Splunk Enterprise Platform Reviews

My team and I use Splunk Enterprise Platform for security monitoring, including collecting logs from firewalls, endpoints, servers, and cloud platforms, then compliance reporting, such as generating compliance reports for PCI DSS, SOC 2, and GDPR, log management including centralized logs from thousands of devices, infrastructure monitoring which includes monitoring CPU usage, memory utilization, disk space, and application monitoring including tracking application errors and response times, and various other purposes that arise day to day.

The most critical use case for Splunk Enterprise Platform is security monitoring and threat detection because we can detect cyberattacks in real-time, correlate logs from multiple sources including firewalls, EDR, IDS, IPS, and Active Directory, which enables SOC analysts to identify suspicious activity quickly. For example, about one week ago, an attacker tried to exploit a SharePoint vulnerability where Splunk Enterprise Platform detected multiple POST requests to suspicious SharePoint endpoints, then execution of powershell.exe by the SharePoint service, then the creation of unknown DLL files. We detected that potential SharePoint exploit affecting the server SP Web 01, with indicators including suspicious PowerShell execution, web shell creation, and multiple failed authentication attempts.

Every day, we use Splunk Enterprise Platform to check security dashboards by logging into the platform and reviewing SOC dashboards for critical alerts, failed login trends, and malware detections, then monitor real-time alerts by continuously watching for alerts such as multiple failed login attempts, privilege escalation, or data exfiltration. When an alert is triggered, we investigate it by searching logs and identifying the affected user or device, and we follow up by reviewing authentication logs and correlating events. Instead of looking at one log source, we correlate multiple sources including VPN logs, DNS logs, and CrowdStrike EDR. We also conduct threat hunting by proactively searching for suspicious behavior when there are no alerts, respond to incidents by creating or updating an incident ticket, inform the incident response team, isolate the affected endpoint, and continue monitoring and generating reports as part of our day-to-day workflow.

Splunk Enterprise Platform handles massive petabyte-scale environments well, but asserting strict data sovereignty such as complying with localized regulations that prohibit data from crossing borders requires deliberate architectural planning. The strengths I can mention include decoupled storage, and by leveraging smart store, we can separate our high-compute indexer nodes from our storage tier to allow us to scale to multi-petabyte levels without inflating our compute costs and ensures our cold data resides within our approved geographic borders. There is also distributed search, allowing us to query vast quantities of historical data stored in different geographic nodes or sites without needing to centralize all the raw data into one massive physical repository. The challenges we face include the complexity of cross-border queries; while we can keep data locally sovereign, querying datasets across international or inter-regional boundaries can strain bandwidth and increase search latency while relying on distributed federated searches.

The use of Splunk's Federated Search has evolved from a troubleshooting fix into a deliberate architectural strategy for reducing ingestion costs and managing compliance constraints. Initially, it served as a way to occasionally bridge distinct geographical Splunk Enterprise Platform clusters, but today it acts as an active data fabric layer that queries multi-cloud data lakes and external remote environments in place without moving raw data.

My experiences with maintaining granular control over data using a trusted control plane within Splunk Enterprise Platform reflect a major architectural shift, moving data governance from a retrospective cleanup activity to an in-flight policy enforcer. In-flight governance at the edge uses a centralized cloud control plane executed locally on-premises or within region-specific infrastructure which allows us to control data before it leaves our boundaries, employing granular filtering, masking, and smart in-flight routing. My experience with provider-level access control for Federated Search involves using granular control to manage data sovereignty; Splunk Enterprise Platform's introduction of provider-level role-based access control enhances our experience and data management capabilities.

In consideration of new use cases including agentic AI architectures, Splunk Enterprise Platform's governance and RBAC transition from a passive security checklist into active execution guardrails. The crucial role they play in managing access to operational data for these use cases involves limiting the blast radius. An agent utilizes the permissions of the service accounts assigned to it. Strict RBAC ensures an agent designed for network troubleshooting cannot access sensitive HR logs or financial transactions. Governance structures prevent LLMs from scanning unvetted data sources, stopping attackers from using prompt injection to trick an agent into exposing restricted system data. Access to operational data is managed through least privileged service accounts, whereby agents are assigned to highly specialized Splunk Enterprise Platform roles mapped to narrow indexes and limited data models. Real-time data masking using Splunk Enterprise Platform algorithms or ingest-time transformations strips PII and credentials before data hits the index, ensuring agents cannot interact with forbidden raw strings.

Among the best features that Splunk Enterprise Platform offers are real-time incident monitoring, real-time threat detection, the ability to investigate endpoints, a powerful Search Processing Language (SPL) which allows analysts to search and investigate huge amounts of data quickly, real-time alerts, dashboards, and data visualizations that greatly convert raw logs into graphs, charts, and reports. It also supports scalability, handling terabytes to petabytes of daily log data. It provides role-based access control which restricts data access based on user roles. It also features a machine learning toolkit that allows users to perform anomaly detection and predictive analytics. These features are critical for SOC analysts.

The most important feature for Splunk Enterprise Platform is SPL, which is the Search Processing Language, because it helps us search billions of events within seconds. It powers threat hunting and forensic investigations. It is used to create dashboards, alerts, and reports and almost every advanced feature relies on SPL. Strong SPL skills are among the most sought-after abilities for Splunk Enterprise Platform administrators and SOC analysts. For example, when a user reports that their account is compromised, with SPL we can quickly find all login events for that user, check failed login attempts, identify source IP addresses, see which systems were accessed, correlate activity with firewall, VPN, and endpoint logs, and build a timeline for the incident. A single SPL query can answer questions that would otherwise require checking multiple systems manually.

There are some useful features that Splunk Enterprise Platform users sometimes overlook, including data model acceleration which speeds up searches on large datasets, and this is very useful for SOC teams that need quick investigation results. There are also scheduled searches and automated reports which automatically run searches at set intervals and deliver reports to stakeholders without manual effort. Scalability is also important; whether we ingest a few GB or several TB of logs per day, Splunk Enterprise Platform's distributed architecture allows it to scale with enterprise needs. Role-based access control allows different teams to access only the data they need, which improves both security and compliance. These features highlight the capabilities that distinguish Splunk Enterprise Platform from basic log management tools and show its practical value in enterprise environments.

Splunk Enterprise Platform has had some of the biggest positive impacts on our organization, including improvements in incident response time. Before using Splunk Enterprise Platform, analysts needed to manually search logs across multiple systems, but with Splunk Enterprise Platform, we can centralize logs with real-time alerts and dashboards which improved our incident response times to be 50 to 80% faster in many SOC environments. In terms of threat detection, before using Splunk Enterprise Platform, threats were detected after a significant delay, but Splunk Enterprise Platform helps us continuously monitor and correlate rules detecting attacks within minutes which impacts earlier containment and reduces business impact. In terms of efficiency, we used multiple tools and manual log collection before Splunk Enterprise Platform, but with Splunk Enterprise Platform we have a single platform we can use for searching, monitoring, and investigations, allowing us to investigate more incidents with less effort. For compliance and auditing metrics, before using Splunk Enterprise Platform we needed to manually collect evidence and compile auditing reports, but with Splunk Enterprise Platform we can automate reports for compliance frameworks which save hours of manual work and improve audit readiness. These are the key improvements we have seen with using Splunk Enterprise Platform.

While Splunk Enterprise Platform is widely regarded as a powerful SIEM and observability platform, users across enterprises commonly report recurring challenges including licensing and data ingestion costs. Splunk Enterprise Platform's licensing is often based on the volume of data ingested, and as our organization grows, costs can increase significantly, and our teams may need to carefully decide which logs to ingest, which can limit visibility. A suggested improvement would be more flexible licensing options, better built-in recommendations for optimizing data ingestion, and smarter data compression or tiered pricing. There is also a steep learning curve where beginners can find SPL difficult. A suggested improvement would be more AI-assisted SPL generation, interactive tutorials, and guided dashboard creation with additional pre-built templates for common SOC use cases. These are the main areas for improvement that I can see: licensing flexibility, reducing the learning curve for new users, simplifying development, improving performance for very large datasets, and providing more AI-assisted features to reduce manual effort.

In terms of adding more improvements, there are frequently discussed areas including easier third-party integrations. While Splunk Enterprise Platform supports many integrations, onboarding new security tools sometimes requires custom configurations or add-ons. A suggested improvement would be more plug-and-play integrations, faster support for new vendors, and then simplified administration. Administrators often manage indexes, forwarders, user roles, and cluster health, so a suggested improvement would be easier administration dashboards and automated health checks. These are suggestions that acknowledge Splunk Enterprise Platform's strengths while highlighting areas where many enterprise users see opportunities for further improvement.

The primary areas for improvement that I see are licensing flexibility, simplifying administration, expanding plug-and-play integrations, and adding more AI-driven assistance for searches and investigations. These improvements would significantly simplify our tasks and help us solve more incidents in a lesser amount of time, making it flexible even for beginners.

I have been working for about 15 to 16 months in my current role, in the same project, in the same security domain only.

In my experience, Splunk Enterprise Platform has been a stable and reliable platform for day-to-day security monitoring and log analysis. It has consistently handled large volumes of data. The dashboards, searches, and alerting capabilities have performed reliably, though occasional issues such as slow searches or delays during peak data ingestion can occur. Overall, the platform has been dependable for security operations.

Splunk Enterprise Platform is highly scalable in my experience, efficiently handling increasing volumes of log data, users, and security events by scaling horizontally with additional indexers and search heads. As our environment grows, the platform continues to perform well with the right infrastructure configuration, but scaling requires proper planning for storage, compute resources, and licensing to maintain optimal performance.

I have not needed to contact Splunk Enterprise Platform support directly as the platform has been stable in our day-to-day operations. Most routine issues are handled internally by our team using Splunk Enterprise Platform's documentation and knowledge resources. Based on my current experience, I have not encountered major problems that required escalation to Splunk Enterprise Platform support.

Splunk Enterprise Platform delivers a measurable ROI by reducing manual effort, minimizing downtime, and improving security operations. When it comes to time saved, security analysts spend significantly less time searching logs and investigating incidents. In terms of employee productivity, the same SOC team can handle more alerts due to automation, dashboards, and correlation searches. Money saved includes faster incident detection and response, reducing the cost of security breaches, data outages, and compliance failures. For our enterprise, the key impact areas are generally time saved in investigations, higher analyst productivity, lowered costs of security incidents due to faster detection and response, and reduced manual reporting effort.

Regarding my experience with Splunk Enterprise Platform's pricing, it is a powerful but premium platform requiring deliberate optimization to manage high upfront costs, including high initial setup costs and then complex shifting licensing. While unit costs are high, the platform's ability to consolidate siloed tools into a single pane of glass provides immense value justifying the premium cost if the architecture is tightly managed.

I would recommend others to highly use Splunk Enterprise Platform because of its day-to-day usability, alert investigation capabilities, the time saved, and its highly accurate, scalable, and reliable support in day-to-day SOC operations. Splunk Enterprise Platform has greatly assisted in our day-to-day activities, and I would like to thank the Splunk Enterprise Platform team for providing us with a highly accurate and reliable platform that facilitates the maintenance of our day-to-day SOC operations. I would rate my overall experience with Splunk Enterprise Platform as a nine out of ten.

My main use case for Splunk Enterprise Platform is for doing data analysis. I can give you an example of how I use Splunk Enterprise Platform for data analysis. We are monitoring the infrastructure of the client, such as what systems they are using. It could be network devices, or it could be Windows or Linux servers. We get the infra-related data in Splunk Enterprise Platform environment, such as CPU, memory, and host status, and based on that, we do the configuration at our end. If any issues are there, we are generating the ticket. For example, if a disk is occupying more than 90% of its space, then based on that, we are triggering an alert. If any host is not responsive, we generate an alert such as 'host reporting no data'.

We are having multiple ways to use Splunk Enterprise Platform day-to-day. We have multiple environments, such as a high availability environment and a low availability environment. Based on the client's budget, we set up Splunk Enterprise Platform infrastructure. For example, with a high availability environment, the cost will be more, but the availability of the monitoring tool will be high. That is called the clustered environment. If a client has a low budget and they have a smaller number of servers to monitor, then we will go for a distributed environment.

The best feature of Splunk Enterprise Platform is data insights. The data is very quickly searchable. The data is stored in an index. If you have a very large amount of data and you put it in Excel, it will take a lot of time to work on it and get the insights, such as the exact error logs. But in Splunk Enterprise Platform, data is stored in a TSIDX file. We have an index to get the data, so you can quickly get a look at your environment's data. The visibility is very high.

Suppose a thousand servers are under monitoring. All the data from those thousand servers is ingested into Splunk Enterprise Platform. If any of the servers go down, it will quickly create an alert, irrespective of how many. Even if a thousand servers go down, it will create the alert quickly. The investigation is very easy. We have a set of indexes where data will be stored. We will have log files, we will have the log data, so the analysis is very easy.

We also have vendor support. If my environment is not working or is showing an error, the vendors provide support on time. The security level is also very good. Whenever any vulnerability is detected, the vendor will inform us, and they will come up with the latest version so that we can do the upgrades. The documentation part is everything very transparent.

Whatever problem the client comes up with, for example, 'My environment has this many servers, and we cannot do it because it is at different locations,' it cannot be manually monitored. There should be a one-stop destination so that we can monitor all the environments. In that way, Splunk Enterprise Platform is playing a very important role in our organization to serve clients better.

The response time is reduced because within 5 to 15 minutes, if any issue occurs with the server, it will generate an alert. If the system comes back up, there is an automation process, so the ticket will auto-resolve as well. However, the footprint will always be there. It will show exactly when the issue happened. It is saving time also because whatever data we are getting, it is taking less time to parse, index, and process the data and give us the ticket.

Regarding improvement for Splunk Enterprise Platform, compatibility is needed. They are coming out with a newer version every two months, and there is the vulnerability part. When they are releasing any version, they need to check it from a security point of view completely. The remediation they are providing is in the newer version. In the existing version itself, they can review it and provide the fixes so that every two or three months, we do not need to go for upgrades, because upgrades take some time.

The Splunk experts are there who are involved and have the knowledge to do the integration. Everything is fine. The only thing is the vulnerability part, which is the only flaw I observed.

I have been using Splunk Enterprise Platform for the last five years.

Splunk Enterprise Platform is stable.

The scalability of Splunk Enterprise Platform is very good. If we are talking about the cluster setup, you can add more indexers, more search heads, and more heavy forwarders. You can add more components based on your requirements. Scalability is very easy in Splunk Enterprise Platform.

Customer support is also top-notch. We are getting the support. They have on-call support and email support.

Multiple options are available, such as Dynatrace and DataDog, but Splunk Enterprise Platform is the leading one nowadays because it provides security features as well. Splunk Enterprise Platform was acquired by Cisco, and Cisco is a big player in security. Splunk Enterprise Platform is a good one, and it is also cost-saving. It is not charging more. It is charging based on indexing the data only, so we are good with Splunk Enterprise Platform.

Governance and security within Splunk Enterprise Platform is good. Whenever they find any vulnerability, they immediately inform their customers, telling them to stop using something and providing the fixes. They come up with it immediately. Splunk Enterprise Platform itself was bought by Cisco, so from a security point of view, they are getting better now.

Directly, as of now, we are not integrated with agentic AI, but we are using agentic AI for the troubleshooting part. It will take some time to integrate it, but these things will be there. However, everywhere, human intervention will always be there. It cannot allow the AI to go and change the configuration without the permission of a human being.

Splunk Enterprise Platform has high capability. It is capable of handling that much data. It will use more resources, but it can handle it.

We have used the federated search feature of Splunk Enterprise Platform because the client had location-related security requirements. We have the option and the feature where we can hold the data there, and it can be searched from one location. The data will be stored in a different location, but it can be searchable from one destination. It is very helpful. The environment is providing a very reliable solution to us.

Splunk Enterprise Platform has a very good feature. You can mask the data while indexing it. If you are talking about the access part, we have multiple access levels available. If you want to limit the access to particular data for a particular team, we have that option. We can create a customized role, and it also has in-built roles. Based on that, a dedicated user can only access the dedicated data.

Nothing is missing because Splunk Enterprise Platform has very strong capabilities with multiple roles, and we have customized roles as well. For the login process, we can use SAML and LDAP. It is a very good platform that provides you with a way to maintain data security. The governance tools provided by Splunk Enterprise Platform are very good.

The cost saving is a shared resource for multiple projects. We can work for 10 to 12 or 15 projects with Splunk Enterprise Platform skill set. I am working as an admin and developer, so that part comes under the architect team. We have a dedicated team that decides the pricing, cost, and licensing based on the client's requirements, such as how many servers are under monitoring. For a thousand servers, it should go with a clustering environment and high availability. It totally depends on the demand of the client.

Because we have 10 to 12 projects and 10 to 12 associates, there is no dependency. If someone goes on leave, everyone else has access to all the projects, so there is no dependency. Everyone can work on any of the projects, so it is good. You do not need to put two dedicated people there, and if those two people are not there, then who will work? There is no such issue. With shared responsibility and shared resources, it is working very nicely with less cost.

I would rate this review an 8 overall.

My usual use cases for Splunk Enterprise Platform involve all NOC and SOC activities, where SOC-related alerts will be aggregated with NOC-related alerts, allowing for correlation between them, including use cases such as abnormal travel and anomaly detection, all of which are detected by Splunk Enterprise Platform.

For instance, if there is a DDoS attack indicated by an anomaly in the traffic when WAF is integrated, an alert is generated in Splunk Enterprise Platform, which our L1 and L2 teams will then visualize and remediate based on the alert.

I do not use Splunk Enterprise Platform's Machine Learning Toolkit directly, but my team utilizes it.

Splunk Enterprise Platform's Machine Learning Toolkit has helped us with predictive analytics in our organization significantly, as it automates the anomaly detection that previously required our L1 and L2 teams to spend three to four hours on.

It immediately triggers alerts upon detecting patterns such as WAF spikes or suspicious login behavior, allowing our L1 to avoid manual analysis and triaging. The predictive analysis reduces false positives, enabling our analysts to close tickets swiftly—previously taking two to three days, and now they close them before breaching the SLA due to effective pattern discovery and outlier detection.

Splunk Enterprise Platform's Machine Learning Toolkit is efficient in detecting abnormal login attempts and brute force attacks, effectively aiding our proactive defense planning through advanced analytics and anomaly detection.

Splunk Enterprise Platform's most valuable features include its integration with AI, as Cisco, which has taken Splunk Enterprise Platform recently, is building up AI functionalities, enhancing remediation capabilities and the orchestration part in the market. Additionally, Splunk Enterprise Platform shows the correct logs at the correct time, and inventory management is very good.

I assess the effectiveness of Splunk Enterprise Platform in detecting anomalies and preventing system outages as very strong; for over two to three decades, it has provided centralized log visibility, real-time monitoring, and analytics correlation, which is robust for threat detection and incident investigation.

Splunk Enterprise Platform's machine learning capability of the toolkit predicts trends and reduces many false positives, making Splunk Enterprise Platform an essential tool for both SOC and network operations, where it effectively detects anomalies that other SIEM tools cannot.

Splunk Enterprise Platform's personalized dashboards are superb, as I have been experimenting with them extensively, and new features have enhanced their quality, making them particularly effective for presentations to leadership, including direct engagement with the CISO.

In terms of improvement for Splunk Enterprise Platform, as more companies embrace AI, adding more AI automations is crucial and could parallel what competitors such as Xplain are doing. Managing duplicate alerts efficiently can optimize costs, as the current license-based data ingestion can quickly escalate if duplicate data is fed.

Better filtering of unnecessary log sources could greatly interest clients by demonstrating cost efficiency. From an architectural standpoint, data onboarding, normalization, performance, and scalability improvements would be beneficial, particularly in optimizing search speed and query execution to handle larger searches efficiently.

I have been working with Splunk Enterprise Platform for the last 10 years as a Splunk certified power user and advanced user, and along with Splunk Enterprise Platform, I am using Palo Alto's Cortex XSOAR and Azure Sentinel continuously for over 10 and 12 or more years.

I evaluate the stability and reliability of Splunk Enterprise Platform as very high; we utilize it for both SOC and NOC operations, and our L1 and L2 teams get real-time alerts and query the SPL effectively without delays that other SIEM solutions may impose.

Splunk Enterprise Platform is scalable; we have already adapted it from SOC to NOC operations while maintaining good indexing practices that prevent overload and ensure clear searches, maximizing performance in large SPL queries.

My L1 team regularly communicates with Splunk Enterprise Platform's technical support, which is very helpful.

I would rate the technical support from Splunk Enterprise Platform around eight on a scale from one to ten, where one would be the worst and ten would be the best.

Before using Splunk Enterprise Platform, I utilized Azure Sentinel in my previous company at Deloitte, prior to leaving.

Although I did not participate in the initial setup, I provided mentoring for the team under me who managed the implementation because I have spent 14 years in the industry, which included hands-on implementations earlier in my career.

Splunk Enterprise Platform's implementation is very straightforward; I do not feel there is a significant difference from the implementation point of view, as everything is clearly documented by Splunk Enterprise Platform.

We are a customer of Splunk Enterprise Platform, currently at Aramex, and we bought a vendor from Capgemini who has actually implemented Splunk Enterprise Platform for us, so we are not directly linked with Splunk Enterprise Platform but rely on our vendor to use Splunk Enterprise Platform for us.

Splunk Enterprise Platform's dashboards significantly improve data interpretation, providing immediate real-time visibility on top trending alerts and live data without needing to run queries repeatedly. They aggregate metrics and highlight trends such as threat overviews and MITRE ATT&CK mapping, which reduces the workload for our L1 and L2 teams.

Pre-built alerts for anomalies in login attempts, failed attempts, or geolocation mapping are very visible in Splunk Enterprise Platform's dashboard, which plays a critical role in providing real-time visibility into security events and network activities.

Splunk Enterprise Platform's application management feature enhances end-user experiences by providing organized dashboards that monitor application usage and configurations, facilitating faster detection and query execution. It logs metrics into applications that reveal usage patterns, anomaly detections, and attack occurrences, while also ensuring proper governance and versioning of applications.

I consider Splunk Enterprise Platform an expensive tool because budget constraints from license-based data ingestion costs are significant. Costs can escalate rapidly when duplicate data is processed, which Splunk Enterprise Platform can identify to help clients save directly on unnecessary spending.

I leverage Splunk Enterprise Platform for advanced threat detection, which is critical for our SOC operations. Threat intelligence and detection are vital, especially since Cisco's acquisition of Splunk Enterprise Platform has integrated Talos into it, enhancing our ability to monitor for IP reputation and potential attacks, while also keeping an eye on advisories regarding application vulnerabilities. I would rate this product overall at a nine out of ten.

I have implemented the complete Splunk Enterprise Platform structure in my previous organization, implementing the platform, creating use cases, dashboard queries, creating dashboards, and onboarding different devices via Syslog and API.

Splunk Enterprise Platform has a vast and versatile powerful search engine with which I can handle all queries, and creating use cases and the search and dashboard is the main selling point, allowing me to visualize live dashboards.

The platform has a powerful search engine, allowing the integration of custom AI such as ChatGPT. Splunk Enterprise Platform also has its own Phantom as a SOAR, which is much more refined and gives more accurate results than any other AI integrated SIM tool. In anomaly detection, I can live track anomalies and change the registry.

Splunk Enterprise Platform serves as a time-saving solution because integrating other sources such as Syslog or router switch firewall is much easier.

The cost is the most significant area for improvement in Splunk Enterprise Platform, as it is quite expensive, causing many clients to differ due to this reason. Otherwise, I don't see that Splunk Enterprise Platform requires further improvement because it is the number one tool.

The cost remains a significant point of concern.

I have 2.5 years of experience with Splunk Enterprise Platform.

The stability depends on how aggressively the environment changes. If I am providing network services, it can be challenging due to continuously changing firewall configurations.

Splunk Enterprise Platform is stable when not integrating or adding new devices continuously.

I consider Splunk Enterprise Platform a scalable solution since it has different components, and if the server is down, I can upgrade the server resources or create a new node for performance optimization.

I have never used their technical support because everything is available on their website and documents. It is crucial for anyone looking to deploy Splunk Enterprise Platform to first certify for their courses, such as the Splunk Administrator and the Power User Administrator certifications, which address all troubleshooting queries.

Positive

The initial setup of Splunk Enterprise Platform depends on the user; if set up in a Windows environment, it is much easier, requiring just clicking on the wizard and following the steps. In the Linux environment, it is quite hectic, but manageable compared to Wazuh, where I have to integrate the GPC API key alongside the installation. In Splunk Enterprise Platform, I only need to download and configure a single file, making it easy to manage.

I have expertise in Splunk Enterprise Platform tools, including Splunk Cloud, having experience working with other tools such as IBM Security QRadar.

We are a managed service provider (MSP), and we provide services using Splunk Enterprise Platform.

Splunk Enterprise Platform holds the number one position in Gartner, and integrating different types of tools and creating use cases is much more streamlined compared to other tools such as IBM QRadar and AD audit, managing the log 360.

The platform has a powerful search engine, allowing the integration of custom AI such as ChatGPT. It also has Phantom as a SOAR, which is more refined and gives more accurate results than any other AI integrated SIM tool. In anomaly detection, I can live track anomalies and change the registry. While working with Wazuh, when I integrated the Cortex XDR, there was a mismatch of events sometimes, making it tedious, but in Splunk Enterprise Platform, I just need to log into the console and everything is there, making it an all-in-one solution.

I rate Splunk Enterprise Platform 9 out of 10.

Splunk Enterprise Platform serves as our primary solution for centralized log management and security monitoring. We collect logs from multiple systems and security devices into a single platform to investigate incidents, troubleshoot issues, monitor suspicious activity, and create dashboards and alerts for better operational visibility. The platform also helps us correlate events from different log sources, making investigation faster and more efficient.

For example, an organization received an alert about suspicious PowerShell activity on a Windows endpoint. Using Splunk Enterprise Platform, the analyst searches for the affected hostname and username, then correlates Windows Event Log, Active Directory authentication log, firewall log, and endpoint security log. The timeline shows that the user logged in from an unusual IP address or executed a PowerShell command and then attempted a connection to multiple internal servers. Because all relevant logs are available in one place and can be correlated by timestamp, username, and host, the analyst can quickly understand the sequence of events and determine the scope of the incident without manually checking multiple systems.

Splunk Enterprise Platform's Search Processing Language, real-time search and alerting, and customizable dashboards are the most valuable features I have found. The Search Processing Language makes it easy to search and analyze large volumes of log data to quickly identify issues or security events. The real-time alerting capability has helped us detect critical events as they occur, allowing for faster response. I appreciate the flexibility of dashboards, which can be customized to display key metrics and operational insights for different teams. Additionally, Splunk Enterprise Platform's ability to ingest data from a wide range of sources and correlate events across multiple systems provides a comprehensive view of the environment, making troubleshooting and incident investigation much more efficient.

The Search Processing Language is the feature I rely on the most in Splunk Enterprise Platform. It allows me to quickly search and analyze large volumes of log data, filter relevant events, and identify the root cause of issues much faster than manually reviewing logs. Whether I am investigating a security alert or troubleshooting an operational problem, the Search Processing Language helps me pinpoint relevant information efficiently, making it the most valuable feature in my day-to-day work.

Overall, the feature set of Splunk Enterprise Platform is comprehensive and flexible. The combination of centralized log management, powerful search capability, customizable dashboards, and real-time alerting enables teams to monitor their environment, investigate incidents, and troubleshoot issues from a single platform. The extensive integration support also makes it easy to bring together data from different systems, providing better visibility across IT and security infrastructure.

Organizations commonly report that Splunk Enterprise Platform improves visibility across their IT and security environments by centralizing logs from multiple systems. This can help security and operations teams investigate incidents more quickly, reduce the time spent troubleshooting issues, and identify potential problems through real-time monitoring and alerting. Many organizations also use dashboards and reporting to gain operational insights, support compliance activities, and make more informed decisions based on machine data.

One area where Splunk Enterprise Platform could be improved is its licensing model, as costs can increase significantly with higher data ingestion volumes. The initial deployment and data onboarding process can also be complex, especially for large environments. Additionally, there is a learning curve for new users when working with the Search Processing Language and building advanced dashboards. Simplifying administration, improving the onboarding experience, and providing more built-in templates and guided analytics would make the platform easier to adopt and manage.

Another area of improvement would be performance optimization in very large environments where complex searches can take longer to execute if they are not properly optimized. It would also be beneficial to have more artificial intelligence-driven analytics, automated recommendations for search optimization, and pre-built dashboards and use cases.

I have been working in this field for approximately four and a half years.

Splunk Enterprise Platform is highly stable.

Splunk Enterprise Platform is highly scalable and is designed to support organizations ranging from small deployments to large enterprise environments. It can ingest and analyze increasing volumes of data by adding indexers, search heads, and other components as requirements grow. The distributed architecture allows organizations to expand capacity while maintaining performance and reliability. Proper infrastructure planning, data management, and search optimization are important to ensure the platform continues to perform efficiently as the environment scales.

Splunk Enterprise Platform was our primary log management and analytics platform, so we did not migrate from another SIEM or log management solution. We selected it because of its powerful search capability, scalability, broad integration support, and ability to centralize logs from multiple systems for monitoring.

We did not conduct a formal evaluation of multiple solutions before adopting Splunk Enterprise Platform. The decision was primarily based on its strong reputation for log management and analytics, extensive integration capabilities, powerful search functionality, and its ability to scale to meet enterprise security and operational requirements.

Before implementing Splunk Enterprise Platform, I clearly define my use cases, identify the log sources I want to onboard, and estimate my expected data volume to plan licensing and infrastructure appropriately. I invest time in learning the Search Processing Language and designing an efficient ingestion strategy, as these have a significant impact on performance and usability. It is also a good idea to start a phased deployment, build dashboards and alerts around your highest priority use cases, and establish governance for user access and data retention from the beginning. This approach will help me get the most value from the platform while keeping the deployment manageable.

We have seen operational benefits, although we did not formally measure ROI with specific metrics. Splunk Enterprise Platform helped reduce the time required to investigate incidents by centralizing logs and providing powerful search capabilities. This improved analyst productivity and troubleshooting efficiency. The biggest return has been better visibility and faster access to relevant data, rather than a measurable reduction in headcount or quantified cost savings.

The pricing for Splunk Enterprise Platform for large volumes is on the higher side compared to some alternatives, especially for organizations that ingest large volumes of data. The initial setup requires investment in implementation, but once deployed, the platform provides strong value through its scalability and extensive capabilities. The licensing model is straightforward but requires careful planning to manage data growth and costs. For organizations that prioritize security and IT operations, the overall value generally justifies the investment.

My organization has tracked TCO metrics for the non-indexing analytics approach to evaluate the success of reducing TCO with Splunk Enterprise Platform's non-indexing analytics approach.

Splunk Enterprise Platform provides useful artificial intelligence-assisted capabilities that can help improve security operations and data analysis. From a governance and security perspective, I think it is important that artificial intelligence features respect existing role-based access control, maintain audit logs, and protect sensitive data. Organizations should also have clear policies around how artificial intelligence is used, what data it can access, and how artificial intelligence-generated insights are validated before taking action. Overall, the artificial intelligence capabilities are promising, but strong governance, transparency, and data protection are essential for enterprise adoption.

Artificial intelligence capabilities in an enterprise security platform can significantly improve productivity by helping summarize data, identify patterns, and assist with investigation. However, the accuracy and reliability of the output depend on the quality of the underlying data and configuration. Artificial intelligence-generated insights should be treated as decision support rather than definite answers, and they should always be validated by security analysts before taking action. I provided this review with an overall rating of nine out of ten.

The team I work on is a workflow team for the bank. We get a lot of traffic because of onboarding and workflow processes, which results in around a million hits per day. Whenever we have a release scheduled, Splunk Enterprise Platform is a very useful tool for me to monitor the logs.

Splunk offers an advantage where I can log and monitor all of the microservices in a single location. Search Processing Language (SPL), which is the query language for the product. SPL does take time to master as it is somewhat complex. When searches are straightforward, then it is quick, but if you need to perform complex searches with multiple pipes, sub-searches, or statistical functions, then it becomes somewhat confusing. You need time to become familiar with it.

I created some Splunk Enterprise Platform dashboards, which is the main focus of my work. I used a drag-and-drop builder, and it has real-time updates, visualization varieties, drilldowns, and token inputs. I built a dashboard for the application which answered these questions: which workflow combination has the highest hits and which users are triggering them. I wrote a query using SPL which aggregated the results from the API in the given timeframe that we can choose, and accordingly it will show a pie chart. Using the drilldowns and tokens, I built another panel where if you click a particular combination, it will list the number of users hitting that combination and how many times. This is something very useful I found in Splunk Enterprise Platform dashboards.

Regarding the downsides of Splunk Enterprise Platform, as I mentioned, one is the Search Processing Language is somewhat complex when it comes to complex filtering and searching. You need to become familiar with it to make complex searches. That is one thing.

There is not a no-code option for panels. You have to write an entire query for it. It would be better if they could introduce more drag-and-drop options so that people can add more features to their panels and pie charts and visualize the data they want.

I have been using Splunk Enterprise Platform for 1.5 years.

Considering the stability of Splunk Enterprise Platform, it is pretty stable. It sometimes takes time when I switch the timeframe, such as from 15 minutes to one hour. It takes some time in loading all of the logs from the application. Otherwise, it is very stable. It is a latency issue.

As I mentioned, the current application I was working on already has a lot of users. So it is a pretty scalable solution. We get millions of hits for the APIs.

When I joined the company, Splunk Enterprise Platform was already in place from the very start. Many of my friends work in several different companies, many uses DataDog, but here, I have only used Splunk Enterprise Platform.

I am not involved in those kinds of decisions yet. I do not know about the pricing.

The whole bank uses the same tool to monitor their logs and analyze production data or any environment data. That is why I have not had any chance to use an alternative.

I am not familiar with the pricing because being a junior developer.

Splunk Enterprise Platform offers Federated Search, which I have not used.

My overall review rating for Splunk Enterprise Platform is 9 out of 10.

In terms of using Splunk Enterprise Platform, we use it for our SOC environment where we have an ES setup separately. We collect logs from various sources like AWS, EDR logs, firewall logs, WinEvent logs, Linux logs, application logs, and specific service logs.

We gather that and based on that, we are providing users dashboards, searches, and alerts.

In terms of my favorite features of Splunk Enterprise Platform, it has vast customizability. It is very customizable. I can customize it according to my use case. Or if I have any restrictions in my environment or client environment, I can customize it according to my requirements. It is not something where I need to go with the straightforward way.

For a specific feature of Splunk Enterprise Platform, I appreciate the custom commands and custom endpoints by using which I can build my Splunk apps.

When concerning the cost of Splunk Enterprise Platform, the license cost can be a factor. The pricing is based on limited factors. There are two types of pricing where we have licensing based on the data or logs which we are indexing by size.

It can also be based on if we are purchasing the cloud platform, then it can be based on multiple factors such as how much data we are searching daily or a limit on that. Usually for 10 GB of license and two years of retention, it costs around $20,000 to $30,000.

Based on my thoughts about Splunk Enterprise Platform, I would rate it a seven or eight because the only thing I'm keeping in mind is the licensing cost. Otherwise, the overall product is good, its features, its customizability, and scalability are all excellent. The only factor is the licensing.

If they were providing a license to small customers, if they target small customers, it would be really great.

If they provide a small license to small customers, or if they bring some new licensing for small customers for the specific use case on top of Splunk Enterprise Platform, that would be beneficial.

My experience with Splunk Enterprise Platform is approximately two and a half years.

In terms of Splunk Enterprise Platform stability, I would rate it nine out of ten.

When considering scalability, Splunk Enterprise Platform is very scalable. I would rate it nine out of ten.

I have contacted support for Splunk Enterprise Platform multiple times. For our architecture specifically, we have contacted Splunk support. The add-on which is being provided by Splunk support was generating an error in our environment. For that, we contacted support and they were able to provide us with the solution which is currently working fine.

Regarding alternatives to Splunk Enterprise Platform, I have tried to use other tools, but they are very specific to some use cases only. I have preferred to use Splunk because it works with all my use cases and all the log or source types. I tried Dynatrace and DataDog, which provide observability, but that was not as useful to me.

In terms of ease of use with Splunk Enterprise Platform, it is very easy and straightforward. All the steps are mentioned in their documentation. All the guides which are required or the prerequisites that must be there before installing or setup, are in their documentation. The community is also very good. We have enough description about the installation steps, which is what makes it easiest.

Using Splunk Enterprise Platform requires maintenance. In terms of maintenance, it will be specific. If we are making any changes, then we must schedule maintenance because it will restart its services and we must accept the downtime. If we are upgrading our environment or any specific apps that are present in our environment, then we must have maintenance for it.

I would rate this review an eight overall.

In my enterprise work as a consultant, I designed most of the architecture based on customer use cases and requirements. For the use case part, we can convert data into CSV to JSON with the ingest processor, which is a good point for data reduction. We create security alerts, notifications, and many data models to monitor data for compliance purposes.

Regarding Federated Search, it is an excellent feature. We have a separate environment where we can search data from different complete stacks or different complete Splunk infra. We have one platform with a complete environment for SIEM and another environment for observability. We enabled Federated Search between both of these environments. Any observability team can get data from the SIEM, and the SIEM team can get data from observability.

What I appreciate most about Splunk Enterprise Platform is that one of the best features is its ability to support customization. You can customize anything in Splunk Enterprise Platform. We have scripted input, normal file monitor, port monitoring, and many add-ons. Splunkbase is one of the biggest app and add-on stocks available. It supports everything you need. Wherever your data is, we can retrieve it. This is one of the best things about Splunk Enterprise Platform.

What I dislike about Splunk Enterprise Platform is the props and transforms functionality. For most types of data, we have custom add-ons and everything is available, but for some data we want to parse, the add-on is not available. Then we need to write manual props and transforms. Sometimes there are many issues with the Regex. When you write Regex, it may not work properly. In the Regex101 platform, you find Regex working, but when you apply it to Splunk Enterprise Platform, it is not working. Therefore, props and transforms, such as parsing of the data, are not that reliable.

Regarding maintenance, I don't think there is a strict maintenance requirement, but we need to continuously monitor the platform. For example, when Splunk version upgrades come in, we need to upgrade. Continuous monitoring is required. Sometimes knowledge bundle size increases, sometimes an alert is not running, and sometimes we have search head cluster replication factor down. Many kinds of issues are present with Splunk Enterprise Platform because you have your own infrastructure. This could be a plus or minus at any time, which is where we need to focus on maintenance.

Regarding the feature called Trusted Control Plane, I am not familiar with it. Is it in Splunk 10x or what?

I have been using Splunk Enterprise Platform for eight years.

The stability of Splunk Enterprise Platform is very good. There are no stability concerns.

Scalability is also good. There is not much configuration required. If you want to expand anything, you can increase more indexes or add storage. There is a separate storage tier that you can expand however you want. It supports both vertical and horizontal scaling. You can grow the environment without difficulty.

I was working directly with Splunk when I worked at Splunk.com as a Site Reliability Engineer with the data system. There we directly supported all Splunk customers by upgrading their environments, installing apps, and performing Splunk version upgrades. We handled many tasks such as changing configurations. For everything that a customer raised a support case for, we were the ones who provided support.

I have contacted Splunk support myself. I worked with two clients, including Emirates Airline, which I am currently working on. I raised support cases many times, including ODS cases. Regeneron Pharmaceuticals was another customer, and I raised many technical support cases for them.

I would rate Splunk support a nine because they are very good and very technical. They provide solutions on time, which is something I appreciate.

The initial deployment of Splunk Enterprise Platform is simple and very easy. You need some training before you do it. For a single instance, it is very easy. You just need to unzip the package and install it. However, if you want to set up clustering, search head clustering, indexer clustering, and other configurations, you either need to read the documentation or complete the architect labs. For me, it was very easy because I was an architect and consultant at that time.

Regarding pricing, it is costly. I don't know the exact numbers, but it is very expensive. However, it is worth it when you are using it properly. When you have a proper SIEM, proper data, and everything is in compliance, and you use Splunk Enterprise Platform to its full potential, then this investment is worth it.

I have used alternatives, and most of the customers are using Cribl for parsing because it has the best UI and visual elements. In Splunk Enterprise Platform, we need to write the files, but Cribl offers a visual approach, which is better.

I was working with Emirates Airline, where we take a license from Splunk and use Splunk Enterprise Platform. We have our own on-premises infrastructure. I am a customer of Splunk Enterprise Platform. I would give this product an overall rating of nine.

I still work with Splunk Enterprise. I want to clarify that I am only working with Splunk Enterprise, not with Splunk AppDynamics, Splunk Cloud Platform, or Splunk Enterprise Platform. I am solely focused on Splunk Enterprise for my current work.

I have been working with this platform for almost the last five years, even more than that. Overall, it has been around 17 years that I have been working in IT and with software in general, not only Splunk but other software as well. That was really good. The primary use for us was anomaly detection and system outage prevention, and Splunk was definitely helpful to us in those areas. The personalized dashboards in Splunk have helped me significantly with my overall workflow.

We are using Splunk Enterprise Platform for advanced threat detection. The Splunk feeds go through different systems for SIEM audits, and we utilize them from there. Overall, Splunk Enterprise Platform impacts my organization positively, and I can see the benefit from using the product.

For improvement, I do see a lot of issues with Splunk support, particularly with response times. When there is an issue, finding the root cause is taking too long. The system shows some error infrastructure-wise, but that error is not directly linked with the problems. There are some delays with the response time from their technical support, and I am not very satisfied with their work in this regard.

I have been working with this platform for almost the last five years, even more than that.

There was no complexity with implementation. It was straightforward for me and my team, with no complexities involved.

I do not see any challenges with scalability right now. Integration with third-party tools is quite easy, and I have not noticed any difficulties in this area.

Regarding the technical support of Splunk, there are some delays with the response time, and I am not very satisfied with their work in this regard.

Positive

Before Splunk, I worked with Dynatrace and AppDynamics. Splunk is the one directly used for log analytics and anomaly detection. I have not worked with any competitors such as Datadog.

We were moved from AppDynamics to Dynatrace. We used AppDynamics more for transaction tracing. From there, we were strategically moved into Dynatrace. For the entire log monitoring, we still recommend Splunk Enterprise Platform. We still use Dynatrace for the other transaction trace and other services. The reason for switching from AppDynamics to Splunk Enterprise Platform was that we needed a dedicated solution specifically for log monitoring and anomaly detection.

I cannot say directly about cost reduction, but it is returning on our platform in terms of detections. In terms of finance, I do benefit from Splunk Enterprise Platform, and it provides a return on investment.

Right now, the Enterprise version is reasonable. When we go for Splunk Cloud or something similar, we recently had negotiations, and that is acceptable. When it comes to Enterprise, it is definitely reasonable in terms of pricing.

We are not using Splunk's Machine Learning Toolkit directly, but the Splunk feeds are still going back to the originating machine learning systems.

I am working with Splunk Enterprise Platform, and I have worked with Enterprise and ITSI, both. Sometimes I have worked with ES also, Enterprise Security.

I use Splunk Enterprise Platform mostly for log monitoring. In our company and our projects, we are monitoring for log monitoring, we are using Splunk. After that, we have created some dashboards according to our requirement and alerts and reports. Sometimes for historical data, we have created summary indexing. We are managing our Splunk Enterprise Platform infrastructure like search head, indexers, deployment server, and license master. We have 1,000, you could say 10,000+ UF. Some of them we are using with apps like Splunk DB Connect. For Kafka, we are using different add-ons for sending our data to Splunk Enterprise Platform from different log paths and log sources. That is the main use for Splunk Enterprise Platform. Mostly we are using it for log monitoring.

When I talk about Splunk Enterprise Platform, I can say that Splunk Enterprise Platform is, whatever the tool I have worked from my last eight, nine years of experience in my overall corporate journey, a very powerful tool where I can customize everything as per my requirement. There is no hesitation and there is no limitation for my customization. Whatever I want, I can do that from Splunk Enterprise Platform. If I am talking about tools other than Splunk Enterprise Platform, they are not very vast, or not good enough to customize. Here I can customize. If I need to customize from backend side, I can do whatever using Python, Java. If I want to create some things, that is a different thing. In every project, the requirements differ. If I need JavaScript in my platform, in my dashboard, where I want to customize and play with the dashboard according to my requirement, I can use JavaScript. I send the data, I can use Python script to send the data to Splunk Enterprise Platform. There are very different things. Mostly the SPL, which I am using, has already covered most of the things. But for what is not covered, I can use some different things also.

In my opinion, the effectiveness of Splunk Enterprise Platform in detecting anomalies for preventing system outages is very good. It is improving day by day.

When I talk about the personalization dashboard in Splunk Enterprise Platform, I can easily customize my dashboard.

Even if people do not know about Splunk Enterprise Platform, they want to create the dashboard, they can just drag and drop. They can add a widget and choose some visualization like a bar chart. If they do not know about the XML or the backend of their dashboards, they can still do it from the UI only.

The Application Management feature in Splunk Enterprise Platform may help enhance the end-user experience, but I need to check that.

Advanced threat detection in Splunk Enterprise Platform is very good enough to detect anomalies and detect vulnerabilities. Splunk Enterprise Platform has a different product called Splunk ES, which is a very good product in cybersecurity. I can easily detect some problems, and it automatically sends alerts. The anomaly detection is very good for live production data. Whenever an anomaly comes in an application, it automatically resolves and just gives the notification. It creates incidents or whatever is needed, where I can integrate with different tools like PagerDuty, Moogsoft, or even send my data into Slack if I am not using ServiceNow.

For a potential area of improvement in Splunk Enterprise Platform, I can say to try to make it easy for the user and user-friendly.

Simplifying the UI would help, because not everybody has it in their knowledge. If you want to sell your product, you will go with the company CIO, Chief Information Technology Officer. I do not think he will be working on that project; he will be working on your tool. Their resources, their employees will be working on Splunk Enterprise Platform. If you will show them the UI where they can understand, even if they do not know about any coding, they can just play, drop, and drag. If you satisfy them, then anyone will work on their tool in their company. I just want to give you the business perspective, because if you talk to any CIO, they are looking first at the UI part. They will not look into the coding part; they will just check the UI. If the UI is user-friendly, it will attract every person.

There is very much improvement needed from Splunk vendor support side because they need to check what people are raising in the requests. They do not understand the concerns people are raising. I do not think Splunk is working on their application support, I believe they hire third-party people who do not know as much about Splunk Enterprise Platform.

Regarding deep knowledge of the product, I am talking about the technical aspects. If anyone says something is not working, it seems many cases I have raised where they do not reply to my request adequately. That is why I say there is a requirement for improvement.

I have been working with Splunk Enterprise Platform for the last six years.

From one to ten, I would rate the stability for Splunk Enterprise Platform as a nine.

I would rate the scalability as an eight.

For technical support from Splunk, I can say it is a two only.

Neutral

The setup process for Splunk Enterprise Platform is very simple.

In my opinion, the main competitors for Splunk Enterprise Platform in the Enterprise Platform market are Dynatrace and DataDog. Recently, at a Dynatrace conference, they mentioned their goal to beat Splunk Enterprise Platform in the future.

DataDog is also relevant. For open-source options, ELK is available for those who need a more budget-friendly solution since Splunk Enterprise Platform is not open source and is quite costly.

I am working with Splunk Enterprise Platform and Dynatrace, and my feedback was really valuable for us.

I am using Splunk Enterprise Platform, and I am combining it with a Cloud platform, AppDynamics, and SOAR.

I worked with Splunk Machine Learning Toolkit, but that is a different thing. I have not worked so much on the MLTK side, so I cannot say anything, I cannot give more of an idea or feedback on that.

The ability to manage applications through Splunk Enterprise Platform is something I need to check.

I am talking about Splunk Enterprise Platform, and there is a lot it provides to the end user. The first thing for Splunk Enterprise Platform is that I can organize my data, like the Common Information Model, CIM, where there are different departments in my company and different application owners. Accordingly, they can set their data, which they do not want, they can just skip that. Whenever they need, they just use the simple one, and that data will be present. In one umbrella, they can see different locations and different data. In any organization, I have to organize my data. If I do not organize my data, then it would be very difficult to find it.

Directly, if I just check my application, I can enter my application, like in Linux. I just enter index equal to Linux, and it gives me all the details. Even in the dashboard, I select Linux, and it shows all the data, including vulnerabilities, CPU usage, and memory usage.

This is a really good point. Because people are not working on their tool. If I tell any technical problem in Splunk Enterprise Platform to the CIO, I do not think he will understand. He has not worked on it; he does not know what I am talking about. But if you present to him that our UI is very helpful to everyone in your organization, no matter if they are on the leadership team, application team, development team, testing team, or application support team, they can all use our tool easily without any hesitation. Even if they need help, Splunk Enterprise Platform has introduced AI, which helps answer any questions regarding SPL.

I purchased Splunk Enterprise Platform directly from the vendor.

I rate the price for Splunk Enterprise Platform as a five because it is very high. If the price were lower, there would be no tools in the market capable of competing with Splunk Enterprise Platform. The only reason people think about moving from Splunk Enterprise Platform to another tool is the price. I would rate this Splunk Enterprise Platform solution with an overall rating of eight.