Splunk Cloud Platform Reviews

Splunk Cloud Platform is my main use case, which we sell to our channel partners within the channel community that then sell it to their customers, primarily as a cloud-based platform that collects data, analytics, and monitoring. It is mainly used for log management, security monitoring, known as SIEM, IT operations monitoring, and customers can use it for infrastructure troubleshooting and compliance reporting, but primarily for getting real-time analytics. It is a useful SaaS cloud-hosted tool that manages infrastructure, upgrades, scaling, and maintenance for customers.

A specific example of how a customer uses Splunk Cloud Platform in their day-to-day operations is how it collects logs from Linux, Windows servers, Azure, and AWS. Teams can run powerful searches using SPL, search processing language, to find failed logins, investigate outages, and trace application errors. It also automatically alerts the team for system failures, CPU spikes, security threats when they occur, and API slowdowns, showcasing just a couple of examples of what our customers use Splunk Cloud Platform for.

Splunk Cloud Platform provides a complete picture regarding how customers use it. It includes capabilities around machine learning and dashboards that allow them to monitor KPIs, have a real-time operational view, and executive reporting from all the logs.

Splunk Cloud Platform's best features include its scalability, as it can handle terabytes of data and is probably one of the market leaders within SIEM capability, which is very strong. In this day and age, cybersecurity products need great integration, and it has a huge ecosystem that can integrate with over 1,200 integrations and applications. Another major positive is that it is cloud-managed, which means less infrastructure management. Finally, the main feature that many people value, and our customers provide feedback on, is real-time analytics with fast detection and troubleshooting.

Splunk Cloud Platform has positively impacted my organization by reducing the need for infrastructure management due to being a SaaS cloud platform. The main use case is detecting cyber attacks faster. For example, a large financial institution, a bank, used Splunk Cloud Platform and identified failed logins, impossible travel events, VPN anomalies, and endpoint alerts when attackers attempted credential stuffing. Without Splunk Cloud Platform, those alerts existed in multiple systems, and detection could take days, but with it, events were correlated correctly and raised a single notable event, triggering alarms immediately. This significantly improves mean time to detect and respond, reducing investigation time from hours to just 10 to 30 minutes for common incidents by providing a single pane of glass visibility for SOC teams.

Splunk Cloud Platform has areas for improvement, including the fact that it is obviously an enterprise tool and can be expensive, which is the biggest complaint I have noted. Costs can rise due to high data ingestion and long retention periods, along with a complex licensing structure that makes pricing difficult to predict as usage grows, especially since more systems send logs. There are also performance concerns at scale where users have reported slower searches and expensive long-term storage needs, particularly in multi-terabyte environments. Additionally, operational complexity exists as enterprises still need to do data onboarding, create dashboards, handle retention policies, access control, and performance tuning.

These are the three key areas of improvement I have identified.

I have been using Splunk Cloud Platform for approximately three to four years at various different places of work.

Splunk Cloud Platform is undeniably stable, which is one of its key advantages. While it may come with a high price tag and face scalability issues, its stability is commendable, enabling easy visibility into logs, effective data ingestion, and successful operations with diverse integrations and third-party platforms.

My customers typically leverage scalability and integration features across the main cloud providers, primarily AWS, integrating with CloudWatch, CloudTrail, S3, and Lambda for cloud security monitoring and audit logging. They also integrate with the entire Microsoft stack, including Defender for Cloud, Sentinel, Azure ID, and Azure Monitoring, as well as Google Cloud, where GCP integrates with Cloud Logging and Pub/Sub security command center. We also have integrations with major SIEMs including Sophos, CrowdStrike, and firewalls from Palo, Fortinet, Cisco, and Juniper, and identity management tools including Okta, Ping, and Duo. For threat intelligence, we get much of our integration from Recorded Future as our main integration, but they are just some of the top ones we integrate with effectively.

Splunk Cloud Platform's scalability works well, especially for smaller businesses, but can present issues for larger enterprises facing stricter regulations and greater integration requirements.

Customer support with Splunk Cloud Platform is really good. The CSMs and account managers in the channel team are great, providing assistance not just with selling the product but also for implementation, deployment, and aftercare. I would rate customer support a nine on a scale of one to ten. There have been a couple of instances where issues arose, which is why it does not earn a full ten, but overall, it stands out as a really good platform and contributes to why they remain number one in the business.

I have not personally switched from a different solution to Splunk Cloud Platform, but we utilize various different solutions for SIEM, including QRadar and Exabeam, alongside newer tools including DataDog and Elastic.

My experience with pricing, setup costs, and licensing is that while the setup costs are straightforward and not overly burdensome, licensing for small to mid-sized enterprises is favorable. Highly regulated businesses, including financial services and banks, tend to use Splunk Cloud Platform regularly, and while it is a high-quality product, the costs can elevate significantly as scalability needs grow within larger enterprises.

My partners deploy Splunk Cloud Platform in several different ways. My partners typically purchase Splunk Cloud Platform through distribution and channel partners, rather than directly.

I have observed a robust return on investment with Splunk Cloud Platform, particularly in how quickly it enables the detection of breaches. We see logs between 10 to 30 minutes in contrast to six hours with other platforms, marking a substantial ROI for organizations needing to prevent breaches that can cost from tens of thousands to the average ransomware cost in the UK of 3.2 million last year. Being able to resolve issues quickly not only saves money but also minimizes the need for additional security personnel, thanks to the effectiveness of its log prioritization and integration capabilities.

Before choosing Splunk Cloud Platform, the primary alternative evaluated was DataDog, although that was not my decision directly.

The aforementioned examples are the best ones to highlight regarding positive outcomes about how Splunk Cloud Platform has helped my organization or my customers.

My partners typically purchase Splunk Cloud Platform through distribution and channel partners, rather than directly. My impressions of Splunk Cloud Platform's visibility into multiple environments, including cloud, on-premises, and hybrid are very positive. It excels at monitoring across these environments and provides high capabilities, especially strong in centralizing visibility. This is facilitated by effective cloud monitoring alongside mature on-premises monitoring, all visible in a unified dashboard for SIEM use, supporting massive scales and deep forensic investigation across all these monitoring types.

My impression of Splunk Cloud Platform's zero setup feature for AI models is mixed, as there have been a couple of problems. Data is never standardized among organizations, leading to different log formats and inconsistent field naming. Therefore, AI cannot understand the data without mapping it first. Moreover, there is a need for context rather than just raw data, and integration remains unavoidable. Splunk Cloud Platform's zero setup AI concept feels more like a marketing idea than reality, as it requires careful scrutiny in enterprise environments. The main blockers noted remain related to data integration and standardization.

My experience with Splunk Cloud Platform's application ecosystem is that it is easy to manage for small and simple environments, as management involves just installing the application and configuring the data. However, for enterprise environments, management becomes really complex when dealing with multiple applications and teams, especially in larger organizations or heavily regulated industries including financial services and banking, where governance is stringent.

Splunk Cloud Platform scales extremely well at enterprise and hyperscale levels with some cost and architecture considerations. It can ingest almost limitless data and scale impressively, but higher data volumes present challenges, including costs, poor data hygiene, slower searches, and operational complexities that arise even in cloud environments. Despite these challenges, Splunk Cloud Platform scales extremely well technically; however, in real-life enterprise contexts, the main scaling limitation is not infrastructure but rather cost, data volume discipline, and query efficiency.

In comparing native models to third-party integrations within Splunk Cloud Platform's environment, I find that native Splunk scores high in integration quality and stability. However, it lacks the customization and innovation speed found with third-party options. Native models require very low maintenance effort, which contrasts with the medium to high maintenance needed for third-party applications. Each model has its advantages: the native model excels in core SIEM engines and performance-critical workloads, while third-party models handle data ingestion for external systems and industry-specific applications effectively. Therefore, a hybrid approach, leveraging the reliability of native capabilities with the flexibility of third-party applications, is ideal.

Splunk Cloud Platform's subscription model significantly impacts financial planning for data platform investments by being quite complex and opaque. The licensing and subscription model are tough to decipher initially, largely due to the relationship between ingestion levels, data scaling, and the associated costs that increase with usage. Customers usually find that as they scale, their expenditure rises, with no clear set cost available when they first begin using it.

Splunk Cloud Platform is a market leader known for its strengths in enterprise-scale log analysis, advanced security monitoring, complex event correlation, and deep search capabilities. It is also highly customizable, making it an excellent choice for organizations unperturbed by cost and seeking a cloud-native design, especially if they have a SOC environment and a large IT estate. I would rate this product a nine out of ten overall.

Public Cloud

Amazon Web Services (AWS)

Currently, we are using Splunk Cloud Platform for our basic security. We have our own firewall, and we are getting that firewall data. We have installed Splunk agent on all of the laptops for our 200 to 300 plus employees. We are collecting data from a lot of servers and all internal sources everywhere and putting that into Splunk Cloud Platform. We are performing analysis on what users are doing, and some security use cases are based on the firewall logs. We also have Zscaler logs that we are using for all purposes.

For AI models, there is one good feature in Splunk Cloud Platform. We are using the latest version 10.2, so there will be SPL to SPL3 conversion. There are AI features as well that can help write some Splunk queries. AI will help in this area. Other than this, we are not using AI in Splunk Cloud Platform.

For Splunk Cloud Platform, the best feature is that we don't need to manage the infrastructure. That is one of the best things. We don't face any downtime issues. If we are facing anything, we just need to create a support case and the Splunk team will resolve everything. There are maintenance windows, and they will take care of everything. That is a good thing that I appreciate. We just need to manage only search and no background things. Everything will be taken care of by the cloud teams.

With Splunk Cloud Platform, we are managing the apps ecosystem. Inside the manager, we will see all of the apps. For this, we do have a deployment server and a cluster master. With that, if we need to upgrade the app, we just need to create a support case, and the Splunk team will upgrade all of the apps on behalf of us. We can also do manual things as well. Sometimes in the UI, there is an upgrade apps option available. We are upgrading that manually as well. For our forwarders and our clients, we are pushing apps from our deployment server. For this, we can download apps from Splunkbase, put it in the deployment server, and just deploy there. It will go everywhere and it will restart Splunk and it will come up. This is a straightforward process. It's easy. We just need to take care of one thing, which is to read the Splunk release notes.

For improvement in Splunk Cloud Platform, the Splunk docs are available, which is helpful. However, for cloud, they need to give some more visibility. They need to give cluster master access to us and some more visibility into what they are doing and what they are performing. We would like to see what the settings and backend access are. We are not modifying anything, but they must need to give some read access so that we can see what the configuration is being deployed behind our search UI and all the things. That is one thing that they can improve.

For improvement, they can integrate a lot of default apps. There are a lot of default apps already, but let's say we are using Palo Alto firewall, we are getting Windows event logs, Linux logs, and these types of logs. Every customer is getting this kind of logs. They need to give some default dashboards or we just need to change the index, and that will help to populate all of the data. Everyone wants to know who is logging in and who is logging out. These are some basic security use cases that are there. Splunk Cloud Platform needs to publish one app as a default app and inside this app, you will have all of these things.

We are using this product since two years. Last year we think about Cribl.

This is a very stable product. It will act immediately and will give alerts. Everything is on time, so it's very good. I rate stability from 1 to 10 as nine.

The scalability of Splunk Cloud Platform is 10. It's a fully scalable product.

For Splunk Cloud Platform, there will be some issues I faced for downscale while coordinating with Splunk support. However, for upscale, they can easily do it. If we want to add more data, they can add more indexers and can add more size as well. Let's say we are storing right now 100 TB, but if we want to increase from 100 to 150 TB, we just need to say that to the support sales team, and they can increase it in one to two days. So for upscale, it is very good, but for downscale, sometimes we face issues.

The technical support for Splunk Cloud Platform is very good. I will give a 10 because they immediately help and support. I rated it 10 out of 10, the support.

I never used other SIEM, but I can compare Splunk Cloud Platform as one of the stable SIEM products. Other than this, there are log connectors, and one more thing is DataDog. However, they are not very feasible compared to Splunk Cloud Platform. With Splunk Cloud Platform, you can modify whatever you want. Let's say you want to run Python, you want to run any script, you want to monitor any port, you want to monitor data from syslog, whatever you think, you can do it in Splunk Cloud Platform. But you cannot do the same thing in some other solutions. In that case, Splunk Cloud Platform is one of the best things.

Deployment of Splunk Cloud Platform was easy, but you need to learn Splunk. For example, if you have some understanding and you are at least a Splunk certified admin minimum, then you can able to do all of the things. Deployment doesn't face any issues. You just need to download the .tar.gz file, extract this and start this. That's all. However, there are a lot of components, such as search head, indexer, forwarder, heavy forwarder, and universal forwarder. To connect all of these things, you must know how Splunk works and how to configure all the things. You must go through training.

We have 200 plus users working with Splunk Cloud Platform, around 250 or 200.

Maintenance for Splunk Cloud Platform is not required because Splunk version upgrades and some security fixes will be taken care of automatically by the Splunk Cloud team. However, for our heavy forwarder and from our side, there is a half infrastructure on our side as well. For that, we need to manage it, but one person is enough for that.

Regarding pricing for Splunk Cloud Platform, it is not cheap. It's cost-efficient if you are using it properly. If you really need the SIEM solution, then it is very cost-effective for your company. However, if you are not using it properly, then it is very costly for you. If you are just using this for storing data and just to see the things, then this will be a costly product.

I will give advice to others looking to implement this product that if you have more than one TB of data, then this product is helpful. Other than this, this is mainly a SIEM solution. It will help for security use cases. It is mostly designed with a lot of AI features and threat intelligence available. This is very helpful for the people who are looking for security solutions because there are a lot of intelligent dashboards available in enterprise security and it will give you a full map of your company where the data is flowing. You can collect the data and put it in Splunk Cloud Platform and you can see visually. This will give you raw things to visualization. So it's good.

For Splunk Cloud Platform, we are using cloud, so visibility is less. I can say that because I don't know where my indexer is or where my data is getting stored. It's in the cloud, it's secure, and it's managed by Splunk and Cisco. It's a trusted thing, but we don't know where they are storing or what the things are. We just have one URL, which is a search URL and we are using that. Visibility is less, very less in the cloud.

For the integration capabilities of Splunk Cloud Platform, we don't need to go anywhere. Splunkbase is there. Whatever, let's say tomorrow I'm purchasing a new product, Fortinet or any product. I just need to search 'FortiGate add-on Splunk' or 'FortiGate app for Splunk'. I can browse that on Google Chrome and I can easily find one of the apps that is built already. For Okta, there are default apps. Whatever product you think, there is a default app available on Splunkbase. We just need to simply download and install in Splunk Cloud Platform. That's it. It will work. We can integrate other solutions with this with the help of this app in Splunk Cloud Platform and we can get the data and we can visually see these things. I give this product an overall rating of 9 out of 10.

We use Splunk Cloud Platform for three main purposes: Core, Enterprise Security, and ITSI. These are the three key platforms we utilize for Splunk Cloud Platform.

Splunk Cloud Platform is easy to manage and has a lot of automation in place where my end users can access and provide data detections, anomaly detections, and use it for certain use cases where they can create notables or use Enterprise Security. There are many features that they have seen which are more advanced when compared to the enterprise platform we had previously.

Many users are trying to build custom queries with their limited knowledge of Splunk Searching SPL2, so they use our Cloud AI feature where they can create searches, optimize the queries, and perform valuable visualizations from it.

The best features Splunk Cloud Platform offers include easily manageable instances where there is no need to manage dedicated infrastructure in our data centers, providing a lot of value to end users who can access and provide visibility from any place. Additionally, whenever a new user comes into the organization, it is very easy to handle their access-related issues using SAML, and the authentication process is very straightforward without the hurdles we had on-premises. It also features easily understandable code that they can build.

Previously, during our enterprise phase, we used LDAP as the authentication IAM feature. Now we have started using SAML based on the Azure Cloud platform, which allows us to easily authenticate or grant access to any user without time-consuming approvals. The easiest task in cloud is directly through SAML, where we can grant access to any end user whenever they need access to Splunk Cloud Platform.

In Splunk Cloud Platform, we do get all the relevant information either through XML code that we can deploy to set up any SAML authentication or SAML configurations. That is all process-related, but I have not seen any other good examples apart from providing access to the end users.

The main positive impact of Splunk Cloud Platform on my organization is in terms of cost and infrastructure. These are the two main things that changed our company's Splunk usage, allowing us to provide all integrations and analysis directly from the cloud instead of depending on multiple environments.

Improving Splunk Cloud Platform could be achieved by adding more advanced features such as using AI or observability to build custom props and generating basic templates based on the data, which would help end users who are not familiar with Splunk SPL2 or SPL3. Splunk should provide basic templates to enable end users to build their dashboards based on the data that is already ingested. I refer to this as automating the knowledge objects necessary for users.

The main change I have personally experienced is the need for low-level expertise in Splunk among new users who come and go daily. Since I cannot sit and train each individual, having basic templates and analysis based on data would help our end users effectively build the visualizations they need.

Regarding Splunk Cloud Platform's zero-setup feature for AI models, we still are not utilizing it fully within our organization, so I cannot answer that question.

When I add any data to Splunk for monitoring, it should automatically detect the data and recommend which data models I need to use. It would be greatly appreciated if Splunk could facilitate this feature.

I have been using Splunk Cloud Platform since 2022.

Splunk Cloud Platform is not entirely stable. In the last couple of months, we have experienced issues with instances approaching max resources without alerts, and there have been problems on the AWS side as well, where instances have gone down.

The scalability of Splunk Cloud Platform is good, although our organization is not currently scaled automatically. It is one of the positive features of Splunk Cloud Platform, as it adapts to increased resource consumption from add-ons whenever we request scaling for the necessary environment.

Assessing the platform's ability to scale in alignment with our organization's demand fluctuations can be challenging, and I do not have a clear answer at this moment.

Customer support is great; I would say it is effective as they respond in a timely manner and acknowledge cases properly.

While in the enterprise, we used a perpetual license with limited capacity, such as 15 terabytes, which caused us to encounter many issues when over the limit. With the cloud solution, we gain the flexibility to request increases in resources handled by Splunk Cloud Platform, which greatly benefits us compared to perpetual licensing.

I have seen a significant return on investment by identifying unnecessary applications still ingesting data, which were not in use but kept servers running. We have observed between five to seven percent of the overall enterprise-wide applications that were flagged for frequent analysis and necessary cleanup, which saved my SVCs and licenses, ultimately translating to significant cost savings for my organization.

Before choosing Splunk Cloud Platform, we evaluated other options such as Kibana, which is another visualization tool, SolarWinds for server metrics monitoring, and Dynatrace for similar service-related information. We currently use both Dynatrace and Splunk Cloud Platform, but our main use cases are centered around Splunk Cloud Platform for enterprise security and ITSI.

In on-premises, I have everything under my control regarding analysis, configuration, setup, and installations. However, in the cloud, it is useful as many things get automated and managed by Splunk Cloud Platform. Sometimes, I do not feel confident that the configurations I made are getting reflected in the cloud because I cannot instantly check the metrics, such as pre-deployment and post-deployment resource usage. I have noticed that Splunk Cloud Platform Monitoring Console is still not equipped with the instance resource usage dashboard, which we manage manually. I would appreciate if we can add a Monitoring Console dashboard for monitoring the resources of instances in our SaaS platform.

When compared to on-premises, I feel much more comfortable managing app upgrades or app installations in Splunk Cloud Platform. There are three different platforms: one for Core, one for ITSI, and one for Enterprise Security. I have full control over app upgrades or installations in Core instances, which automatically deploy to indexers. However, for Enterprise Security and ITSI, I need to open a support case, making it less easy for me to manage everything myself on the premium app instances.

I prefer using third-party integrations such as Cribl and BindPlane over native models in Splunk Cloud Platform environment. These third-party solutions offer better comfort for data parsing and routing to multiple destinations, which I have not found as effective in Splunk Cloud Platform.

The subscription model impacts our financial planning for data platform investments as we base costs on SVCs, which are sufficient for our ingestion needs. However, I do not have much financial planning to discuss on the governance aspect.

I would rate this review an 8 overall.

Hybrid Cloud

Amazon Web Services (AWS)

My main use case for Splunk Cloud Platform involves gathering security relevant logs for detection and response engineering to support our cyber defense and SOC operations.

In my day-to-day work, Splunk Cloud Platform is used to support our SOC alerting as well as incident response activities.

Splunk Cloud Platform supports my incident response activities as detection response engineering alerts trigger, and SOC tier one analysts utilize enrichment gained from our SOAR platform to investigate logs supported by Splunk Cloud Platform. Depending upon the alerting scenario and playbook direction, they would then continue to either investigate or perform additional searching inside Splunk Cloud Platform to further understand the event in question.

Splunk Cloud Platform also supports a lot of our metric and dashboarding to provide insights from our business unit on various threats received, phishing emails, threat intelligence, indicators, and so on.

Splunk Cloud Platform's best features include the new iteration of dashboarding, which has helped our cyber defense team provide dashboarding to our customers and our business units, allowing them to self-serve for many of the metrics that they need for various monthly, quarterly, and annual reports.

What I appreciate most about the new dashboarding iteration is the plug-and-play capability, specifically the ability to very easily drag and drop panels into dashboards, which allows us great flexibility and customization for our customers.

Splunk Cloud Platform has positively impacted my organization by providing a unified solution for not just cyber, but also for our application and fellow global tech teams to appropriately monitor, not just for cyber use cases, but also for firewall utilization and, in certain cases, applications, alongside the additional benefit of audit and compliance, mandatory log retention for various SOX, PCI, and SOC 2 Type 2 cases.

Splunk Cloud Platform has been monumental in assisting us with our audit and compliance requirements, as we have been able to develop self-serving dashboards showing items such as Crown Jewels or PCI in-scope systems, allowing us to quickly see at a glance via these dashboards their coverage, such as EDRs in place, FIM enabled, vulnerability management picture, and so on, allowing us to quickly attest to our PCI assets following guidelines.

Regarding improvements for Splunk Cloud Platform, I do not identify any direct improvements for the core product offering. The improvements for News Corp involve continuing to expand, and we are already talking with our account manager on Enterprise Security Essentials and how we could utilize that in our environment to supplement our current manual process for creating detection response engineering alerts, as well as including Agentic AI in the workflow natively from Splunk Cloud Platform.

I have been using Splunk Cloud Platform for three years and three months.

Splunk Cloud Platform is stable.

Splunk Cloud Platform's scalability has served our needs wonderfully.

The platform's ability to scale aligns with my organization's demand fluctuations, and I believe there is a lot of flexibility to scale. I have a great relationship with Splunk Cloud Platform and our account manager team when interested in and trying new features, whether it is Federated Search, and I am very much looking forward to the new Data Lake model they are implementing, as there have been many enhancements over the last year that have greatly interested News Corp in where we want to go and scale with the business.

Customer support is good. We have solid support from Bill, our Technical Account Manager, who helps escalate certain high-priority items, so we have had great customer support.

We previously used Devo as a log management solution, which was purchased before my time at News Corp as a cost-effective option for cyber logging, but we quickly found that it did not scale, struggled with ingest and searching, and consistently had errors or faults during regular operations. We wanted to switch to a known good solution, as several team members had positive experiences with older on-prem implementations of Splunk, hoping that would translate into a positive experience with Splunk Cloud Platform.

My experience with pricing, setup cost, and licensing has been overall very good. Nothing against any of our Splunk Cloud Platform teammates, as we face some internal political complexities with some global tech Splunk spend on observability cloud versus our cyber needs—I am in Cyber Defense for our Splunk Cloud Platform environment—so the challenges we encounter are more internal, ensuring we have appropriate back-billing to both the right teams and our business units. From the quoting and pricing model we have received from our account manager, we have always gotten great support from the team.

I can share a return on investment example, as we previously worked with Devo as our log management system for cyber purposes for approximately three years. While the cost was comparable, we initially thought moving to Splunk Cloud Platform would be quite expensive, but the ability to embrace functions such as active archive helped us drive down that bill, making the cost similar from Devo to Splunk Cloud Platform, which was great. We also saw significantly reduced latency for day-to-day searches when we moved to Splunk Cloud Platform, as we did not have a good experience with the Devo toolset, leading to efficiency gains from SOC tier one all the way to tier three in searches, reducing search time and fewer errors compared to Devo, resulting in great optimization.

Before choosing Splunk Cloud Platform, we reviewed a couple of different options, including LogRhythm, among others I cannot recall.

Splunk Cloud Platform is a great product, and my advice for others looking into using it is to appropriately scope both ingest for active searchable, as well as any potential active archive, and evaluate Data Lake and Federated Search to see where that fits into your use cases for compliance, audit, or active investigative or alerting needs. Overall, Splunk Cloud Platform has been great for us. I would rate this review a 9.

Private Cloud

Amazon Web Services (AWS)

I use Splunk Cloud Platform to check logs. As a product developer, whenever I try to make a transaction to see whether it has proceeded smoothly, we check the logs. In logs, we can see from the payload how the message gets generated, which is very useful for us.

I work as a product developer for Guidewire, an insurance tool, where we mostly face payment-related issues. It follows a check lifecycle where it starts from awaiting submission, requesting, requested, issued, cleared, pending stop, stopped, and everything. We have various check lifecycles. Suppose if a lifecycle is missed and the user is trying to proceed with a transaction starting from awaiting submission and moving directly to issued instead of requesting to issued, we face an illegal state change exception. Without Splunk Cloud Platform logs, we wouldn't know what type of exception we are facing. We help the user after checking the logs as well.

Recently we faced an issue where we use another software called One-Ink, where most of our process checks get updated to our database. From there, they were doing IP whitelisting where most of the payment-related features were done. IP whitelisting means giving out an IP address only for certain individuals where they can do payment-related changes. When they were doing that, they missed two or three of the IP addresses that were needed to be processed, and we had a global outage for check-related issues. We checked logs to know whether the issue was or how the issue got generated. We had to create a new payload and check it from Splunk Cloud Platform to see whether the payload got generated and the affected claims were resolved.

Generally, when we face a certain issue, if a check-related transaction will have a public ID generated, for that public ID, we don't have it in the UI. We have to query the database to get the public ID. Public IDs are primary keys and using those primary keys as a substitute, you have to search through our logs.

Logs can ask which type of log you need to give it, such as a claims pay logger or a state change logger or any other logger as a filter. Then you need to give that public ID and it would give you all the fields that were changed in that specific criteria that you were searching.

For me, with Splunk Cloud Platform, if you don't give the necessary filtration values, it has its own querying type. If you do not give a proper query or anything for the log to be generated on a primary key, it won't give you the values. It takes too much time and it checks a large number of values. Sometimes it goes more than a million, so that takes a lot of time. However, if you use proper filtration, it takes much less time. It saves our time and we could also pause the values, we could pause the search fields, we could resume the certain fields, we could skip a few fields, and we could check right from the payload whether which messages were generated and how the transaction was proceeded.

Splunk Cloud Platform holds only three months' worth of data. If you try to search for more than three months or prior to three months, it wouldn't store the values because the data stores a large number of data. I believe that's the limit for us. I believe having flexible memory would ease us because whenever we face an incident, if we want to look for this occurrence or root cause, if it is prior to three months, we wouldn't have proper logs to check.

I wish it would take a little less time and not search through unnecessary things. Of course, querying depends on the developer's knowledge, but storage is also an issue because I feel memory is not flexible enough. If we try to increase our memory, it will charge us a considerable amount of money.

I have been using Splunk Cloud Platform for around one year and three months.

We face occasional downtime issues where when we try to scale up, we face a considerable amount of challenges. If we consider one month, we would face around two to three days of downtime issues.

Scalability is a little issue for us because it's not currently adapting to our rightful needs. I believe they should upgrade on their side to match our tempo.

I never really reached the customer support, but they provide proper documentation, so all that was required. Mostly our support team takes care of any needs that were needed by us.

I did not use any solution prior to this because in this project, this was the tool that was working when I started.

We picked this tool because it was on top of a line in the market and it suited our specific criteria. We are developers, so it suited and matched our tempo.

I would say initially, to read Splunk Cloud Platform logs, it would prove very difficult because it is definitely not beginner-friendly. It will take around 15 days to one month to just adapt to what is a log and where you need to find the error because a payload and every logger is a complex form where line by line it will be written, but what that line is, they won't show that. It is definitely not a beginner-friendly tool, but it is definitely the best tool that is available in the market for insurance-related products.

Related to the pricing factor, I think it is slightly on the costlier side, but I wouldn't know much because I'm not on the management side. My organization divides developers and management, so we wouldn't know the price for it.

Generally, at our morning call, we go through our incident team-wise and assign incidents based on what we can do. Before we can do that, we check whether this is doable or not. We go through the logs and find if any check-related issues or claim-related issues that we face. We go through the logs and first check where the problem is because most of the problems that we faced were related to permission issues, where the user might not have permission and tries to make a few changes when that person doesn't have permission. They face a few errors or issues and cannot log in through certain sites or anything. Splunk Cloud Platform helps us reduce the time and effort through checking the logs. If we didn't have this, we would have checked the history loggers, where it checks and tracks even the person who viewed that particular claim. It would take a considerable amount of time.

Initially, we were a team of 300 people where our project started with three different teams. Before having this, prior to Splunk Cloud Platform logs, we used to depend mostly on the history loggers where it tracks our history or movement. Any small changes would be tracked down there, but we wouldn't have any sort of search criteria where we cannot search. We would have to manually go through step by step, one column after another, to see who has done what changes. That would prove an issue. After Splunk Cloud Platform was introduced to us, we saved a considerable amount of time. Time is a major factor for us developers.

Our team started off with 300, and now we are 30 people. We saved a considerable amount of money and resources that are required to hire more people. We started off with a team of more than 300 people and require less than 30 people right now. I think it's over a five year duration where we came to this number, but I think fewer employees are needed because of this, and we spend little effort because logs track everything. It helps us in our day-to-day task.

Storage is the major issue that we face occasionally because whenever we are trying to solve a root cause issue that is a PRB, we would require a lot of history loggers which would not be available for us. The second issue would be that it is not that scalable. I don't think increasing our storage would cost us a less amount, but it would cost us more. I would rate this product an 8 out of 10.

On-premises

My main use case for Splunk Cloud Platform is troubleshooting system errors.

One specific example of how I use Splunk Cloud Platform for troubleshooting system errors is when activation doesn't go through on our side; we look through Splunk logs to see what the error was and how we could fix it.

I also use Splunk Cloud Platform for dashboard monitoring.

The best features Splunk Cloud Platform offers include that everything I need is easily ready, and I can interpret it easily, which makes my troubleshooting faster and more accurate.

The easy interpretation of data helps me reduce the time spent on certain tasks because it reduces the time that I have to manually look into an account and see what the issue is, as Splunk Cloud Platform directly tells me the point of failure, what was the request that made it fail, and what it expects.

Splunk Cloud Platform has positively impacted my organization by reducing the number of customers who are in longer outages because we are able to identify the problem sooner through Splunk Cloud Platform.

I would say the outages that we've encountered are 20% less than what we had last year.

I'm not sure if it's Splunk Cloud Platform or if it's a network issue on our side, but sometimes the data that it produces loads a little bit slower.

Sometimes there are several steps involved in finding the right data, adjusting time ranges and fields, so it would be nice if the workflows felt more connected and required fewer clicks.

I have been using Splunk Cloud Platform for one year.

Splunk Cloud Platform is stable.

Splunk Cloud Platform's scalability is good because we are able to ingest more data as we need.

The customer support for Splunk Cloud Platform is great because we've had several outages where it was Splunk Cloud Platform's issue, and we were able to resolve it very quickly because of the customer support.

I would rate the customer support a nine out of ten.

I did not previously use a different solution.

I have seen a return on investment through time saved and money saved because we have higher success rates and fewer customers who are down.

My experience with pricing, setup cost, and licensing is that it's pretty easy to follow as far as identifying the price points.

I did not evaluate other options before choosing Splunk Cloud Platform.

I would advise people looking into using Splunk Cloud Platform to start with a clear use case and understanding of what data they need to bring into Splunk Cloud Platform and to take advantage of the built-in tools.

Splunk Cloud Platform's AI capabilities are governed and pretty secure, which helps my team be better engineers while troubleshooting issues.

I would say that the accuracy of Splunk Cloud Platform's AI capabilities falls about 80% since I have seen it make an assumption on its own when not required to, but overall, I have had a pretty good experience with it.

In our organization, Splunk Cloud Platform is used as a centralized cloud-based solution for monitoring and troubleshooting, allowing us to search multiple data across different sources in one place, though the visibility is limited to the logs and fields sent into Splunk Cloud Platform.

The platform's ability to scale aligns well with my organization's demand fluctuations, allowing us to handle higher log volume without having to constantly add or manage the infrastructure ourselves, which reduces the workload of my team and lets me focus on troubleshooting and monitoring instead of planning.

My experience with Splunk Cloud Platform's app ecosystem is that it's pretty easy to manage because Splunk Cloud Platform already handles most of the maintenance and updates for us, with most updates being pretty seamless, although we do need to review some changes to ensure that the dashboard and integration still work as expected.

I prefer using the native capabilities in Splunk Cloud Platform when they meet the need because they're usually easier to manage and more consistent, though third-party integrations are still useful for specialized use cases, they can add more complexity during security, maintenance, and data movement; I think I would love to lean towards native tools first and only use third-party integrations when they provide a clear benefit.

I've developed a tool using AI, and the zero-setup approach of Splunk Cloud Platform makes it much easier to start using AI because we don't have to spend as much time configuring infrastructure and integrations, with the main benefit being speed and simplicity while still being able to keep the workflow of my troubleshooting process.

The subscription model impacts my financial planning for data platform investments, but that is not something that I am responsible for; I'm assuming that the main challenge would be making sure that the usage by the team is within the expected level since higher usage means increased cost.

I would rate this review overall as nine out of ten.

On-premises

Other

My main use case for Splunk Cloud Platform is analysis and gathering logs and looking for and conducting root cause analyses.

A recent scenario for using Splunk Cloud Platform for analysis or root cause analysis involves taking the root of any issue that I have, and then determining the timeline for this issue that I am looking for. Instead of going through all logs by writing for a specific index and source type and going through the logs sequentially, I can streamline my process.

The best features Splunk Cloud Platform offers include logs and providing details on logs.

When I say it provides details on logs, the specific features I find most valuable are dashboards and alerts.

Splunk Cloud Platform has impacted my organization positively by capturing all alerts, monitoring the dashboards, and analyzing issues immediately, which has improved efficiency in my company.

Efficiency related to finding the root cause can provide all the issues so we can have production tickets for it. Efficiency is also related to alerts and dashboards so we can be triggered on time, on the spot.

Splunk Cloud Platform can be improved by more integration with AI to make it easier when researching and analyzing logs, and to make it very easy to read those logs.

I have been using Splunk Cloud Platform for two years.

Splunk Cloud Platform is stable.

Splunk Cloud Platform's scalability is good. I rank it 7.5.

Customer support for Splunk Cloud Platform is good.

I would rate the customer support on a scale of one to ten as 6.5 to seven.

I did not previously use a different solution.

Before choosing Splunk Cloud Platform, I evaluated AppDynamic as another option.

I do not see a return on investment.

Licensing and pricing for Splunk Cloud Platform are good. It is a bit expensive, but good.

On the financial side, Splunk Cloud Platform's subscription model is not affecting me because I am not on the financial side. I only use it.

I would advise others looking into using Splunk Cloud Platform to get it so they can have their efficiency and their data secured, and have their 24/7 support.

My impressions of the solution's visibility into multiple environments such as cloud, on-premises, and hybrid is that the solution I prefer is the on-cloud one. Everything is secured on the cloud, and if there are any issues, you can raise it to the Splunk team so they can fix it immediately. You won't have to be involved in triaging those issues.

Splunk Cloud Platform's zero-setup feature for AI models affected my ability to deploy AI solutions by making it easiest for me so I can use the DevOps pages on my triaging and analyzing data and logs.

My experience with Splunk Cloud Platform's app ecosystem is that it is easy and direct to update the ecosystems with the AI.

The platform's ability to scale aligns with my organization's demand fluctuations resulting in more efficiency, easy work, and in a timely manner, rather than spending a long time on gathering information or analyzing logs. It makes it more efficient, saving time and accuracy.

I do not work with native models over third-party integrations in Splunk's environment.

I rate this solution an 8 overall.

Private Cloud

Amazon Web Services (AWS)

My main use case for Splunk Cloud Platform involves working on desktop support and making dashboards for our inventory, which includes tracking computers going offline, handling break-fix issues, and managing various Windows projects.

For one of those projects, I pull data in from Active Directory, SCCM, Tririga, and CMDB, which are all multiple sources. In Active Directory, we have the version of the computer, whether it's Windows 10 or 11, and we have another external lookup that tells us when those are due for upgrade. So if a computer is due for upgrade, say in 2026 or 2027, I use Splunk Cloud Platform to filter that out through 3,500 machines, and it helps us keep track of where we are and what we need to do.

The biggest use involves all the data we pull from different sources such as AD, CMDB, Tririga, and ServiceNow, and we compile all that data into one table for compatibility comparisons. Sometimes they list different locations, and it helps us automatically create tickets if things are wrong, which we can then distribute to my tech team.

The best features Splunk Cloud Platform offers are primarily the lookups, as I rely heavily on them. I am not great with searches, but once I figure out the searches, I create big lookups that run every day, allowing me to pull all the data I need right from one master source, which is how I mostly use it.

The daily lookups and master source help tremendously because before Splunk Cloud Platform, I kept everything in Excel lookups, making multiple VLOOKUPs from different data sources almost weekly, which took a lot of time, filtering, and sorting. Now with Splunk Cloud Platform, it all happens automatically every day, and I can simply look at the results instead of continuously finding all the info.

Splunk Cloud Platform has positively impacted my organization tremendously since we have had it. While I provided my use cases, there are other departments with their own as well, including our scientists who can now see their data on Splunk Cloud Platform TVs showing whether computers are up or down. There is also a security team that utilizes Splunk Cloud Platform for their security measures. While I do not have information on what they do, they are the ones that brought it in and helped us set our setup. So my whole company is pretty much running on Splunk Cloud Platform now.

Regarding improvements for Splunk Cloud Platform, I do not have any complaints as I think it is pretty good already.

I have been using Splunk Cloud Platform for about three to four years.

Splunk Cloud Platform is stable.

The ability of Splunk Cloud Platform to scale aligns well with my organization's data demand fluctuations. My company has significant data needs, and the data engineers I communicate with are skilled at scalability and making searches smaller to avoid being too large. Overall, they do well.

Customer support is great; I attend the convention every year and can talk to whoever I need. I have taken classes and had discussions with proctors, and everyone has been very helpful.

I have not previously used a different solution; I am a first-time learner in this.

There is definitely a time and resource saving for my company with Splunk Cloud Platform. I do not know the pricing, so I cannot provide a return on investment, but I feel it has been very helpful for my team.

I did not evaluate other options before choosing Splunk Cloud Platform, as all I used before was Excel. Splunk Cloud Platform is my first platform.

Without looking directly at metrics, I can say it has saved me hours and days in a month. It has had a massive impact on my field. I could not live without it, as I do everything pretty much on Splunk Cloud Platform at work to keep us organized. It has been amazing.

I give Splunk Cloud Platform a rating of 10 out of 10. I choose a 10 because I enjoy having a single data source for all my data sets, and it has made my life much easier in managing our data sets, projects, and the various uses I get out of it.

I cannot provide insight into Splunk Cloud Platform's governance and security regarding AI capabilities, as I am not familiar with the AI features in Splunk Cloud Platform yet. I have only used some outside AI, such as Cloud Code, to help me create dashboards, which is really the most use I get out of it, not within Splunk Cloud Platform.

I feel that the accuracy and reliability of output in Splunk Cloud Platform depend on the person coding it. If the coding is right, it will be reliable, but I need to validate it, just as with anything else. If not, then it is going to be wrong, but that would not be on Splunk Cloud Platform; it would be on the person coding it.

I have only used cloud, so I have not experienced hybrid or on-premises. The cloud works fairly well; however, some really large searches can take some time, but since I mostly work in lookups, I have my setup to be pretty snappy, so I do not run into too many issues.

I have zero interest in Splunk Cloud Platform's AI models, using some external AI for help rather than the internal AI models, which I do not think my company has even adopted yet.

I do not know much about Splunk Cloud Platform's app ecosystem as it has not been an area I have gotten involved in yet. I know they exist, but I have just not worked with them.

I have only used Splunk Cloud Platform's internal models, so I have no experience with third-party integrations, leaving me unsure about any influence they may have on my data strategy.

The subscription model does not impact my financial planning for data platform investments, as I do not purchase Splunk Cloud Platform or anything; I am just a power user of it.

For others looking into using Splunk Cloud Platform, I advise to sit down and learn it. That is what I did. I did not know how to code or anything; I used some AI to help me get started and then kept learning. The more I learned, the more I saw how useful it was, and it has been great.

Private Cloud

Amazon Web Services (AWS)

Splunk Cloud Platform is used for our on-premise server. Our organization uses it as a cloud SaaS product. We have deployed our server on Splunk Cloud Platform. We have partnered with AWS and Splunk Cloud Platform because we already use Splunk Enterprise Security. Additionally, we get Splunk Cloud Platform in that form.

The best features in Splunk Cloud Platform are that it is very fast compared to any other cloud because we have integrated Splunk with Splunk Cloud Platform. We get the logs from the agent to Splunk, and we store those logs on the cloud. We are using it for real-time monitoring. The SPL, meaning search processing language, is also very easy. Any other SOC analyst can learn that language for searching. The searching query language is very powerful.

For monitoring, it is a very good cloud. We have integrated it with the Splunk SIEM tool only. Additionally, the platform's app ecosystem is very easy to use even in the initial starting phase, and it supports responsibilities including real-time alert monitoring and event correlation. It is very easy to learn the cloud because we have integrated it with the SIEM tool.

Compared to other clouds we were using before, the price of Splunk Cloud Platform is very nominal because our sales team is already a partner with the Splunk team. We get some benefits in pricing. We already purchased existing Splunk. They also offer a cloud service to our organization. Improvement-wise, I do not see anything, because compared to AWS—and we also partner with the AWS cloud—it is very cheap.

Our entire SOC is deployed on that cloud only. I would suggest going for Splunk Cloud Platform because AWS, Microsoft Azure, and Google Cloud are very expensive in comparison. Improvement-wise, I do not see anything. You can go for it.

I have been using Splunk Cloud Platform for six months.

Stability-wise, with Splunk Cloud Platform, I did not find any issue because it is a cloud. If it is down, then our whole server and client servers are all down. Stability-wise, it is very stable. There is no issue with using Splunk Cloud Platform. Any other cloud is very stable, which is why we are using the cloud service rather than having a hard disk in our organization. We do not require any hardware as a service. That is why we pay clients to have SaaS, a cloud as a service. Stability-wise, it is good. There are no issues. If an issue occurs in our organization, we usually raise a ticket to the team to handle it. If there is a storage issue or any integration issue that happens with our customer, we directly schedule a call with the customer and the tech team.

Regarding the ability to scale with Splunk Cloud Platform, you can. We have integrated Splunk with Splunk Cloud Platform, but as I told you, we also have Wazuh and Microsoft Sentinel. We deploy all the servers on Splunk Cloud Platform only. It is up to you how you scale because it integrates with any other SIEM tool. We just want API keys to integrate with it. We have to pay for the amount of data or cloud we are using. That much we have to pay to the Splunk Cloud team.

All our data is on Splunk Cloud Platform. We have multiple customers, so as per their requirement and their purchasing from the SIEM tool, we deploy all the servers in Splunk Cloud Platform only.

I would rate the technical support of Splunk Cloud Platform as nine, because Splunk Enterprise has good technical support. Splunk Cloud Platform provides good support as a cloud service.

Regarding the deployment on AWS Cloud, it is very easy compared to others. It is very easy because I also work with the Azure cloud because I am working with the Microsoft Sentinel SIEM tool. Deployment is very easy for the cloud. We just require an API key to integrate with it or with any other tool. For cloud, the deployment is very easy.

My impressions of the visibility into cloud, on-prem, and hybrid models while using Splunk Cloud Platform are that there are no challenges. It is more that you want to know about the language for searching on the cloud. I already told you about the SPL language, for Splunk and for the cloud. If you have the knowledge about how to manage and search in the cloud, it is very easy. I am in the learning phase. It is new to me right now, but I am still learning.

When I compare Splunk Cloud Platform with other solutions or other vendors, I compare it with Microsoft Azure Sentinel. They are both cloud platforms. Compared to Microsoft Sentinel, Splunk Cloud Platform has a good area. Microsoft also gives a very wide area, such as Defender XDR, connectors, and threat intelligence. It is also the same in Splunk, but I prefer the Splunk one compared to Microsoft Sentinel because it is very easy to use.

In Sentinel, there are many roles and responsibilities for reader, contributor, and responder. However, in Splunk Cloud Platform, we can additionally give admin tasks or role-based tasks to the SOC analyst role. It is very easy for a SOC analyst to handle.

For others looking to implement Splunk Cloud Platform, my advice would be to go for it. First, you have to do the pilot deployment. Second, you have to learn the SQL language for Splunk Cloud Platform because it is very important to learn. If you do not learn that query language, the SPL search processing language, you cannot find or do threat hunting and investigation for alert analysis. You can follow the investigation chart, such as a process tree, analyzing the IP, and verifying the IOC with the PF. Most effectively, learn the SPL language. If you learn it, you can easily handle Splunk Cloud Platform.

To be a ten out of ten, when I compare Splunk Cloud Platform with others, Splunk Cloud Platform is leading the market. Our sales team is also going to tell customers to go for Splunk Cloud Platform because we are pushing Splunk only. We get the SIEM tool and cloud in one platform. We did not have to find a different way to store the logs or storage on another AWS cloud. As our organization's option, we are also pushing clients to use Splunk Cloud Platform as a cloud and SIEM tool. It is beneficial for us and for them.

Splunk Cloud Platform's cloud is AI, so I can say ten out of ten. However, there is one issue: when our storage limit is crossed, they directly charge higher. From a charging point of view, it is about cost and AI. If there is an improvement, or if they give some discount to our organization, such as we are using two hundred GB per day, but if on any day we exceed that limit, they charge our organization a higher amount. They charge high.

I would rate this review nine out of ten overall.

I used Splunk Cloud Platform for seven years. We built use cases for one of our pharma customers, Regeneron Pharmaceutical from the US. We created numerous use cases for their operations, including keeping medical records with details about medicine inventory, doctor information, and many other elements that we stored and presented.

I appreciate the expansion capability of Splunk Cloud Platform. We can forward any kind of data to the cloud endpoint that they provide. This allows us to forward any kind of traffic to that endpoint. There is no need for maintenance. If an error occurs or Splunk health is not good, we can raise a support case and they will handle everything. There is no need to maintain infrastructure either, as they keep the infrastructure very stable, which is a good thing.

If you want to make Splunk Cloud Platform more reliable, there will be some issues. For example, if you want to allow some IP or renew some certificates, you need to raise a case and it will not be immediate. It will go through the process and take three to four days. Sometimes, the technical support case persons are not sufficiently technical. I have experienced this where they are not technical enough or not understanding the issues.

The app ecosystem is good, but if you want to upgrade any kind of apps or receive support related to the app, you mostly need to raise a support case and the Splunk team will handle it. However, if there is a problem with your custom apps that you need to deploy on an indexer, that becomes an issue. You can upload it from the search head, but sometimes there are DMC issues. DMC mostly fails sometimes, so we cannot deploy from the search head cluster or indexer. For custom apps, you need to go through all of these processes, which involves a lot of process.

I used Splunk Cloud Platform for seven years.

Stability with Splunk Cloud Platform is very stable. Sometimes we face an issue with latency. For example, when we are ingesting 10 TB of data and there is a sudden increase, we need to increase the storage at the cloud end. Sometimes this will take time because it is not on our end but on the cloud end. That is the only issue. Everything else is good.

Splunk Cloud Platform is very flexible in terms of scalability. If you purchase something initially and later have increased requirements, they can scale up and scale down your environment. That is one good feature. We just need to raise a simple support case, and based on that support case, they will scale up and down our environment. That is good.

I reached out to technical support many times regarding operations. If you want to perform any kind of operations, you need to reach out to the technical support. They are very good and their responsiveness is fine. Everything is good. However, as I mentioned, sometimes they might not have proper knowledge or sometimes they are not sufficiently technical. They are not understanding sometimes.

I used New Relic for log collection. However, New Relic is not a part of Splunk. It is a very limited scope product, not widely used like Splunk. There is no competitor to Splunk in the current market right now.

I do not think we need to do anything for initial setup. We just need to request the cloud team, and they will prepare an instance and everything for us, and they will give us a URL to access the cloud. After that, you need to allow firewall access based on what is in your company. That is all. Then you can access the environment. It is very simple and we do not need to configure anything.

Maintenance is not required at all in the cloud. A team of four or five people is more than enough to handle the full cloud infrastructure. I managed the cloud around 10 TB ingestion per day with only four or five people. That is more than enough because we do not need to take care of hardware and other components. However, if you have on-premises, then you need more than 30 people to maintain all of the parts.

Splunk Cloud Platform pricing is very costly. If we did it on-premises, it would be cheaper because we would just need to purchase a license. However, Splunk Cloud Platform is very costly. But if you use it properly, then you can get value from it. Maintaining an infrastructure on-premises would be expensive as well.

Splunk Cloud Platform pricing is very costly. If we did it on-premises, it would be cheaper because we would just need to purchase a license. However, Splunk Cloud Platform is very costly. But if you use it properly, then you can get value from it. Maintaining an infrastructure on-premises would be expensive as well.

Visibility with Splunk Cloud Platform is very good. We do not use only cloud because we have a heavy forwarder at our end that will forward the data. This is a hybrid deployment on our end. If you have on-premises only, then everything is on you. With on-premises, we have full visibility of the environment, including what is indexer and what is search head. However, in the cloud, we do not know where this is deploying. They are saying that they are deploying only on AWS. If something goes wrong with AWS, then our full Splunk Cloud Platform goes down. For enterprise on-premises, we have full visibility and can see what is affected and other details. Visibility is less in cloud and more in on-premises. I have not tried that feature. My overall rating for this product is 9.