Coming October 25: PeerSpot Awards will be announced! Learn more
Senior Solutions Architect at a manufacturing company with 51-200 employees
Real User
Top 5Leaderboard
Seamless integration with devices and operating systems, centralized management and control, and proactive support
Pros and Cons
  • "The integration is seamless with many devices and operating systems."
  • "Being a SIEM solution with a centralized dashboard, we would like to have more options to customize it."

What is our primary use case?

We are a solution provider and Splunk is something that we provide as a service to our customers.

What is most valuable?

The most valuable feature is the reporting and the information that is provided by the tool.

It is very easy to implement a PoC using Splunk, which will show the value of the reporting and data that it provides.

The integration is seamless with many devices and operating systems.

It is flexible enough that you can choose what kind of deployment model you want.

They have a large solution toolkit that supports IoT, wherein businesses can get a lot of help with the centralized management functionality. There are also tools to assist from the security and SIEM perspective, and there is a centralized dashboard.

What needs improvement?

Being a SIEM solution with a centralized dashboard, we would like to have more options to customize it. It should be easy to customize dashboards.

When we are monitoring something, we would like to have a more granular outlook. Splunk has a good dashboard that is easier to use than some competing products, but better customizability would be a great help for the users.

For how long have I used the solution?

We have been working with Splunk for approximately three years.

Buyer's Guide
Splunk
September 2022
Learn what your peers think about Splunk. Get advice and tips from experienced pros sharing their opinions. Updated: September 2022.
634,590 professionals have used our research since 2012.

What do I think about the stability of the solution?

This product is very stable.

What do I think about the scalability of the solution?

Splunk is a very scalable solution. Being a Japanese product, they will ensure that all of the features work in any environment. It is very heterogeneous. It can integrate with Windows, Linux, AIX, HP-UX, and Solaris. It also supports IoT devices, mobile phones, and more.

We have more than 150,000 people using our services.

How are customer service and support?

The Splunk team has good, proactive support. Also in terms of assisting with the installation, they are quite good.

Which solution did I use previously and why did I switch?

Splunk is similar to IBM QRadar, which we also have experience with. However, Splunk has advanced SIEM features included with it, so we often use it to satisfy this requirement. Whenever an organization is looking to implement SIEM, they have the flexibility to choose Splunk, QRadar, or the ArcSight Logger solution.

One of the major differences that I see between Splunk and QRadar is that Splunk gives the users fewer devices, so they can do things quicker. 

How was the initial setup?

The installation for Splunk is easier than competing products QRadar and ArcSight.

We have Splunk deployed on the cloud so that we can provide the service, but some of our customers have it installed on-premises.

All the user has to do is download the Splunk server agent, install it on the laptop or endpoint, integrate 50 or 100 devices, then see what kind of reporting is available.

What about the implementation team?

We have an in-house team for deployment in maintenance. Splunk is a tool that does not require much staff to maintain. The users can start with a PoC, simply learn it, and deploy it for themselves. They don't require subject experts to be hired for the installation and configuration.

What's my experience with pricing, setup cost, and licensing?

Price-wise, if you compare QRadar to Splunk for SIEM functionality then they are in the same range but when you integrate SOAR with these solutions, Splunk takes the lead and is more competitive.

What other advice do I have?

This is a product that I recommend for anybody who wants and advanced SIEM solutions. Of the three that I have used including QRadar and ArcSight, Splunk is the one that I prefer.

I would rate this solution a nine out of ten.

Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
PeerSpot user
Md. Iqbal Karim - PeerSpot reviewer
Technical Account Manager at Trustaira
Reseller
Top 20
Straightforward to set up with great integration capabilities and a high level of maturity
Pros and Cons
  • "The solution has proven to be quite stable."
  • "The product is relatively expensive."

What is our primary use case?

We primarily use the solution for monitoring and security.

We can use the solution to try to find some correlational data. For example, in banks, there is usually a protocol whereby users cannot withdraw more than a certain amount of money from an ATM. However, we find that, when people are on holiday, they are trying to withdraw more than the allowed amount. It's a use case we can deploy in our country. You can set certain rules and watch the data in order to gain insights.

How has it helped my organization?

I cannot speak to a specific example of how the solution has assisted our organization.

What is most valuable?

The solution's capability is its most valuable aspect.

The initial setup is very straightforward.

The solution has proven to be quite stable.

We've found the solution to be very mature.

The integration capabilities are excellent. They have apps that integrate quite well with Palo Alto and Cisco, for example.

What needs improvement?

Sometimes it becomes very difficult to find certain results from Splunk. Not all users are developers and they are not able to write code to find specific results or specific details from Splunk. From a user perspective, the solution needs to improve the search functionality.

The dashboard could be improved. If it was easier for non-developers or those working in network security, it would be ideal. It would be nice if they had a built-in dashboard for those who are less knowledgeable in coding.

The product is relatively expensive. 

For how long have I used the solution?

I haven't been using the solution for very long just yet.

What do I think about the stability of the solution?

The solution is very stable. There are no bugs or glitches. It doesn't crash or freeze. It's reliable.

What do I think about the scalability of the solution?

We do not plan to increase usage at this time.

How are customer service and technical support?

We've used technical support in the past. We've found them to be very helpful and responsive. We're satisfied with the level of support that we receive when we reach out for help.

Which solution did I use previously and why did I switch?

I've previously used LogRhythm, among other solutions. We sell a few different solutions.

How was the initial setup?

The initial setup is not too difficult. It's not overly complex. It's straightforward. The code is very easy.

The deployment took two or three months or so.

What about the implementation team?

We used an integrator to assist us in the initial setup.

What's my experience with pricing, setup cost, and licensing?

The problem with the product is that the price of Splunk is very high. It is an industry leader and therefore it's high in terms of price. That is the issue in our country. Sometimes people want to buy Splunk, however, due to the budget, they are not able to.

What other advice do I have?

We are resellers.

We use a variety of deployment models, including private cloud and hybrid.

This solution is the best security solution. If a company is looking for the best, they have to buy Splunk. It is a very good and very mature solution. It is very easy to integrate with some other service or security solutions. If they have specific solutions that need to be integrated for monitoring purposes, it should be a problem. For example, it integrates very well with Cisco.

I'd rate the solution at a ten out of ten. We are quite happy with its capabilities.

Which deployment model are you using for this solution?

Private Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Reseller
PeerSpot user
Buyer's Guide
Splunk
September 2022
Learn what your peers think about Splunk. Get advice and tips from experienced pros sharing their opinions. Updated: September 2022.
634,590 professionals have used our research since 2012.
Salma Shahin - PeerSpot reviewer
Senior Engineer at Sony India Software Centre
Consultant
Top 20
Well-organized, user-friendly, and suitable for complex and large environments
Pros and Cons
  • "It is the best tool if you have a complex environment or if data ingestion is too huge."
  • "The cluster environment should be improved. We have a cluster. In the Splunk cluster environment, in the case of heavy searches and heavy load, the Splunk cluster goes down, and we have to put it in the maintenance mode to get it back. We are not able to find the actual culprit for this issue. I know that cluster has RF and SF, but it has been down so many times. There should be something in Splunk to help users to find the reason and the solution for such issues."

What is most valuable?

It is a very well-organized solution. I find it more user-friendly than ArcSight and QRadar. I can search, and I can do whatever I need in terms of dashboards, reports, etc.

It is the best tool if you have a complex environment or if data ingestion is too huge.

What needs improvement?

The cluster environment should be improved. We have a cluster. In the Splunk cluster environment, in the case of heavy searches and heavy load, the Splunk cluster goes down, and we have to put it in the maintenance mode to get it back. We are not able to find the actual culprit for this issue. I know that cluster has RF and SF, but it has been down so many times. There should be something in Splunk to help users to find the reason and the solution for such issues.

I would also like to be able to see all the data for internal logs. When we search for internal logs, sometimes, we are not able to find some of the data. For example, when Splunk crashes or something happens, we don't get to know what happened. We tried looking into the internal logs, but we could never figure out the reason from the logs. The information is limited, and it should be improved.

For how long have I used the solution?

We have been using Splunk for more than four years.

What do I think about the scalability of the solution?

Its scalability is very good. Companies nowadays are totally dependent on tools like Splunk. It is widely used in our organization. We have a huge team that uses it on a daily basis. For onboarding, we have another team, and we also have a team for Splunk monitoring. We have a large amount of data ingestion per day, so our team has more than 25 people in it.

How are customer service and support?

In my current company, I have seen the tickets getting resolved soon. In my previous company, which was a startup, a P1 ticket generally took 24 hours or less. They called us back and resolved it as soon as possible, but if it was a P2 or P3, I have seen them taking a month or more.

Which solution did I use previously and why did I switch?

We worked with QRadar for some time, but after that, we just came to Splunk.

How was the initial setup?

It is straightforward. The deployment duration totally depends on how you are working.

We have it on-premises as well as on the cloud.

What's my experience with pricing, setup cost, and licensing?

We have an unlimited one, and we pay yearly, but I don't know how much it costs. Previously, I worked for a startup, and when they started building it up, it was complicated for them because they didn't have the budget for that many licenses. It was very costly for them. So, startups might find it a little bit problematic because of the licensing, but for bigger companies, there is no issue.

What other advice do I have?

If it is a complex environment and data ingestion is huge where you want to ingest Syslogs or networking devices logs, you should go with Splunk. It is better than QRadar. Nowadays, the usage of AWS is growing, and that should be taken into consideration when deciding about on-premises or cloud deployment.

I would rate it a nine out of 10. I find it great. I'm very eager to do the Splunk certifications as well.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
Flag as inappropriate
PeerSpot user
Gregg Woodcock - PeerSpot reviewer
Consultant at Splunxter, Inc.
Real User
Top 10
Our clients are easily able to modify and evolve their implementations
Pros and Cons
  • "With good domain knowledge, one can build almost anything. If you throw in Alert Manager or an integration with ServiceNow. Then, you have your own SIEM"
  • "Our clients are easily able to modify and evolve their implementations."
  • "It needs a better way to export dynamic views without requiring a ton of code and user/pw."
  • "It needs integration with a configuration management solution."
  • "It needs integration with a configuration management solution."

What is our primary use case?

Security. We have built SIEM solutions three times from the ground up (not ES) using Splunk for some of the largest companies in the world.

How has it helped my organization?

Out clients went from unhappy using inflexible, poorly-supported products (in some cases barely functionally) to confident and excited when using Splunk. Not only are they able to do their security jobs and investigations, but they are also easily able to modify and evolve their implementations themselves to keep up with the shifting sands, which is the SecOps landscape.

What is most valuable?

  • Core Splunk
  • Saved searches
  • Dashboards (SimpleXML) 

With good domain knowledge, one can build almost anything. If you throw in Alert Manager or an integration with ServiceNow. Then, you have your own SIEM.

What needs improvement?

  • It needs integration with a configuration management solution. 
  • It could use better password management for forwarders. 
  • It needs a better way to export dynamic views without requiring a ton of code and user/pw.

For how long have I used the solution?

Almost 10 years.

What do I think about the stability of the solution?

Unfortunately, lately every release has a new memory leak.  Be SURE to upgrade late and READ THE RELEASE NOTES, especially the "Known Issues" section.

What do I think about the scalability of the solution?

We only ever have issues when deployed on VMs and the VM admins do not do what we tell them to do which is EXCLUSIVELY RESERVE OUR RESOURCES.

How are customer service and technical support?

It used to be great (but perhaps that was because my employer at the time was a key prospect in a vertical where Splunk had no customers) but Splunk support is definitely a victim of Splunk's explosive growth.  The first tier support is as bad as it is most places and getting worse all the time.  If you KNOW your problem is not run of the mill, ask for escalation immediately.  Also the clock on the case does not start until somebody adds a note to the case so always call in and ask if they got your diag file (always attach a diag) and the person who answers will have to add a note to the case which will start the clock.

Which solution did I use previously and why did I switch?

I have dabbled with LogRythm and ArcSight and they are both OK, but Time-To-Value is WAY shorter with Splunk, IMHO.

How was the initial setup?

Use bare metal severs on Linux and you will be fine.  Use Windows and you will have much trouble.  Use VMs and your admins will cheat you and you will have much trouble.  Do not use NAS!!!!

What about the implementation team?

In-house.  We at Splunxter are Splunk experts.  We can do anything with Splunk.  We always hit homeruns.

What was our ROI?

We usually get multi X-factor within a quarter.

What's my experience with pricing, setup cost, and licensing?

Get free PS if you can (ask) or USE THE DOCS.  The documentation will get you to success.  If you are not getting more value out of Splunk than the license you are paying, then you are doing something wrong and should spend a tiny bit more to get a consultant like Splunxter.com to help you.

Which other solutions did I evaluate?

No,we went with the free trial and got so much value so quickly we bought in.

What other advice do I have?

You can also get GREAT help at answers.splunk.com.

Disclosure: My company has a business relationship with this vendor other than being a customer: We are a Splunk-focused consulting company, but not a Splunk Partner. I am also a member of the "Splunk Trust", Splunk's "MVP" program.
PeerSpot user
Senior security consultant at a comms service provider with 51-200 employees
Consultant
Threat hunting is a key feature for us
Pros and Cons
  • "One of the most valuable features is threat hunting. We can do threat hunting and identify if there is any malicious activity happening within our environment, which is a key feature for us."
  • "Splunk could be improved by reducing the cost. The cost is one of the biggest challenges for us in keeping to our production requirements."

What is our primary use case?

Our initial use case was for security investigation, with the intention of creating some use cases. We ended up adding operational aspects, monitoring certain operational activities, such as high CPU utilization or any other applicational basis. 

This is obviously a cloud solution, but it does have some presence on-premises as well, so it's hybrid. 

What is most valuable?

One of the most valuable features is threat hunting. We can do threat hunting and identify if there is any malicious activity happening within our environment, which is a key feature for us. 

What needs improvement?

Splunk could be improved by reducing the cost. The cost is one of the biggest challenges for us in keeping to our production requirements. 

As for additional features, I think they need to refine their AI capability. I know that everyone is talking about artificial intelligence and threat hunting, so I guess one of the key requirements for us is for the solution to automatically provide us some kind of indication and then mitigate any risk. So automation should be a feature. 

For how long have I used the solution?

I have been using Splunk for two years. 

What do I think about the stability of the solution?

This solution is excellent from a performance and stability perspective. There's very minimal maintenance required. Basically the only aspect we need to maintain is the one we have on-prem. So patching up everything and making sure it has the required updates. 

What do I think about the scalability of the solution?

There are no issues at all in terms of scalability, since this is a cloud-based solution. There are around 25 to 30 users in my company accessing Splunk. 

How are customer service and support?

Splunk's support is good. The process was smooth and they provided sufficient support, so there was no need to escalate anything. Also, they provide training on a regular basis, which is good. 

Which solution did I use previously and why did I switch?

I have never worked with other similar products. I've worked for three companies, all of which use Splunk. 

How was the initial setup?

The initial setup was very smooth. I think we got some support from the Splunk team. Since it's a cloud-based solution, it took us probably three or four weeks to actually start working. But deploying agents, configuration, refining, fine tuning, and other ongoing activities went on for about a month. 

What about the implementation team?

We implemented through an in-house team with some support from the Splunk team. It was a very smooth process, from our perspective. 

What's my experience with pricing, setup cost, and licensing?

This solution is costly. Splunk is obviously a great product, but you should only choose this product if you need all the features provided. Otherwise, if you don't need all the features to meet your requirements, there are probably other products that will be more cost-effective. It's cost versus the functionality requirement. 

Which other solutions did I evaluate?

I also evaluated IBM QRadar and LogRhythm NextGen SIEM

What other advice do I have?

I work in security architectures, not operations, so I don't actually work with Splunk on a regular basis, but the team that does is working on threat hunting and incident management. 

I rate Splunk an eight out of ten. 

Which deployment model are you using for this solution?

Hybrid Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Other
Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Senior Informatica Administrator at a computer software company with 10,001+ employees
Real User
Top 20
The logging features are useful as are the dashboards and alerts
Pros and Cons
  • "Splunk is a user-friendly solution."
  • "In terms of the interface, it could include some improvements for the look and feel."

What is our primary use case?

We use Splunk on-premise. We mostly use it for log analysis and fraud detection. We are also testing using it in machine learning and other solutions. We have 10 people managing Splunk and we have approximately 150 people using the product in total.

How has it helped my organization?

With Splunk, we got more insights out of our data as it includes machine and secure data. It also has a logging attendance system and this helps to protect our resources from any  attackers hacking system information at a granular level

What is most valuable?

The logging features are useful as are the dashboards and alerts in addition to the organization of data. It has options for creating dashboards and alerts. You can also create queries in the SQL language. Splunk is a user-friendly solution.

What needs improvement?

Index performance is a bit slow but this is partly due to the huge volumes of data for our industry within our environment This makes the index very large and inefficient in terms of performance. Performance could be improved to cater to this, however. We have also had problems with the compatibility between Splunk and other systems. We have previously been on 5.3 and migrated to 5.5. We are now planning to migrate to version 7.7. It has been difficult to find documentation about the compatibility with Linux. In terms of the interface, it could include some improvements for the look and feel.

For how long have I used the solution?

We have been using Splunk for one year in our infrastructure environment.

What do I think about the stability of the solution?

The users access the native cloud solution. So we are taking advantage of the native cloud solution provided, and by using the gentle scaling approach this has helped stability.

What do I think about the scalability of the solution?

We scaled up gradually from three processes up to five, and the performance is okay. So we used gentle scaling  but this also helped stability.

How are customer service and technical support?

We have used Splunk tech support often. If we have a critical issue such as server down or frequently occurring issues they are always reliable and provide us with solutions to our problems. Technical support for Splunk is good.

How was the initial setup?

Setup is complex. We tried to cluster five indexes. This helped us migrate our data into the Splunk environment. We are using 20 applications which make use of this indexed data. The actual deployment took us about two to three weeks because of some problems getting the data into the system.

What about the implementation team?

We worked with a Splunk consultant who shadowed us to help ensure we performed the process correctly. 

What's my experience with pricing, setup cost, and licensing?

Licencing occurs yearly. We now have a three-yearly support contract as of now.  Licensing is a yearly, one-time cost.

Which other solutions did I evaluate?

We considered a few alternative products because the logging was faster. In the end, we decided to go to Splunk.

What other advice do I have?

I would definitely recommend Splunk. We will review performance within two years of our three-year contract and then decide at that point what other aspects we need to consider. I would rate Splunk 8 out of 10.

Which deployment model are you using for this solution?

On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Praful Bhatnagar - PeerSpot reviewer
Principal Systems Engineer at Aricent
Real User
Top 5
A complete solution that satisfies the needs of our clients, but it is complex to set up and use
Pros and Cons
  • "It's the completeness of the solution that we like the most."
  • "Our two main complaints are about the difficulty of the initial setup and the licensing model."

What is our primary use case?

We are a software development company and Splunk is one of the products that we have implemented for our clients. It is used for log analytics as well as the mobile SDK for checking the stability of mobile applications.

What is most valuable?

It's the completeness of the solution that we like the most. It has a solution for backend log analytics, but also one for mobile applications.

What needs improvement?

Our two main complaints are about the difficulty of the initial setup and the licensing model.

The billing model is a little bit complicated because you have to predict in advance how much data you'll have and how much storage you'll need. When you start, you don't really have those numbers but to get the licensing, you need them. It is only at that point that you'll know how much the product is going to cost you.

For how long have I used the solution?

I have been working with Splunk for more than five years.

What do I think about the stability of the solution?

There have been no issues in particular. What we are using has not been that heavy.

What do I think about the scalability of the solution?

We have not had any problems with respect to scalability.

How are customer service and technical support?

Based on when we have been in contact with them, I think that technical support was fine.

I'm not sure if they have different support models but I think it took a long time for them to respond. It may be a consequence of the support contract our client had with them.

How was the initial setup?

This is a complicated product to use and you need constant help to set it up. I really wish that it was easier to set up and use.

What about the implementation team?

We do not have any dedicated people who are working on Splunk, but we have a team of approximately 100 people that are responsible for the development of mobile applications, backend systems, DevOps, etc.

What's my experience with pricing, setup cost, and licensing?

I think that most of the log analytics solutions are expensive and I'm not sure if it's worth it. However, I wish that they were less expensive. I am not talking about a single product but rather, all of the ones that are in the domain of log analytics.

What other advice do I have?

Splunk is a good product but I would definitely tell people to analyze their requirements to see if Splunk fits their use case, or not. The licensing model is very complicated, so if there is a product that has a better licensing model then it would probably be good to start with that. Then, later on, if the product is not working well enough, then they can switch to Splunk. At that point, they will have knowledge of the data they are using and will understand the costs that they might incur while using it. 

The only way that I would suggest somebody use this as their first solution is if they already had all of the data that is required to get a cost estimate.

I would rate this solution a seven out of ten.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Ali Tamimi - PeerSpot reviewer
Managing Director at Hayyan Horizons
Real User
Top 20Leaderboard
Low-maintenance and stable with very useful dashboards
Pros and Cons
  • "The log aggregation is great."
  • "Technical support needs to be more responsive."

What is our primary use case?

We primarily use the solution for security and operations monitoring.

How has it helped my organization?

Gives full visibility on operational and security posture in our organization. Integrations is straightforward and effective.

What is most valuable?

The log aggregation is great.

The solution offers good data analytics.

The dashboards are very helpful.

The initial setup is simple and straightforward. 

The solution is low-maintenance.

It's a stable product.

We have found that the solution scales well. 

What needs improvement?

The TERM licensing model is still not very useful. It's not helping us. They used to have a perpetual licensing model. Now Splunk is offering annual term/subscription only. That's costly and it's more expensive and it's putting some burden on us.

Technical support needs to be more responsive. 

We would like to see more AI. Through AI, artificial intelligence, not machine learning only. We want to see more AI-enabled kinds of functionalities just to reduce dependencies on manual interventions. We do that, however, automation and artificial intelligence-based kind of automation we would really like to see.

For how long have I used the solution?

I've been using the solution for six years. I've used it for a while at this point. 

What do I think about the stability of the solution?

It's not high maintenance. There are software or upgrade releases every now and then, however, in general, the product is very stable. There are no bugs or glitches. It doesn't crash or freeze. 

What do I think about the scalability of the solution?

We have 17 people that are using the solution currently. 

It's very easy to scale the product if you need to.

How are customer service and technical support?

We use technical support every now and then. The response times are not very good. This is the thing that I would need to see improvement on and probably in that area only. They are that good when they started handling cases, however, they take too much time to respond to customer requests.

Which solution did I use previously and why did I switch?

We did not use anything else on the production scale. Our first experience was with Splunk.

How was the initial setup?

The solution is straightforward and simple to set up. It's not complex at all.

What about the implementation team?

We handled the process internally. We did not need the assistance of any integrators or consultants. 

What's my experience with pricing, setup cost, and licensing?

Filter the noise out.

Which other solutions did I evaluate?

Yes all the other competitors, Splunk by far is the best.

What other advice do I have?

We're a partner and a customer. 

I'm using the latest version of the solution. 

I would highly recommend the solution. It's the best product out there. It's definitely easy to set up. The use cases are multiple. It's not restrictive in terms of the efficiency of the platform. Just make sure that you have enough resources or good counsel from people who can help with the use cases. If you do the sky would be the limit. It is a good solution.

I'd rate the solution at a ten out of ten.

Which deployment model are you using for this solution?

On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
PeerSpot user
Buyer's Guide
Download our free Splunk Report and get advice and tips from experienced pros sharing their opinions.
Updated: September 2022
Buyer's Guide
Download our free Splunk Report and get advice and tips from experienced pros sharing their opinions.