Splunk Enterprise Platform Reviews

My team and I use Splunk Enterprise Platform for security monitoring, including collecting logs from firewalls, endpoints, servers, and cloud platforms, then compliance reporting, such as generating compliance reports for PCI DSS, SOC 2, and GDPR, log management including centralized logs from thousands of devices, infrastructure monitoring which includes monitoring CPU usage, memory utilization, disk space, and application monitoring including tracking application errors and response times, and various other purposes that arise day to day.

The most critical use case for Splunk Enterprise Platform is security monitoring and threat detection because we can detect cyberattacks in real-time, correlate logs from multiple sources including firewalls, EDR, IDS, IPS, and Active Directory, which enables SOC analysts to identify suspicious activity quickly. For example, about one week ago, an attacker tried to exploit a SharePoint vulnerability where Splunk Enterprise Platform detected multiple POST requests to suspicious SharePoint endpoints, then execution of powershell.exe by the SharePoint service, then the creation of unknown DLL files. We detected that potential SharePoint exploit affecting the server SP Web 01, with indicators including suspicious PowerShell execution, web shell creation, and multiple failed authentication attempts.

Every day, we use Splunk Enterprise Platform to check security dashboards by logging into the platform and reviewing SOC dashboards for critical alerts, failed login trends, and malware detections, then monitor real-time alerts by continuously watching for alerts such as multiple failed login attempts, privilege escalation, or data exfiltration. When an alert is triggered, we investigate it by searching logs and identifying the affected user or device, and we follow up by reviewing authentication logs and correlating events. Instead of looking at one log source, we correlate multiple sources including VPN logs, DNS logs, and CrowdStrike EDR. We also conduct threat hunting by proactively searching for suspicious behavior when there are no alerts, respond to incidents by creating or updating an incident ticket, inform the incident response team, isolate the affected endpoint, and continue monitoring and generating reports as part of our day-to-day workflow.

Splunk Enterprise Platform handles massive petabyte-scale environments well, but asserting strict data sovereignty such as complying with localized regulations that prohibit data from crossing borders requires deliberate architectural planning. The strengths I can mention include decoupled storage, and by leveraging smart store, we can separate our high-compute indexer nodes from our storage tier to allow us to scale to multi-petabyte levels without inflating our compute costs and ensures our cold data resides within our approved geographic borders. There is also distributed search, allowing us to query vast quantities of historical data stored in different geographic nodes or sites without needing to centralize all the raw data into one massive physical repository. The challenges we face include the complexity of cross-border queries; while we can keep data locally sovereign, querying datasets across international or inter-regional boundaries can strain bandwidth and increase search latency while relying on distributed federated searches.

The use of Splunk's Federated Search has evolved from a troubleshooting fix into a deliberate architectural strategy for reducing ingestion costs and managing compliance constraints. Initially, it served as a way to occasionally bridge distinct geographical Splunk Enterprise Platform clusters, but today it acts as an active data fabric layer that queries multi-cloud data lakes and external remote environments in place without moving raw data.

My experiences with maintaining granular control over data using a trusted control plane within Splunk Enterprise Platform reflect a major architectural shift, moving data governance from a retrospective cleanup activity to an in-flight policy enforcer. In-flight governance at the edge uses a centralized cloud control plane executed locally on-premises or within region-specific infrastructure which allows us to control data before it leaves our boundaries, employing granular filtering, masking, and smart in-flight routing. My experience with provider-level access control for Federated Search involves using granular control to manage data sovereignty; Splunk Enterprise Platform's introduction of provider-level role-based access control enhances our experience and data management capabilities.

In consideration of new use cases including agentic AI architectures, Splunk Enterprise Platform's governance and RBAC transition from a passive security checklist into active execution guardrails. The crucial role they play in managing access to operational data for these use cases involves limiting the blast radius. An agent utilizes the permissions of the service accounts assigned to it. Strict RBAC ensures an agent designed for network troubleshooting cannot access sensitive HR logs or financial transactions. Governance structures prevent LLMs from scanning unvetted data sources, stopping attackers from using prompt injection to trick an agent into exposing restricted system data. Access to operational data is managed through least privileged service accounts, whereby agents are assigned to highly specialized Splunk Enterprise Platform roles mapped to narrow indexes and limited data models. Real-time data masking using Splunk Enterprise Platform algorithms or ingest-time transformations strips PII and credentials before data hits the index, ensuring agents cannot interact with forbidden raw strings.

Among the best features that Splunk Enterprise Platform offers are real-time incident monitoring, real-time threat detection, the ability to investigate endpoints, a powerful Search Processing Language (SPL) which allows analysts to search and investigate huge amounts of data quickly, real-time alerts, dashboards, and data visualizations that greatly convert raw logs into graphs, charts, and reports. It also supports scalability, handling terabytes to petabytes of daily log data. It provides role-based access control which restricts data access based on user roles. It also features a machine learning toolkit that allows users to perform anomaly detection and predictive analytics. These features are critical for SOC analysts.

The most important feature for Splunk Enterprise Platform is SPL, which is the Search Processing Language, because it helps us search billions of events within seconds. It powers threat hunting and forensic investigations. It is used to create dashboards, alerts, and reports and almost every advanced feature relies on SPL. Strong SPL skills are among the most sought-after abilities for Splunk Enterprise Platform administrators and SOC analysts. For example, when a user reports that their account is compromised, with SPL we can quickly find all login events for that user, check failed login attempts, identify source IP addresses, see which systems were accessed, correlate activity with firewall, VPN, and endpoint logs, and build a timeline for the incident. A single SPL query can answer questions that would otherwise require checking multiple systems manually.

There are some useful features that Splunk Enterprise Platform users sometimes overlook, including data model acceleration which speeds up searches on large datasets, and this is very useful for SOC teams that need quick investigation results. There are also scheduled searches and automated reports which automatically run searches at set intervals and deliver reports to stakeholders without manual effort. Scalability is also important; whether we ingest a few GB or several TB of logs per day, Splunk Enterprise Platform's distributed architecture allows it to scale with enterprise needs. Role-based access control allows different teams to access only the data they need, which improves both security and compliance. These features highlight the capabilities that distinguish Splunk Enterprise Platform from basic log management tools and show its practical value in enterprise environments.

Splunk Enterprise Platform has had some of the biggest positive impacts on our organization, including improvements in incident response time. Before using Splunk Enterprise Platform, analysts needed to manually search logs across multiple systems, but with Splunk Enterprise Platform, we can centralize logs with real-time alerts and dashboards which improved our incident response times to be 50 to 80% faster in many SOC environments. In terms of threat detection, before using Splunk Enterprise Platform, threats were detected after a significant delay, but Splunk Enterprise Platform helps us continuously monitor and correlate rules detecting attacks within minutes which impacts earlier containment and reduces business impact. In terms of efficiency, we used multiple tools and manual log collection before Splunk Enterprise Platform, but with Splunk Enterprise Platform we have a single platform we can use for searching, monitoring, and investigations, allowing us to investigate more incidents with less effort. For compliance and auditing metrics, before using Splunk Enterprise Platform we needed to manually collect evidence and compile auditing reports, but with Splunk Enterprise Platform we can automate reports for compliance frameworks which save hours of manual work and improve audit readiness. These are the key improvements we have seen with using Splunk Enterprise Platform.

While Splunk Enterprise Platform is widely regarded as a powerful SIEM and observability platform, users across enterprises commonly report recurring challenges including licensing and data ingestion costs. Splunk Enterprise Platform's licensing is often based on the volume of data ingested, and as our organization grows, costs can increase significantly, and our teams may need to carefully decide which logs to ingest, which can limit visibility. A suggested improvement would be more flexible licensing options, better built-in recommendations for optimizing data ingestion, and smarter data compression or tiered pricing. There is also a steep learning curve where beginners can find SPL difficult. A suggested improvement would be more AI-assisted SPL generation, interactive tutorials, and guided dashboard creation with additional pre-built templates for common SOC use cases. These are the main areas for improvement that I can see: licensing flexibility, reducing the learning curve for new users, simplifying development, improving performance for very large datasets, and providing more AI-assisted features to reduce manual effort.

In terms of adding more improvements, there are frequently discussed areas including easier third-party integrations. While Splunk Enterprise Platform supports many integrations, onboarding new security tools sometimes requires custom configurations or add-ons. A suggested improvement would be more plug-and-play integrations, faster support for new vendors, and then simplified administration. Administrators often manage indexes, forwarders, user roles, and cluster health, so a suggested improvement would be easier administration dashboards and automated health checks. These are suggestions that acknowledge Splunk Enterprise Platform's strengths while highlighting areas where many enterprise users see opportunities for further improvement.

The primary areas for improvement that I see are licensing flexibility, simplifying administration, expanding plug-and-play integrations, and adding more AI-driven assistance for searches and investigations. These improvements would significantly simplify our tasks and help us solve more incidents in a lesser amount of time, making it flexible even for beginners.

I have been working for about 15 to 16 months in my current role, in the same project, in the same security domain only.

In my experience, Splunk Enterprise Platform has been a stable and reliable platform for day-to-day security monitoring and log analysis. It has consistently handled large volumes of data. The dashboards, searches, and alerting capabilities have performed reliably, though occasional issues such as slow searches or delays during peak data ingestion can occur. Overall, the platform has been dependable for security operations.

Splunk Enterprise Platform is highly scalable in my experience, efficiently handling increasing volumes of log data, users, and security events by scaling horizontally with additional indexers and search heads. As our environment grows, the platform continues to perform well with the right infrastructure configuration, but scaling requires proper planning for storage, compute resources, and licensing to maintain optimal performance.

I have not needed to contact Splunk Enterprise Platform support directly as the platform has been stable in our day-to-day operations. Most routine issues are handled internally by our team using Splunk Enterprise Platform's documentation and knowledge resources. Based on my current experience, I have not encountered major problems that required escalation to Splunk Enterprise Platform support.

Splunk Enterprise Platform delivers a measurable ROI by reducing manual effort, minimizing downtime, and improving security operations. When it comes to time saved, security analysts spend significantly less time searching logs and investigating incidents. In terms of employee productivity, the same SOC team can handle more alerts due to automation, dashboards, and correlation searches. Money saved includes faster incident detection and response, reducing the cost of security breaches, data outages, and compliance failures. For our enterprise, the key impact areas are generally time saved in investigations, higher analyst productivity, lowered costs of security incidents due to faster detection and response, and reduced manual reporting effort.

Regarding my experience with Splunk Enterprise Platform's pricing, it is a powerful but premium platform requiring deliberate optimization to manage high upfront costs, including high initial setup costs and then complex shifting licensing. While unit costs are high, the platform's ability to consolidate siloed tools into a single pane of glass provides immense value justifying the premium cost if the architecture is tightly managed.

I would recommend others to highly use Splunk Enterprise Platform because of its day-to-day usability, alert investigation capabilities, the time saved, and its highly accurate, scalable, and reliable support in day-to-day SOC operations. Splunk Enterprise Platform has greatly assisted in our day-to-day activities, and I would like to thank the Splunk Enterprise Platform team for providing us with a highly accurate and reliable platform that facilitates the maintenance of our day-to-day SOC operations. I would rate my overall experience with Splunk Enterprise Platform as a nine out of ten.

My main use case for Splunk Enterprise Platform is for doing data analysis. I can give you an example of how I use Splunk Enterprise Platform for data analysis. We are monitoring the infrastructure of the client, such as what systems they are using. It could be network devices, or it could be Windows or Linux servers. We get the infra-related data in Splunk Enterprise Platform environment, such as CPU, memory, and host status, and based on that, we do the configuration at our end. If any issues are there, we are generating the ticket. For example, if a disk is occupying more than 90% of its space, then based on that, we are triggering an alert. If any host is not responsive, we generate an alert such as 'host reporting no data'.

We are having multiple ways to use Splunk Enterprise Platform day-to-day. We have multiple environments, such as a high availability environment and a low availability environment. Based on the client's budget, we set up Splunk Enterprise Platform infrastructure. For example, with a high availability environment, the cost will be more, but the availability of the monitoring tool will be high. That is called the clustered environment. If a client has a low budget and they have a smaller number of servers to monitor, then we will go for a distributed environment.

The best feature of Splunk Enterprise Platform is data insights. The data is very quickly searchable. The data is stored in an index. If you have a very large amount of data and you put it in Excel, it will take a lot of time to work on it and get the insights, such as the exact error logs. But in Splunk Enterprise Platform, data is stored in a TSIDX file. We have an index to get the data, so you can quickly get a look at your environment's data. The visibility is very high.

Suppose a thousand servers are under monitoring. All the data from those thousand servers is ingested into Splunk Enterprise Platform. If any of the servers go down, it will quickly create an alert, irrespective of how many. Even if a thousand servers go down, it will create the alert quickly. The investigation is very easy. We have a set of indexes where data will be stored. We will have log files, we will have the log data, so the analysis is very easy.

We also have vendor support. If my environment is not working or is showing an error, the vendors provide support on time. The security level is also very good. Whenever any vulnerability is detected, the vendor will inform us, and they will come up with the latest version so that we can do the upgrades. The documentation part is everything very transparent.

Whatever problem the client comes up with, for example, 'My environment has this many servers, and we cannot do it because it is at different locations,' it cannot be manually monitored. There should be a one-stop destination so that we can monitor all the environments. In that way, Splunk Enterprise Platform is playing a very important role in our organization to serve clients better.

The response time is reduced because within 5 to 15 minutes, if any issue occurs with the server, it will generate an alert. If the system comes back up, there is an automation process, so the ticket will auto-resolve as well. However, the footprint will always be there. It will show exactly when the issue happened. It is saving time also because whatever data we are getting, it is taking less time to parse, index, and process the data and give us the ticket.

Regarding improvement for Splunk Enterprise Platform, compatibility is needed. They are coming out with a newer version every two months, and there is the vulnerability part. When they are releasing any version, they need to check it from a security point of view completely. The remediation they are providing is in the newer version. In the existing version itself, they can review it and provide the fixes so that every two or three months, we do not need to go for upgrades, because upgrades take some time.

The Splunk experts are there who are involved and have the knowledge to do the integration. Everything is fine. The only thing is the vulnerability part, which is the only flaw I observed.

I have been using Splunk Enterprise Platform for the last five years.

Splunk Enterprise Platform is stable.

The scalability of Splunk Enterprise Platform is very good. If we are talking about the cluster setup, you can add more indexers, more search heads, and more heavy forwarders. You can add more components based on your requirements. Scalability is very easy in Splunk Enterprise Platform.

Customer support is also top-notch. We are getting the support. They have on-call support and email support.

Multiple options are available, such as Dynatrace and DataDog, but Splunk Enterprise Platform is the leading one nowadays because it provides security features as well. Splunk Enterprise Platform was acquired by Cisco, and Cisco is a big player in security. Splunk Enterprise Platform is a good one, and it is also cost-saving. It is not charging more. It is charging based on indexing the data only, so we are good with Splunk Enterprise Platform.

Governance and security within Splunk Enterprise Platform is good. Whenever they find any vulnerability, they immediately inform their customers, telling them to stop using something and providing the fixes. They come up with it immediately. Splunk Enterprise Platform itself was bought by Cisco, so from a security point of view, they are getting better now.

Directly, as of now, we are not integrated with agentic AI, but we are using agentic AI for the troubleshooting part. It will take some time to integrate it, but these things will be there. However, everywhere, human intervention will always be there. It cannot allow the AI to go and change the configuration without the permission of a human being.

Splunk Enterprise Platform has high capability. It is capable of handling that much data. It will use more resources, but it can handle it.

We have used the federated search feature of Splunk Enterprise Platform because the client had location-related security requirements. We have the option and the feature where we can hold the data there, and it can be searched from one location. The data will be stored in a different location, but it can be searchable from one destination. It is very helpful. The environment is providing a very reliable solution to us.

Splunk Enterprise Platform has a very good feature. You can mask the data while indexing it. If you are talking about the access part, we have multiple access levels available. If you want to limit the access to particular data for a particular team, we have that option. We can create a customized role, and it also has in-built roles. Based on that, a dedicated user can only access the dedicated data.

Nothing is missing because Splunk Enterprise Platform has very strong capabilities with multiple roles, and we have customized roles as well. For the login process, we can use SAML and LDAP. It is a very good platform that provides you with a way to maintain data security. The governance tools provided by Splunk Enterprise Platform are very good.

The cost saving is a shared resource for multiple projects. We can work for 10 to 12 or 15 projects with Splunk Enterprise Platform skill set. I am working as an admin and developer, so that part comes under the architect team. We have a dedicated team that decides the pricing, cost, and licensing based on the client's requirements, such as how many servers are under monitoring. For a thousand servers, it should go with a clustering environment and high availability. It totally depends on the demand of the client.

Because we have 10 to 12 projects and 10 to 12 associates, there is no dependency. If someone goes on leave, everyone else has access to all the projects, so there is no dependency. Everyone can work on any of the projects, so it is good. You do not need to put two dedicated people there, and if those two people are not there, then who will work? There is no such issue. With shared responsibility and shared resources, it is working very nicely with less cost.

I would rate this review an 8 overall.

My usual use cases for Splunk Enterprise Platform involve all NOC and SOC activities, where SOC-related alerts will be aggregated with NOC-related alerts, allowing for correlation between them, including use cases such as abnormal travel and anomaly detection, all of which are detected by Splunk Enterprise Platform.

For instance, if there is a DDoS attack indicated by an anomaly in the traffic when WAF is integrated, an alert is generated in Splunk Enterprise Platform, which our L1 and L2 teams will then visualize and remediate based on the alert.

I do not use Splunk Enterprise Platform's Machine Learning Toolkit directly, but my team utilizes it.

Splunk Enterprise Platform's Machine Learning Toolkit has helped us with predictive analytics in our organization significantly, as it automates the anomaly detection that previously required our L1 and L2 teams to spend three to four hours on.

It immediately triggers alerts upon detecting patterns such as WAF spikes or suspicious login behavior, allowing our L1 to avoid manual analysis and triaging. The predictive analysis reduces false positives, enabling our analysts to close tickets swiftly—previously taking two to three days, and now they close them before breaching the SLA due to effective pattern discovery and outlier detection.

Splunk Enterprise Platform's Machine Learning Toolkit is efficient in detecting abnormal login attempts and brute force attacks, effectively aiding our proactive defense planning through advanced analytics and anomaly detection.

Splunk Enterprise Platform's most valuable features include its integration with AI, as Cisco, which has taken Splunk Enterprise Platform recently, is building up AI functionalities, enhancing remediation capabilities and the orchestration part in the market. Additionally, Splunk Enterprise Platform shows the correct logs at the correct time, and inventory management is very good.

I assess the effectiveness of Splunk Enterprise Platform in detecting anomalies and preventing system outages as very strong; for over two to three decades, it has provided centralized log visibility, real-time monitoring, and analytics correlation, which is robust for threat detection and incident investigation.

Splunk Enterprise Platform's machine learning capability of the toolkit predicts trends and reduces many false positives, making Splunk Enterprise Platform an essential tool for both SOC and network operations, where it effectively detects anomalies that other SIEM tools cannot.

Splunk Enterprise Platform's personalized dashboards are superb, as I have been experimenting with them extensively, and new features have enhanced their quality, making them particularly effective for presentations to leadership, including direct engagement with the CISO.

In terms of improvement for Splunk Enterprise Platform, as more companies embrace AI, adding more AI automations is crucial and could parallel what competitors such as Xplain are doing. Managing duplicate alerts efficiently can optimize costs, as the current license-based data ingestion can quickly escalate if duplicate data is fed.

Better filtering of unnecessary log sources could greatly interest clients by demonstrating cost efficiency. From an architectural standpoint, data onboarding, normalization, performance, and scalability improvements would be beneficial, particularly in optimizing search speed and query execution to handle larger searches efficiently.

I have been working with Splunk Enterprise Platform for the last 10 years as a Splunk certified power user and advanced user, and along with Splunk Enterprise Platform, I am using Palo Alto's Cortex XSOAR and Azure Sentinel continuously for over 10 and 12 or more years.

I evaluate the stability and reliability of Splunk Enterprise Platform as very high; we utilize it for both SOC and NOC operations, and our L1 and L2 teams get real-time alerts and query the SPL effectively without delays that other SIEM solutions may impose.

Splunk Enterprise Platform is scalable; we have already adapted it from SOC to NOC operations while maintaining good indexing practices that prevent overload and ensure clear searches, maximizing performance in large SPL queries.

My L1 team regularly communicates with Splunk Enterprise Platform's technical support, which is very helpful.

I would rate the technical support from Splunk Enterprise Platform around eight on a scale from one to ten, where one would be the worst and ten would be the best.

Before using Splunk Enterprise Platform, I utilized Azure Sentinel in my previous company at Deloitte, prior to leaving.

Although I did not participate in the initial setup, I provided mentoring for the team under me who managed the implementation because I have spent 14 years in the industry, which included hands-on implementations earlier in my career.

Splunk Enterprise Platform's implementation is very straightforward; I do not feel there is a significant difference from the implementation point of view, as everything is clearly documented by Splunk Enterprise Platform.

We are a customer of Splunk Enterprise Platform, currently at Aramex, and we bought a vendor from Capgemini who has actually implemented Splunk Enterprise Platform for us, so we are not directly linked with Splunk Enterprise Platform but rely on our vendor to use Splunk Enterprise Platform for us.

Splunk Enterprise Platform's dashboards significantly improve data interpretation, providing immediate real-time visibility on top trending alerts and live data without needing to run queries repeatedly. They aggregate metrics and highlight trends such as threat overviews and MITRE ATT&CK mapping, which reduces the workload for our L1 and L2 teams.

Pre-built alerts for anomalies in login attempts, failed attempts, or geolocation mapping are very visible in Splunk Enterprise Platform's dashboard, which plays a critical role in providing real-time visibility into security events and network activities.

Splunk Enterprise Platform's application management feature enhances end-user experiences by providing organized dashboards that monitor application usage and configurations, facilitating faster detection and query execution. It logs metrics into applications that reveal usage patterns, anomaly detections, and attack occurrences, while also ensuring proper governance and versioning of applications.

I consider Splunk Enterprise Platform an expensive tool because budget constraints from license-based data ingestion costs are significant. Costs can escalate rapidly when duplicate data is processed, which Splunk Enterprise Platform can identify to help clients save directly on unnecessary spending.

I leverage Splunk Enterprise Platform for advanced threat detection, which is critical for our SOC operations. Threat intelligence and detection are vital, especially since Cisco's acquisition of Splunk Enterprise Platform has integrated Talos into it, enhancing our ability to monitor for IP reputation and potential attacks, while also keeping an eye on advisories regarding application vulnerabilities. I would rate this product overall at a nine out of ten.

My main use case for Splunk Enterprise Platform is security monitoring. Over the past 13 years, I have performed a variety of different roles relating to Splunk, covering ITSI, IT Ops, and Enterprise Security, but predominantly at the moment, my focus is on security monitoring use cases.

I typically use Splunk Enterprise Platform for security monitoring to identify insider threats and unusual behaviors with internal actors as well as external customers who use our services. There is a variety of different use cases within that scope, but the main security focus is on identifying insider threats, using a variety of data sources such as AWS logs and Azure logs, correlating different things between logins, activity, and proximity.

Splunk Enterprise Platform has positively impacted my organization by giving us access to the security monitoring tooling that we need to operate. We are also able to use a lot of that same data for other purposes. For example, data coming in from the website can also be used for IT Ops monitoring of the website, which we can leverage for security and IT Ops. For other source types such as authentication from Entra ID or Okta, we are able to diagnose issues and assess the frequency of usage within the team, alongside security use cases. It gives us many options for using that same data.

In my opinion, the best features Splunk Enterprise Platform offers are its flexibility and ability to accomplish a variety of different things depending on the requirement. There are thousands of apps on Splunkbase which are very good for extending the capabilities. I do quite a lot of app development myself, contributing back to the community from that perspective.

From an app development perspective, there has been a significant push in the last couple of years on new ways of working and building apps with Splunk's provided tooling. The UCC app builder is quite good for starting with a barebones app and building it out. Additionally, there is good new technology around Splunk UI toolkit which allows developers to build richer visual apps. I believe that this empowers developers and enables them to build premium looking and capable products within Splunk Enterprise Platform, facilitating companies' closer integration with Splunk Enterprise Platform.

The extensibility of it is excellent, and it is easy to integrate with, access data, and dashboards from anywhere, including mobile. It is versatile from that front, and the type of apps that can be built on it range massively between dashboards and custom REST interfaces that can be integrated to other systems.

Certain parts of Splunk Enterprise Platform, such as the KV store, are quite monolithic and tightly coupled into Splunk Enterprise Platform. It would be beneficial to deploy Splunk Enterprise Platform while using different KV stores and technologies; for example, if we are running in the cloud, it would be beneficial to leverage cloud vendor turnkey services and abstract them away from Splunk Enterprise Platform. This would let us tie it into existing systems and benefit from the scaling involved.

I have been using Splunk Enterprise Platform for 13 years.

Splunk Enterprise Platform is stable.

It scales very well, and I have never had any issues with the scaling.

Customer support is good. I have always worked well with the account team to ensure that anything needing escalation gets addressed. However, in the last couple of years, the support staff do not necessarily understand the problems I report and sometimes simply regard them as bugs. They expect me to provide diagnostics rather than testing them upfront, which is frustrating, but otherwise, support is very good.

We have typically used tools such as Grafana for metrics, AWS CloudTrail, and AWS CloudWatch logs for viewing logs, but now we have everything centralized in Splunk Enterprise Platform.

I work with partners, but I am not myself a partner. I deliver consultancy work via other partners, but we are not partners ourselves.

I do not have specific metrics about return on investment, such as fewer employees needed, money saved, or time saved.

I do not get too involved in the licensing, so I do not really have much of an opinion on that. However, regarding setup cost, the reference hardware is provided and seems to be overkill for some of the host types. I believe it would be beneficial to understand where savings could be made by running slightly smaller compute for things such as license servers since I do not think the reference hardware is always necessary and could reduce setup and operational costs.

I would advise others to use the free training available initially so they can start using Splunk Enterprise Platform on the right foot. This allows running better, cleaner searches with fewer resources and easier platform navigation. Building a team of skilled individuals to handle data onboarding, search writing, and platform management is essential, along with implementing governance around data ingestion to avoid overloading the system.

With the use of SmartStore, we have been able to reduce our storage usage, which I believe has also saved us money. I do not have specific numbers on how much that has saved, but by moving to SmartStore, we run fewer fast disks that are ultimately more expensive, pushing data to SmartStore and leveraging its capabilities.

I have not worked at anything to the petabyte scale. I have worked at the terabyte level but not at the petabyte level, so I am not fully aware of what kind of problems we might encounter. The scaling work I have done in the past has been quite seamless, scaling very well linearly. I have confidence in the capabilities of other petabyte-level customers, so I believe it could be achieved.

We have not actually explored federated search to S3 yet, but we have done federated search between Splunk Enterprise Platform instances in the past, and that worked very well. I hope federated search for S3 will let us ingest less data and store more directly in S3 from the source, saving us on workload and resources required for ingestion and storage on disk, as we can leverage cheaper S3 storage.

In my organizational context, the AI workload inputs and functionality is managed in the same role-based access control methods as the existing knowledge objects, API endpoints, and capabilities. I would hope that what the AI agents can access is managed in the same way, ensuring specific roles only access necessary data. Splunk Enterprise Platform's role-based access control model works well for knowledge objects and indexes, and I hope that extends equally to AI.

We are able to use single sign-on for login in our private network, which helps. Everything done within the platform is in the audit index, which we regularly monitor and manage to understand what our users are doing. I would rate this product a 9 out of 10.

I have implemented the complete Splunk Enterprise Platform structure in my previous organization, implementing the platform, creating use cases, dashboard queries, creating dashboards, and onboarding different devices via Syslog and API.

Splunk Enterprise Platform has a vast and versatile powerful search engine with which I can handle all queries, and creating use cases and the search and dashboard is the main selling point, allowing me to visualize live dashboards.

The platform has a powerful search engine, allowing the integration of custom AI such as ChatGPT. Splunk Enterprise Platform also has its own Phantom as a SOAR, which is much more refined and gives more accurate results than any other AI integrated SIM tool. In anomaly detection, I can live track anomalies and change the registry.

Splunk Enterprise Platform serves as a time-saving solution because integrating other sources such as Syslog or router switch firewall is much easier.

The cost is the most significant area for improvement in Splunk Enterprise Platform, as it is quite expensive, causing many clients to differ due to this reason. Otherwise, I don't see that Splunk Enterprise Platform requires further improvement because it is the number one tool.

The cost remains a significant point of concern.

I have 2.5 years of experience with Splunk Enterprise Platform.

The stability depends on how aggressively the environment changes. If I am providing network services, it can be challenging due to continuously changing firewall configurations.

Splunk Enterprise Platform is stable when not integrating or adding new devices continuously.

I consider Splunk Enterprise Platform a scalable solution since it has different components, and if the server is down, I can upgrade the server resources or create a new node for performance optimization.

I have never used their technical support because everything is available on their website and documents. It is crucial for anyone looking to deploy Splunk Enterprise Platform to first certify for their courses, such as the Splunk Administrator and the Power User Administrator certifications, which address all troubleshooting queries.

Positive

The initial setup of Splunk Enterprise Platform depends on the user; if set up in a Windows environment, it is much easier, requiring just clicking on the wizard and following the steps. In the Linux environment, it is quite hectic, but manageable compared to Wazuh, where I have to integrate the GPC API key alongside the installation. In Splunk Enterprise Platform, I only need to download and configure a single file, making it easy to manage.

I have expertise in Splunk Enterprise Platform tools, including Splunk Cloud, having experience working with other tools such as IBM Security QRadar.

We are a managed service provider (MSP), and we provide services using Splunk Enterprise Platform.

Splunk Enterprise Platform holds the number one position in Gartner, and integrating different types of tools and creating use cases is much more streamlined compared to other tools such as IBM QRadar and AD audit, managing the log 360.

The platform has a powerful search engine, allowing the integration of custom AI such as ChatGPT. It also has Phantom as a SOAR, which is more refined and gives more accurate results than any other AI integrated SIM tool. In anomaly detection, I can live track anomalies and change the registry. While working with Wazuh, when I integrated the Cortex XDR, there was a mismatch of events sometimes, making it tedious, but in Splunk Enterprise Platform, I just need to log into the console and everything is there, making it an all-in-one solution.

I rate Splunk Enterprise Platform 9 out of 10.

Splunk Enterprise Platform is primarily used to onboard data from a myriad of sources, including logs from various network devices such as computer workstations, switches, routers, and any network-connected device. This data is onboarded for a SIEM tool to use and for analysts to set up detections.

One specific example involved onboarding data from Windows workstations on the network to track authentication activities and flag unusual activity dealing with administrator credentials.

Our specific infrastructure uses Splunk on AWS, where we have Splunk instances, indexers, forwarders, and search heads operating as a whole cluster. This cluster is tied into S3 for data storage.

Splunk Enterprise Platform's best features include data analysis, especially for logs that could be overwhelming to review individually. It makes our data easily searchable and easily analyzed, allowing us to focus on things that are of concern and the things that are important to us. This enables us to narrow down and react as quickly as possible.

Splunk Enterprise Platform has improved our reaction time and investigation time for troubleshooting events and finding security issues within our network, which is a huge time-saver and also a huge reduction in the amount of resources that we would typically need within my organization to address such issues and solve computer issues within our network.

Another feature that stands out is ingest actions, which is available on Splunk forwarders. This is an easier way to reroute data to other places, normalize the data on the heavy forwarder before routing it, and limit the sort of data that you want to send out or fork out to other destinations.

Resource consumption could be streamlined further. Although the integration with S3 makes it a little cheaper and more reasonable to store large volumes of data, it still does not address the issue of keeping data in warm and hot buckets. Keeping a significant amount of data in warm and hot buckets does not work well with S3, as data stored there is typically in cold buckets. Whenever that data needs to be retrieved, it must be thawed before it can be used. It would be improved if we were able to retain higher volumes of data in hot and warm buckets to be readily available to analysts, which would help tremendously. Storage cost is one of the huge issues for us.

With the emergence of AI and its prevalence now, Splunk is moving in the right direction with integrating AI. However, currently, that is mostly tied into the cloud environment. If there could be more on-premises offerings and AI solutions geared to customers that are in isolated environments where they want their data and all their systems to be on-premises and not tied into the cloud, that is somewhere Splunk can make some improvements to serve those customers.

I have been using Splunk Enterprise Platform for the whole ten years, but exclusively for the past five years.

Splunk Enterprise Platform is stable.

Splunk Enterprise Platform scales very well with the use of heavy forwarders and indexers. By its nature of giving the ability to have sites and clusters, it is highly scalable.

Splunk's customer support is very responsive and very good.

In my current environment, there was not any solution specifically to do exactly what Splunk is used for now. However, in previous environments that I have worked in, ArcSight had been replaced with Splunk.

One of the platforms that was evaluated in those environments was Elastic.

I do not have a full experience with the initial setup, but I do know that for pricing and setup cost, we use Splunk partners that we interact with for that.

I do not have a full experience with the implementation team, but I do know that for pricing and setup cost, we use Splunk partners that we interact with for that.

As I mentioned before, a troubleshooting or incident that used to involve a headcount of ten now takes a headcount of four. As far as specific dollar figures, I do not have that information.

I do not have a full experience with that, but I do know that for pricing and setup cost, we use Splunk partners that we interact with for that.

Regarding staffing, the headcount for the number of staff that we would need typically to respond to an incident or event has been significantly reduced. An incident or event that used to take ten people to triage, respond to, and remediate accordingly has been reduced to where that job is now handled by four people.

There has only been one use case for federated search within my environment, which provides search capability to another organization into my environment. It is good because it allows us to limit what data is available to that customer and limit it to a specific index. We can limit the kind of access and the kind of role that is assigned to the federated search users as they access our environment. It is very good because it helps us avoid crashing our entire environment if a rogue search or a search that is not well-structured is executed by that customer. It has worked for us to limit the search quota for that customer so they do not crash our entire environment and our broader environment is not impacted.

Splunk's use of RBAC, role-based access control, has worked very well for us as we can limit certain roles to specific search quotas. We can limit index access to certain roles and app access to certain roles. This has actually worked very well and is well-implemented within Splunk.

Splunk's approach is very good and is on a great track on a private network because for customers like us with on-premises instances, it lets us keep all our data within our network and do whatever we do within our environment without worrying about that data getting out to the public or outside of our environment.

Since the implementation of Splunk, we have significantly reduced our TCO in maintaining data and collecting logs. In partnership with AWS and in some implementations with S3, that has really brought down TCO because we do not need to maintain so many hardware and data centers to be able to meet the same need.

For others looking to use Splunk Enterprise Platform, my advice would be to get familiarized with the product. Even if you are just a customer and not supporting, implementing, or maintaining the environment yourself, it is really good to get educated on the software and its use cases. I would advise organizations to send their employees to get at least some Splunk training and use whatever credits they have to make sure their workforce stays updated on the new changes within Splunk. I would rate this product a nine out of ten.

Splunk Enterprise Platform serves as our primary solution for centralized log management and security monitoring. We collect logs from multiple systems and security devices into a single platform to investigate incidents, troubleshoot issues, monitor suspicious activity, and create dashboards and alerts for better operational visibility. The platform also helps us correlate events from different log sources, making investigation faster and more efficient.

For example, an organization received an alert about suspicious PowerShell activity on a Windows endpoint. Using Splunk Enterprise Platform, the analyst searches for the affected hostname and username, then correlates Windows Event Log, Active Directory authentication log, firewall log, and endpoint security log. The timeline shows that the user logged in from an unusual IP address or executed a PowerShell command and then attempted a connection to multiple internal servers. Because all relevant logs are available in one place and can be correlated by timestamp, username, and host, the analyst can quickly understand the sequence of events and determine the scope of the incident without manually checking multiple systems.

Splunk Enterprise Platform's Search Processing Language, real-time search and alerting, and customizable dashboards are the most valuable features I have found. The Search Processing Language makes it easy to search and analyze large volumes of log data to quickly identify issues or security events. The real-time alerting capability has helped us detect critical events as they occur, allowing for faster response. I appreciate the flexibility of dashboards, which can be customized to display key metrics and operational insights for different teams. Additionally, Splunk Enterprise Platform's ability to ingest data from a wide range of sources and correlate events across multiple systems provides a comprehensive view of the environment, making troubleshooting and incident investigation much more efficient.

The Search Processing Language is the feature I rely on the most in Splunk Enterprise Platform. It allows me to quickly search and analyze large volumes of log data, filter relevant events, and identify the root cause of issues much faster than manually reviewing logs. Whether I am investigating a security alert or troubleshooting an operational problem, the Search Processing Language helps me pinpoint relevant information efficiently, making it the most valuable feature in my day-to-day work.

Overall, the feature set of Splunk Enterprise Platform is comprehensive and flexible. The combination of centralized log management, powerful search capability, customizable dashboards, and real-time alerting enables teams to monitor their environment, investigate incidents, and troubleshoot issues from a single platform. The extensive integration support also makes it easy to bring together data from different systems, providing better visibility across IT and security infrastructure.

Organizations commonly report that Splunk Enterprise Platform improves visibility across their IT and security environments by centralizing logs from multiple systems. This can help security and operations teams investigate incidents more quickly, reduce the time spent troubleshooting issues, and identify potential problems through real-time monitoring and alerting. Many organizations also use dashboards and reporting to gain operational insights, support compliance activities, and make more informed decisions based on machine data.

One area where Splunk Enterprise Platform could be improved is its licensing model, as costs can increase significantly with higher data ingestion volumes. The initial deployment and data onboarding process can also be complex, especially for large environments. Additionally, there is a learning curve for new users when working with the Search Processing Language and building advanced dashboards. Simplifying administration, improving the onboarding experience, and providing more built-in templates and guided analytics would make the platform easier to adopt and manage.

Another area of improvement would be performance optimization in very large environments where complex searches can take longer to execute if they are not properly optimized. It would also be beneficial to have more artificial intelligence-driven analytics, automated recommendations for search optimization, and pre-built dashboards and use cases.

I have been working in this field for approximately four and a half years.

Splunk Enterprise Platform is highly stable.

Splunk Enterprise Platform is highly scalable and is designed to support organizations ranging from small deployments to large enterprise environments. It can ingest and analyze increasing volumes of data by adding indexers, search heads, and other components as requirements grow. The distributed architecture allows organizations to expand capacity while maintaining performance and reliability. Proper infrastructure planning, data management, and search optimization are important to ensure the platform continues to perform efficiently as the environment scales.

Splunk Enterprise Platform was our primary log management and analytics platform, so we did not migrate from another SIEM or log management solution. We selected it because of its powerful search capability, scalability, broad integration support, and ability to centralize logs from multiple systems for monitoring.

We did not conduct a formal evaluation of multiple solutions before adopting Splunk Enterprise Platform. The decision was primarily based on its strong reputation for log management and analytics, extensive integration capabilities, powerful search functionality, and its ability to scale to meet enterprise security and operational requirements.

Before implementing Splunk Enterprise Platform, I clearly define my use cases, identify the log sources I want to onboard, and estimate my expected data volume to plan licensing and infrastructure appropriately. I invest time in learning the Search Processing Language and designing an efficient ingestion strategy, as these have a significant impact on performance and usability. It is also a good idea to start a phased deployment, build dashboards and alerts around your highest priority use cases, and establish governance for user access and data retention from the beginning. This approach will help me get the most value from the platform while keeping the deployment manageable.

We have seen operational benefits, although we did not formally measure ROI with specific metrics. Splunk Enterprise Platform helped reduce the time required to investigate incidents by centralizing logs and providing powerful search capabilities. This improved analyst productivity and troubleshooting efficiency. The biggest return has been better visibility and faster access to relevant data, rather than a measurable reduction in headcount or quantified cost savings.

The pricing for Splunk Enterprise Platform for large volumes is on the higher side compared to some alternatives, especially for organizations that ingest large volumes of data. The initial setup requires investment in implementation, but once deployed, the platform provides strong value through its scalability and extensive capabilities. The licensing model is straightforward but requires careful planning to manage data growth and costs. For organizations that prioritize security and IT operations, the overall value generally justifies the investment.

My organization has tracked TCO metrics for the non-indexing analytics approach to evaluate the success of reducing TCO with Splunk Enterprise Platform's non-indexing analytics approach.

Splunk Enterprise Platform provides useful artificial intelligence-assisted capabilities that can help improve security operations and data analysis. From a governance and security perspective, I think it is important that artificial intelligence features respect existing role-based access control, maintain audit logs, and protect sensitive data. Organizations should also have clear policies around how artificial intelligence is used, what data it can access, and how artificial intelligence-generated insights are validated before taking action. Overall, the artificial intelligence capabilities are promising, but strong governance, transparency, and data protection are essential for enterprise adoption.

Artificial intelligence capabilities in an enterprise security platform can significantly improve productivity by helping summarize data, identify patterns, and assist with investigation. However, the accuracy and reliability of the output depend on the quality of the underlying data and configuration. Artificial intelligence-generated insights should be treated as decision support rather than definite answers, and they should always be validated by security analysts before taking action. I provided this review with an overall rating of nine out of ten.

In terms of using Splunk Enterprise Platform, we use it for our SOC environment where we have an ES setup separately. We collect logs from various sources like AWS, EDR logs, firewall logs, WinEvent logs, Linux logs, application logs, and specific service logs.

We gather that and based on that, we are providing users dashboards, searches, and alerts.

In terms of my favorite features of Splunk Enterprise Platform, it has vast customizability. It is very customizable. I can customize it according to my use case. Or if I have any restrictions in my environment or client environment, I can customize it according to my requirements. It is not something where I need to go with the straightforward way.

For a specific feature of Splunk Enterprise Platform, I appreciate the custom commands and custom endpoints by using which I can build my Splunk apps.

When concerning the cost of Splunk Enterprise Platform, the license cost can be a factor. The pricing is based on limited factors. There are two types of pricing where we have licensing based on the data or logs which we are indexing by size.

It can also be based on if we are purchasing the cloud platform, then it can be based on multiple factors such as how much data we are searching daily or a limit on that. Usually for 10 GB of license and two years of retention, it costs around $20,000 to $30,000.

Based on my thoughts about Splunk Enterprise Platform, I would rate it a seven or eight because the only thing I'm keeping in mind is the licensing cost. Otherwise, the overall product is good, its features, its customizability, and scalability are all excellent. The only factor is the licensing.

If they were providing a license to small customers, if they target small customers, it would be really great.

If they provide a small license to small customers, or if they bring some new licensing for small customers for the specific use case on top of Splunk Enterprise Platform, that would be beneficial.

My experience with Splunk Enterprise Platform is approximately two and a half years.

In terms of Splunk Enterprise Platform stability, I would rate it nine out of ten.

When considering scalability, Splunk Enterprise Platform is very scalable. I would rate it nine out of ten.

I have contacted support for Splunk Enterprise Platform multiple times. For our architecture specifically, we have contacted Splunk support. The add-on which is being provided by Splunk support was generating an error in our environment. For that, we contacted support and they were able to provide us with the solution which is currently working fine.

Regarding alternatives to Splunk Enterprise Platform, I have tried to use other tools, but they are very specific to some use cases only. I have preferred to use Splunk because it works with all my use cases and all the log or source types. I tried Dynatrace and DataDog, which provide observability, but that was not as useful to me.

In terms of ease of use with Splunk Enterprise Platform, it is very easy and straightforward. All the steps are mentioned in their documentation. All the guides which are required or the prerequisites that must be there before installing or setup, are in their documentation. The community is also very good. We have enough description about the installation steps, which is what makes it easiest.

Using Splunk Enterprise Platform requires maintenance. In terms of maintenance, it will be specific. If we are making any changes, then we must schedule maintenance because it will restart its services and we must accept the downtime. If we are upgrading our environment or any specific apps that are present in our environment, then we must have maintenance for it.

I would rate this review an eight overall.

My main use case for Splunk Enterprise Platform is payments monitoring from a business monitoring perspective, where I use Splunk to monitor different payment journeys.

A specific example of how I use Splunk for payments monitoring is monitoring whether each payment reaches its logical end state. For instance, I monitor whether a payment that is supposed to go through fraud check actually goes through fraud check, or if a payment that is supposed to go through sanction check actually does, and whether accounting for those payments has been completed.

In addition to my main use case with Splunk Enterprise Platform, I also use it to trigger different automation. I have created applications including custom alert actions, which I use to trigger third-party automation through Splunk.

Splunk Enterprise Platform offers several best features for me, including customization, which I appreciate since most of my use cases are very challenging. For example, I have an in-house tool that is monitored by operators 24/7, and I needed to integrate that system with Splunk, so I wrote a custom alert action for that purpose. Similarly, for different use cases, I use custom commands and custom apps for data ingestion. Customization of Splunk Enterprise Platform environment is what is most beneficial for my team.

Customization has helped my team by enabling integration of a system monitored by operators 24/7 with Splunk using a custom alert action. Regarding features, I recently started exploring UI Toolkit, which looks great.

Splunk Enterprise Platform has impacted my organization positively in that I rely on it mainly for alerting purposes. Splunk Enterprise Platform is very integrated into my whole ecosystem, and I am able to catch even a simple blip with it, making it really beneficial.

To improve Splunk Enterprise Platform, it needs more AI capabilities. Although I know Splunk is heavily investing in AI-related technologies, I would like to see more AI capabilities in the future.

Regarding needed improvements for AI capabilities, governance should be on different guardrails, with monitoring of the AI models that Splunk is using, so informed decisions can be made. Regarding the accuracy and reliability of Splunk Enterprise Platform's AI output, I have not used it because I am still exploring that area, so I am unable to comment on it.

My impression of Splunk Enterprise Platform's capability to manage data sovereignty at a petabyte scale within my environment is a solid ten.

My use of Splunk's Federated Search for querying data in place has evolved. The main use case nowadays is that I have data in Cisco data fabric, and Splunk reaches out to that data using federated search, which is a game-changer. I would like to see improvements on the performance side where federated search is not slowing me down.

Maintaining granular control over data using the trusted control plane within Splunk Enterprise Platform is generally handled by my admin team, as I am mostly on the Splunk COE team, Center of Excellence team.

As my organization explores new use cases including agentic AI, Splunk Enterprise Platform's governance and role-based access controls play a role in managing access to operational data. I govern the role-based access control for knowledge objects, which should be similar for AI capabilities.

My impression of Splunk Enterprise Platform's approach to managing governance within a private network environment has been really good.

I have been using Splunk Enterprise Platform for almost ten years.

I can confidently say that Splunk Enterprise Platform is very stable.

Splunk Enterprise Platform's scalability is really good in terms of data and knowledge objects.

Splunk Enterprise Platform's customer support is perfect. I would rate the customer support a ten.

I have seen a return on investment in that I am saving time. I am able to generate alerts on time or sometimes before time, and I can take action on them.

My experience with pricing, setup cost, and licensing has been good, as my account manager has been able to handle everything seamlessly.

My advice to others looking into using Splunk Enterprise Platform is that they need to first define what they want to achieve with it, as there could be two different use cases: advanced AI analytics or alerting and taking actions from a perspective standpoint. First define that, determine the need in terms of data, and then use Splunk Enterprise Platform accordingly. I would rate Splunk Enterprise Platform a nine on a scale of one to ten.

My main use case for Splunk Enterprise Platform is to search for data analysis.

A specific example of how I use Splunk Enterprise Platform for data analysis is that I look at asset inventory for monitored use cases within our different operating companies.

Splunk Enterprise Platform helps me with monitoring asset inventory across those different companies by onboarding hosts and having the data show up in Splunk Enterprise Platform. I check to see if we have coverage and if assets identified by operating companies are showing up in Splunk Enterprise Platform as monitored.

The best features Splunk Enterprise Platform offers are high performance, large search capacity, and large data capacity.

Splunk Enterprise Platform's high performance and large search data capacity have helped me by enabling us to routinely aggregate large volumes of data from Sony entities all over the world. Some of those volumes are unstable and spike, and Splunk Enterprise Platform has been able to handle those large spikes, handle the ingest processing and indexing, and make the data available for search very quickly with very little latency.

Splunk Enterprise Platform is readily able to create visualizations and reports and help us in doing risk analysis, security analysis, and other types of data analysis.

Splunk Enterprise Platform has positively impacted our organization by enabling us to secure Sony globally effectively and consistently.

Splunk Enterprise Platform can be improved with AI integration across the board to facilitate not just search but also to help us ingest different types of data, adapt to changing requirements in the data space, understand our data better, and visualize and catalog our data.

The most specific pain point I encounter is handling complex data ingest.

Regarding Splunk Enterprise Platform's AI capabilities, governance and security are strong, but it can be challenging when permissions are not structured correctly from the very beginning, particularly when wildcard permissions are applied.

Regarding Splunk Enterprise Platform's AI capabilities generally, it is strong from a search assist capability, but beyond that, we have limited use of AI within Splunk Enterprise Platform.

Other improvements needed for Splunk Enterprise Platform include automated management of UF agents and automatic upgrading, which would be very helpful.

I have been using Splunk Enterprise Platform for nine years.

Splunk Enterprise Platform is stable.

Its scalability is extremely effective.

Customer support is very strong, and engagement is very strong.

I would rate the customer support an eight only because we solve some problems more quickly before support can solve them.

Before using Splunk Enterprise Platform, we used McAfee Nitro because it had limited search capability and could not effectively handle the data volumes and performance that we needed.

I do not have any specific metrics or anything I can share regarding return on investment. Our mission is not a revenue-generating mission, as we are specifically monitoring Sony globally, which is an expense rather than revenue generation. We do manage costs by keeping tight the number of employees working on the clusters and doing data onboarding.

We have a perpetual license for Splunk Enterprise Platform, which serves us very well. However, maintenance costs increase year over year, which is proving challenging to our organization given routinely tight budgets, and it would be helpful if maintenance costs could come down.

We did not evaluate other options before choosing Splunk Enterprise Platform.

Splunk Enterprise Platform does help us with data sovereignty requirements for Sony, but we manage that by structuring the data across different clusters.

We find maintaining granular control over data using the trusted control plane within Splunk Enterprise Platform effective as it works very well, though we have to be careful to ensure that administrators do not use wildcard permissions; aside from that, it works very well.

At present, we do not see a need to use AI or agentic AI specifically for managing role-based access control.

My advice to others looking into using Splunk Enterprise Platform is to definitely purchase Splunk Enterprise Platform and host it in a scalable AWS infrastructure. I am providing this review with an overall rating of nine.