mitigating issues without major downtimes.

Regarding time saved, we have caught many anomalies and issues related to applications or security data coming in through the data, which gave us proactive monitoring as well related to those.

I think Splunk Cloud Platform can be improved with some improvements on the ingestion pipelines related to edge processors, including all protocols, not only the HEC or other features. Improvements on the HEC side of things would be beneficial.

I have been using Splunk Cloud Platform for almost 10 plus years.

Regarding Splunk Cloud Platform's stability, I would say it is kind of stable, though not completely.

Splunk Cloud Platform's scalability is pretty much easy. It is auto-scaling, so we are not even bothering much about it.

I find the customer support to be good enough.

We previously used an on-prem solution.

I have not seen a return on investment yet; it is just the starting for us and it is completely a non-matured setup as of now on our side.

My experience with pricing, setup cost, and licensing is pretty much seamless.

Before choosing Splunk Cloud Platform, we evaluated our on-prem solution.

My advice to others looking into using Splunk Cloud Platform is to review your data. Do not bring all data; just bring in only what you need. I would rate this product an 8.

I use Splunk Cloud Platform for both IT alerting and incident management in my training.

I use it to find threats and strange behavior of applications or networking. I mostly use it for networking, strange processes, and behaviors. I use the alerting mechanism.

I appreciate the syntax that Splunk Cloud Platform uses because it is not KQL.

The whole product is really good, and I did not have much difficulty using it. The alerting mechanism is good to have, but in my personal training, I did not use it much because I did not need it that much.

The visualization feature in Splunk Cloud Platform is a pretty good feature because I did not need to go to any other vendors, for example, any.run or VirusTotal. This speeds the whole investigation up.

It is worth reconsidering the syntax language and changing it to KQL. The company would benefit from using the KQL language in queries. Pricing would be better.

My experience with Splunk Cloud Platform is three months.

I have not heard a lot of problems or disconnections, so I think nine is correct. That is also nine.

From what I heard, the technical support is pretty decent, so eight is okay.

I have tried Elastic, Sentinel, and I think that is all.

I cannot tell if the deployment is easy or complex. I cannot tell how long it took to deploy because I did not deploy it. I just started the session, and everything was already prepared for me.

I had some tasks to find, such as some strange processes. That was one big task to perform on Splunk Cloud Platform system. There were several of these tasks, but that was an example.

I have not tried the machine learning tools yet. I did not integrate Splunk Cloud Platform with any tools. In my case, it is just me using the solution, but I know the whole platform because I am using Cyber Defender platform for learning. The whole platform has a lot of people, but in my case, it is only me.

I cannot tell if it requires any maintenance, but I do not think it is really rough to do it.

My overall review rating for Splunk Cloud Platform is eight.

My usual use cases for Splunk Cloud Platform involve being an admin where we used to build Splunk clusters or distributed environments from scratch on the on-premises system, but now we have everything up and running on Splunk Cloud Platform, which operates on AWS. Splunk has developed it on AWS. Currently, as an admin, I just need to maintain and configure it according to our needs. It functions as a software as a service now, meaning we don't configure it from scratch the way we used to do with installation, configuration, and setup of the configs as we required. Now, it is software as a service that we use for both Splunk and Observability.

Splunk Cloud Platform has greatly improved my daily operations through enhanced integration with third-party tools. Earlier integrations from on-premises Splunk to third-party tools were quite difficult, lacking the necessary add-ons or applications that could be directly used from the UI. Now on Splunk Cloud Platform, they have introduced new add-ons and plugins that allow us to utilize and pass credentials directly for integration with third-party applications, making the process very efficient and fast. We have multiple new add-ons that let us connect directly to clouds such as AWS, Azure, and Google, as well as event management applications such as ServiceNow, requiring only the credentials and service accounts and eliminating the need to configure from scratch.

The features of Splunk Cloud Platform that I have found most valuable and useful relate to licensing. Previously, it was a daily quota that we purchased on-premises, but currently it is based on SVC, or Splunk virtual compute, which is based on CPU and memory utilization of the cloud for billing. There are two license types: Victoria and Base. As we utilize the SVCs, we are charged accordingly, and we have the option to purchase a fixed number of SVCs or pay based on how many we actually use.

The effectiveness of Splunk Cloud Platform's search capabilities in uncovering operational insights is notable because as an admin or developer, we utilize saved searches that run on schedules that we set. The search capability utilizes the same compute assigned, and compared to on-premises, it is very efficient and fast because on-premises we had fixed compute assigned with limits set for searching per role or application. In the cloud, we find it very easy and fast to use.

Splunk Cloud Platform helps in proactive issue resolution by allowing us to set alerts based on data flow to find errors or anomalies that need identification. The saved searches run based on these conditions to find errors or identify anything unusual in the data. We get alerts based on the conditions we set, which is quite effective.

Areas of Splunk Cloud Platform that could be improved or enhanced in the future include data visualization, as the way we use data for security and other purposes could further benefit from enhanced visualization to support monitoring, threat analysis, and other aspects.

Overall, I would rate Splunk Cloud Platform an eight out of ten as a solution for us.

Regarding stability and reliability so far, we are not yet live and are still in the migration process, but comparing it to on-premises, it seems promising.

My thoughts on the scalability of Splunk Cloud Platform are that it scales up quite well. However, I haven't encountered any specific scenarios to validate it thoroughly yet, but overall, it appears to be good.

My opinion on the technical support and customer service of Splunk, based on my cases, is that it is quite good with the credits we have along with the vendor. However, when we don't have credits, they charge us based on time as well as the criticality of the issue.

Positive

In my opinion, there is room for improvement, as we used to raise multiple issues via the process, but they pick them up slowly, and the response times are not as prompt as we would like.

Regarding how Splunk Cloud Platform's ingest and visualization features help improve my data reporting, I have some insights on dashboards, but from a fully comprehensive perspective of data flow and ingestion, I haven't been hands-on that much. As an admin, I have worked on the infrastructure side of it, so I am unable to provide thorough feedback on that.

I would rate Splunk Cloud Platform an eight out of ten overall as a solution for our organization.

Splunk Cloud Platform is primarily used for data visualization, as it allows us to gain insightful perspectives on our data.

The best features of Splunk Cloud Platform include its powerful analytics and intuitive user interface. I particularly appreciate how it simplifies complex data operations.

The ingestion and visualization features of Splunk Cloud Platform are integral to our data reporting, as they help transform raw data into meaningful visual formats effortlessly.

I believe there are a few areas of Splunk Cloud Platform that have room for improvement, particularly in user customization and documentation clarity.

I have been using Splunk Cloud Platform for quite some time.

The stability of Splunk Cloud Platform is commendable, and I would rate it a nine from one to ten.

Regarding scalability, I find Splunk Cloud Platform to be highly scalable; I would rate it an eight from one to ten, as it meets our growing needs efficiently.

From one to ten, with ten being the best, I would rate the technical support of Splunk Cloud Platform as a solid eight.

The deployment of Splunk Cloud Platform itself is straightforward; I would categorize it as easy, with minimal challenges along the way.

We have approximately one hundred users using Splunk Cloud Platform across various teams in our organization.

Overall, I would rate Splunk Cloud Platform a solid eight from one to ten, as it meets a wide range of our business requirements effectively.

When it comes to the cost of Splunk Cloud Platform, I would rate it a five from one to ten, with one being cheap and ten being expensive.

In comparison to other solutions such as DataDog, Microsoft, and Sumo, I find Splunk Cloud Platform to be quite competitive, offering unique capabilities that are valuable to our operations.

My advice for others looking into Splunk Cloud Platform would be to take full advantage of its versatile features and ensure proper training for your team.

I have Splunk Cloud Platform deployed in the cloud, and I utilize AWS as my cloud provider.

Regarding machine learning tools, I find them to be quite impressive in their ability to enhance data analysis and predictive insights.

My thoughts on the alerting mechanisms in Splunk Cloud Platform are positive; they work effectively to notify us of important changes or issues in our data.

I assess the effectiveness of the search capabilities in uncovering operational insights as quite robust, as they provide detailed results swiftly and efficiently.

My thoughts on the integration with third-party providers is that it generally is seamless, allowing us to synchronize various tools with Splunk Cloud Platform easily.

Overall, I would rate this review an eight from one to ten.

My major use case for Splunk Cloud Platform is for SOC, SIEM mostly.

What I like about Splunk Cloud Platform is the easy reading of the dashboards and finding the data, which brought me the biggest benefits.

The alerting mechanism in Splunk Cloud Platform is customizable, so we could adapt it to our needs and assign the right priorities and based on this, define the action.

Visualization features and ingesting in Splunk Cloud Platform helped to improve my data reporting, but that was also a different team that was providing the log ingestion.

Other features that were really great in Splunk Cloud Platform include real-life monitoring, so we could have logs right away, and parsing was fine, so when it was correctly ingested and Splunk Cloud Platform parsed it correctly, then we had no issues with receiving the correct alerts.

Splunk Cloud Platform could improve in how quickly it reacts to users reporting issues.

Splunk Cloud Platform can be complex depending on the log source in terms of deployment.

I used Splunk Cloud Platform for seven years.

Splunk Cloud Platform was stable, and I did not see any performance issues or downtime, although it happened; the issue was that we had to really fine-tune the log quality so that it would not be ingested too much and handled for nothing.

Regarding the scalability of Splunk Cloud Platform, I would say it is scalable, but maybe the pricing may affect the scalability because it may not be that beneficial to onboard too many log sources if they generate too many false positives and then you reach over the limit of the license.

I would rate the technical support for Splunk Cloud Platform probably a three, because there was some support, but I remember that we were using our proxy company to submit it for us because they were bigger and maybe more convincing to Splunk.

Negative

The biggest issue during deployment of Splunk Cloud Platform was correct log parsing.

I can describe the impact of integration with third-party solutions in Splunk Cloud Platform as limited experience since I was the only one on the receiving end of it, and I was not integrating it with any solutions or with any other vendors; we also had the company who was supporting us in the configuration part, so we didn't even have to do it fully by ourselves.

I don't see ROI with Splunk Cloud Platform, such as time saving or money saving because I'm security operations, so I don't think in management terms.

I have about the same amount of experience in this domain with SOC solutions, as I haven't worked with SOC SIEM solutions such as Splunk Cloud Platform before, so it's the same. My overall review rating for Splunk Cloud Platform is 8.

I have not utilized Splunk Cloud's machine learning capabilities as we just started.

I have not used Splunk Cloud's integration with third-party applications.

I track some false-positive indicators to measure the effectiveness of Splunk Cloud's real-time data processing.

I track approximately an 80% rate of false positives.

The log analysis features of Splunk Cloud have been the most valuable to me.

The data encryption and access controls work fine for my needs, so I assess their value as satisfactory. I am satisfied and would rate them a nine.

I see room for improvement in the area of reporting, especially the reporting dashboard for Splunk Cloud.

I am not expecting any additional features in the future because I have not explored the current features fully yet.

I have been working with Splunk Cloud for about two years.

I would rate their technical support as a 10 out of 10.

I think the pricing of Splunk Cloud offers a good quality-price ratio.

I would rate my overall experience with Splunk Cloud as a nine out of ten.

My main use case for Splunk Cloud Platform is collecting logs from an instrument computer, and we monitor usage and real-time status of instruments.

A specific example of how I use Splunk Cloud Platform to monitor instrument status in real time is that we collect and ingest the logs from the instrument computer. We ingest logs that belong to the application and also logs that belong to the computer, including Windows Event Log and WMI log. From the logs, we identify when the instrument is in an error state, is running, or is stopped, and then we collect these events and create an alert and dashboard using this event.

Splunk Cloud Platform has impacted my organization positively in multiple ways, especially because thanks to the monitoring and alert of the instrument, we can save a lot of time for the scientists. The scientists can act quickly when an instrument is in an error state, and they can go immediately to the lab to fix the issue.

The best features Splunk Cloud Platform offers include definitely the flexibility because we can ingest logs from multiple sources. We can also use APIs and ingest logs from our own database, which is a huge plus.

The flexibility to ingest logs from multiple sources, including APIs and our own database, impacts my daily work significantly because it allows us to collect logs from over 3,000 computers and also over 200 servers, such as SQL Server.

There definitely needs to be some improvement on the dashboard side, in particular on the published dashboard.

I have been using Splunk Cloud Platform for five years.

Splunk Cloud Platform is stable.

Splunk Cloud Platform's customer support is great.

I would rate the customer support on a scale of 1 to 10 as an 8.

I am not sure if I was offered a gift card or incentive for this review.

A specific outcome since using Splunk Cloud Platform is that for one specific lab, they can save 400 hours per year of labor.

I have seen a return on investment, including definitely fewer hours of employees needed and money saved.

I would rate Splunk Cloud Platform an 8 on a scale of 1 to 10. I give it an 8 because I am currently satisfied with what Splunk Cloud Platform offers.

My perception of using native models over third-party integrations in Splunk Cloud Platform's environment is that we did not implement any AI solution yet in Splunk Cloud Platform, which influences our data strategy.

The subscription model impacts my financial planning for data platform investments because it is definitely expensive, so we always need to keep an eye on the cost.

My advice for others looking into using Splunk Cloud Platform is that it is a great platform and definitely worth the money of the investment.

For Splunk Cloud Platform, we perform analytics with a large scale of data pipelines and log data. We query logs and build dashboards to support our operational and business insights. We mainly work with Splunk Processing Language to query logs, identify patterns, and support troubleshooting and reporting.

We definitely use the ML toolkit for regression and anomaly detection. We also use Splunk Processing Language, and after the recent update, the new AI feature has been introduced that suggests queries to us. This feature has saved us considerable time.

Regarding native models, we only use the ML toolkit. I am unaware of the other models that Splunk provides. Specifically for the ML toolkit, we use it for anomaly detection and regression. In terms of cloud, we only use the ML toolkit.

I love how everything is handled by Splunk Cloud Platform itself. We do not have to manage migrations, updates, and other maintenance tasks. That is one of the major benefits of using Splunk Cloud Platform.

We definitely contact them and they help us during upgrade times. For example, if we want to upgrade Splunk Forwarder on a cloud instance or a Splunk Indexer in a cloud instance, they definitely assist us.

Splunk Cloud Platform is highly scalable. It is one of the best SIEM tools across the world because it is valuable not only for monitoring but also for security analysis, dashboards, and other features compared to other tools.

For betterment, there is definitely a cost concern. The cost is high, so there should be a somewhat lower cost. I am expecting a more competitive pricing structure from Splunk Cloud Platform, but otherwise it is fine.

We have been working with this solution for the past 14 months.

I experienced stability issues once or twice during an upgrade, but the rest of the time it is fine. It is highly stable and scalable for us.

Splunk Cloud Platform is highly scalable. It is one of the best SIEM tools across the world because it is valuable not only for monitoring but also for security analysis, dashboards, and other features compared to other tools.

The customer service team is quite fast. They take around two to three hours to reply back and they solve our problems.

We have not had any issues regarding maintenance because everything has been handled by the Splunk team itself. That is the best aspect of Splunk Cloud Platform, so we have not experienced any problems so far.

The initial setup was easy for us because we took training from Splunk. It was quite easy for us.

The implementation timeline depends on the use case, whether you are a Splunk Admin or a Splunk Power User. For a Power User, it took around three to four months to learn it. For an Admin's use case, it is very hard and took around a year. You also need certification to prove that you are a Splunk Admin.

The implementation process is quite easy because we have created custom applications regarding the upgrade of Splunk Enterprise Platform. We have another application called Splunk Forwarder through which pre-checks and post-checks are performed by our custom-made application. It is quite easy for us.

We also use Splunk SOAR in addition to Splunk Cloud Platform. My overall review rating for this solution is 9 out of 10.

I have been using Splunk Cloud Platform for six years.

My main use case for Splunk Cloud Platform is to create end-user dashboards and visualizations.

I use those dashboards or visualizations in my day-to-day work by viewing computer analytics, patching, reporting, firewall issues, and troubleshooting connectivity for end-user lab devices.

In my opinion, the best features Splunk Cloud Platform offers include the basic search, which is the bread and butter. It is the best to be able to view the logs and get access to the data that normally for an end-user such as myself or in creating dashboards for end-users, gives them the ability to view this data without having to get access to the firewall or the VPN data. It is all there and available to us for troubleshooting, which is phenomenal for what we do.

I am still learning how to use it, and there is definitely a learning curve starting out. I did take a two-day training, so it is great that Splunk Cloud Platform has that available. Otherwise, there is definitely a lot you can do with it; you just have to learn about it and play around with it more to really get the full use out of it.

Splunk Cloud Platform has positively impacted my organization by providing accessibility to data and the speed at which we can access that data and troubleshoot. It has really made it a lot faster, providing a lot more user insight for their data as well. That has been a huge help.

From ticketing alone, the amount of time it takes us to gather data needed by other parts of our organization for troubleshooting saves us at least a quarter of the time troubleshooting actual issues when we can provide that data back to them ahead of them asking. It cuts down on a lot of bureaucracy.

I cannot really think of anything that could improve Splunk Cloud Platform.

I would appreciate the ability to cycle through dashboards in a view. We have some users that display the dashboards on a screen, and it would be nice to have an automated way to cycle through those dashboards.

Splunk Cloud Platform is stable in my experience.

In my experience, Splunk Cloud Platform's scalability is good.

Scaling within Splunk Cloud Platform seems to be easy enough and aligns with my organization's demand fluctuations.

I find customer support to be good.

I know that my organization previously used a different solution before Splunk Cloud Platform, but I was not here for that, so I am not sure.

I am unsure about which cloud provider we use for our private cloud deployment.