We changed our name from IT Central Station: Here's why
Assistant Manager System at a financial services firm with 10,001+ employees
Real User
Top 10
Stable, with easy log connection and the capability to scale
Pros and Cons
  • "Its compatibility with other SIEMS is very useful."
  • "We find that the maintenance process could be a lot better."

What is our primary use case?

We are using Splunk as a SIEM tool. We're using it for monitoring.

What is most valuable?

The ease of log connection has been great. 

Its compatibility with other SIEMS is very useful. 

They have many basic use cases that we like. 

The cloud version of the solution is especially scalable.

The product has been quite stable so far.

The initial setup is very easy.

What needs improvement?

Technical support is lacking post-sale.

The modification of firmware could be improved.

We find that the maintenance process could be a lot better. 

The solution is more expensive than other options on the market.

For how long have I used the solution?

We haven't been using the solution for too long at this point. It's been about four months or so.

What do I think about the stability of the solution?

The stability has been good. It offers good performance and doesn't seem to be buggy. There aren't glitches. It doesn't crash or freeze. It's reliable.

What do I think about the scalability of the solution?

The solution is scalable. This is especially true for the cloud deployment model. There really isn't anything holding you back if you use that version.

We have around 100 people on the solution currently. 60 to 70 of those are technical users.

We do plan to keep using Splunk

How are customer service and technical support?

Technical support services are lacking, especially after you buy the product. They aren't as helpful or responsive as we need them to be. However, when we do reach them, they are good and they help.

Which solution did I use previously and why did I switch?

I have used McAfee Nitro in the past and IBM QRadar as well.

How was the initial setup?

The initial setup is not complex. It's very straightforward. In fact, it's far easier to install than other log tools on the market. A company shouldn't have any issues with the process.

That said, I did not work on the installation myself. Other people at the company handled that aspect of the process.

The maintenance process could be better. It's a bit difficult once the deployment is done. We need about five people for maintenance tasks.

What's my experience with pricing, setup cost, and licensing?

When you compare the services and features, the pricing is reasonable. That said, if you compare Splunk to other options on the market, it is more expensive.

What other advice do I have?

As we recently purchased the solution, we are using the latest version right now.

I would recommend the solution to other users. 

I would rate the solution at an eight out of ten. If the solution offered a better price and better support services, I would likely rate it higher. However, for the most part, we have been satisfied with the product and its capabilities.

Which deployment model are you using for this solution?

On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
ITCS user
Assistant Manager ICT - Projects at a financial services firm with 1,001-5,000 employees
Real User
Top 20
Good visualization, reliable, scales well, and has good support
Pros and Cons
  • "The additional vendors we've brought on board, particularly the elastic, have been quite beneficial."
  • "The configuration had a bit of a learning curve."

What is our primary use case?

We are currently using it with SIEM, and SOAR which is Security Orchestration, Automation, and Response.

Splunk is primarily used for security, incident response, and security analytics.

How has it helped my organization?

Using Splunk, give us the visualization we need, we can easily observe things such as user behavior analytics, irregular traffic, frequency, and any spikes in unusual activity inside the network.

What is most valuable?

The additional vendors we've brought on board, particularly the Elastic, have been quite beneficial.

It's a solid platform.

What needs improvement?

Other than the pricing modules, I have no issues with the product itself.

The configuration had a bit of a learning curve.

I would like to learn more about the Cloud solution, but I'm aware that it's lacking some core applications.

If they could bring on more vendors, you would be able to monitor a larger number of applications. We could have visualization with other applications we have with the infrastructure in our organization.

For how long have I used the solution?

I did a POC, but we have recently procured it. We did a rudimentary setup to get an understanding of how it works. We are into our sixth month of using it now.

What do I think about the stability of the solution?

Splunk is a very stable solution.

What do I think about the scalability of the solution?

This solution is quite scalable.

In our organization, we have 10 users, who use this solution but we have plans to increase our usage.

How are customer service and support?

The technical support has been quite helpful.

Which solution did I use previously and why did I switch?

The previous solution was limited in its functionality. 

We were looking at the additional controls that enterprise security may have, as well as visualization, to gain greater visibility.

Splunk offered us more visibility.

How was the initial setup?

The initial setup was complex.

We had some assistance with the actual deployment, but while I was doing the POC, I was working with a vendor. There were things I had to do myself, such as the configuration, which was a bit challenging for me, it was a big learning curve.

What about the implementation team?

For the installation, we received some assistance from the vendor.

What was our ROI?

It's too early to know if there will be a return on investment.

What's my experience with pricing, setup cost, and licensing?

The pricing modules could be improved.

The licensing fees are paid on a yearly basis.

There is a standard license with provisions for more. As we are still exploring the functionality, there may be other departments that want to use it.

What other advice do I have?

Those who are interested in implementing this solution should be prepared to dig deep into their pockets.

I would rate Splunk a nine out of ten.

Which deployment model are you using for this solution?

On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Flag as inappropriate
Learn what your peers think about Splunk. Get advice and tips from experienced pros sharing their opinions. Updated: January 2022.
564,322 professionals have used our research since 2012.
HimanshuTejwani
System Administrator and DevOps Engineer at a tech services company with 10,001+ employees
Real User
Top 5Leaderboard
Very straightforward, easy to configure, stable and scalable.
Pros and Cons
  • "This is a straightforward solution, easy to configure."
  • "This is a costly solution."

What is our primary use case?

Our primary use case of Splunk is for log monitoring and infrastructure monitoring. If we want to diagnose any issue in our application, we just push our application logs. This is on any client server using the universal forwarder logs on the Splunk server. After indexing, we can create a base log, and create attractive dashboards that are simple to understand and use. I'm a system administrator and we are customers of Splunk. 

What is most valuable?

This is a straightforward solution, easy to configure and difficult to mess up. 

What needs improvement?

Splunk is a very costly solution and I think it's the most expensive in the market in terms of costing. Splunk provides an application for infrastructure monitoring. If we're monitoring the docker with containers, we can't see the container name, only the ID. That's a big drawback.

For how long have I used the solution?

I've been using this solution for two years. 

What do I think about the stability of the solution?

This is a stable solution. Deployment takes one person, it can be a system admin or an engineer.

What do I think about the scalability of the solution?

This is a scalable solution. We can do the clustering of it for large applications. We have around 15 users for this product. 

How are customer service and technical support?

If I have any issues, I'll go to the community. I can generally get a response within a day. Although most of the documentation is good, some of it is unclear, particularly if you're new to the product. 

How was the initial setup?

I think it takes around 10 minutes to install it on the server. On the client side, it takes around five minutes. I do the installation myself. 

What other advice do I have?

If you're going with this solution, make sure that when implementing the ports are open. If they're not open, it creates problems with the server. Other than that, this is a very stable and very easy to configure product. We can easily deploy and easily use. Other similar solutions are difficult to configure, Splunk is the simplest. I've used three or four monitoring tools and Splunk is the easiest. If a company can afford it, this is a good product. We are planning to shift to another product because of the cost. We're searching for an open source or cheaper product.

I would rate this solution a nine out of 10. They lose one point for the price and lack of infrastructure support.

Which deployment model are you using for this solution?

On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Consultant at a financial services firm with 5,001-10,000 employees
Real User
Top 5
Good scalability, dashboards, and alarms, but should have a default dashboard for a firewall and better knowledge base
Pros and Cons
  • "Its dashboard is valuable. If you have a good knowledge of how to create a dashboard, you can create any dashboard related to cybersecurity. If fine-tuned, the alarms that are triggered for instant review are also very valuable and useful."
  • "Splunk is query-based, which is not the case with most cybersecurity tools. It is based on search queries and can be difficult to use. It would be good if they can make it easier to understand how to create search queries. They can improve the knowledge base for better understanding. To create your dashboard, you need to have a search query. We have multiple firewalls in our company, and we need a dashboard for them. It would be helpful if a default firewall dashboard is included in Splunk to make monitoring easier. If a dashboard is available for a security device, the operation part will be more efficient. We won't have to follow a manual process for this."

What is our primary use case?

We are using Splunk for cybersecurity operations.

What is most valuable?

Its dashboard is valuable. If you have a good knowledge of how to create a dashboard, you can create any dashboard related to cybersecurity. If fine-tuned, the alarms that are triggered for instant review are also very valuable and useful.

What needs improvement?

Splunk is query-based, which is not the case with most cybersecurity tools. It is based on search queries and can be difficult to use. It would be good if they can make it easier to understand how to create search queries. They can improve the knowledge base for better understanding.

To create your dashboard, you need to have a search query. We have multiple firewalls in our company, and we need a dashboard for them. It would be helpful if a default firewall dashboard is included in Splunk to make monitoring easier. If a dashboard is available for a security device, the operation part will be more efficient. We won't have to follow a manual process for this.

For how long have I used the solution?

I have been using this solution for eight months.

What do I think about the stability of the solution?

In terms of operations, it is stable, but if you don't have a proper configuration and sizing, there could be many issues. It could be more efficient on the storage part. We are still in the deployment stage to be able to say that for sure.

What do I think about the scalability of the solution?

It is very scalable. Currently, we have around 50 users. We will increase its usage if more people need access.

How are customer service and technical support?

We have raised multiple tickets. Some of them are good, and some of them can be better. Overall, their technical support is okay.

Which solution did I use previously and why did I switch?

We didn't use any other solution.

How was the initial setup?

I didn't do the initial configuration. I take care of the operations part. One of our clients did it, and it is somehow complex, and it takes time. It also depends on your knowledge. If you don't have knowledge of Splunk, it is complex.

Which other solutions did I evaluate?

We are a partner of Splunk. So, we did not evaluate other solutions.

What other advice do I have?

I would rate Splunk a seven out of ten.

Which deployment model are you using for this solution?

On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Sr. Cyber Security and Solutions Architect at a government with 10,001+ employees
Real User
Robust, with the ability to capture different data streams and good reporting capabilities
Pros and Cons
  • "It allows us to digest the information, the data, the different data streams, so we can make decisions based upon information that we receive, and it is pretty robust."
  • "The configuration could be better."

What is our primary use case?

It's the mainstay of our monitoring solutions that we have for auto-logging, et cetera, for our enterprise solution.

What is most valuable?

The most valuable aspect of the solution is the ability to capture the different data streams. We also appreciate the reporting in that aspect of Splunk. If we can grow now, with any security arena, it's going to be proactive, not reactive. It allows us to digest the information, the data, the different data streams, so we can make decisions based upon information that we receive, and it is pretty robust.

What needs improvement?

The configuration could be better.

We would like to see improved pricing, however, I'm kind of out of that arena. I make suggestions based upon the flexibility with which we serve our customer base, which is millions of our veterans. I would say that if someone was not familiar with it, one of the things that I've heard is that it's kind of hard for them to understand the whole thing. Splunk is just one piece to the puzzle. It's not the whole puzzle. It's kind of not the solution's fault, in that sense. That said, if it could be more accessible to people with different skillsets, that would be ideal.

We'd like to see reporting where there's a way that we can get a higher description without being too technical, for example, where it's kind of more of an executive-level of technical.

For how long have I used the solution?

I've personally been using the solution for over ten years. At this point, it's been more than a decade. I've used it for a while now. 

What other advice do I have?

We're partners and end-users. We don't have a business relationship with Splunk.

We use the latest version. I'm not hands-on. I'm called the architect, however, we do use the latest version as that's a part of our configuration management framework, that all of our applications - especially in security - are up-to-date with the latest and greatest updates, bells, and whistles. We use both public and private clouds.

In terms of creating the solution, for what we do from an enterprise standpoint, everything from monitoring to data capture to reporting, we would rate it at a nine out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Flag as inappropriate
Praful Bhatnagar
Principal Systems Engineer at a computer software company with 10,001+ employees
Real User
Top 5
A reliable and complete solution, but the pricing model is complex and it's expensive
Pros and Cons
  • "The completeness of the solution is what we like the most."
  • "It's difficult to set up initially, and their billing model is also a bit complicated."

What is our primary use case?

We are using the mobile SDK to check the stability of mobile applications.

What is most valuable?

The completeness of the solution is what we like the most.

What needs improvement?

It's difficult to set up initially, and their billing model is also a bit complicated. 

We have to predict in advance how much data we will have and what the storage would be that we don't have. This makes the licensing complicated because when you start you don't have these numbers.

In order to know how much it will cost, you need those numbers.

I really wish that it was an application that was easier to use.

For how long have I used the solution?

I have been working with Splunk for more than five years.

What do I think about the stability of the solution?

We have not experienced any issues.

What do I think about the scalability of the solution?

For our use cases, we have not required any scaling.

How are customer service and technical support?

The technical support is fine. At times, they take time to respond back but it may have been the support contract that our client had.

I would assume that they are not as responsive as we want them to be.

How was the initial setup?

We have a team of approximately 100 people who are responsible for the development of mobile applications, DevOps, and application development.

What's my experience with pricing, setup cost, and licensing?

The licensing cost model is complicated.

I think that most of the monitoring solutions are expensive. I wish they were less expensive, for all types of products for monitoring.

Which other solutions did I evaluate?

We work with Splunk, but we are looking for some LOG Kinetics solutions for our clients.

What other advice do I have?

I would definitely suggest sending people to analyze or evaluate Splunk.

Because the licensing model is very complicated to understand, it would be better to start with another product that provides a better licensing model. Later, if the product is not working well, they can consider using Splunk and may have a better understanding of the cost.

For me, I would not recommend Splunk as their first solution unless they have all of the data that is required.

I would rate Splunk a seven out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Attila Mate Kovacs
Senior Cyber Security Expert at a security firm with 11-50 employees
Real User
Top 5Leaderboard
Great performance, easy to set up, and offers good speed
Pros and Cons
  • "The level of robustness on offer is very good."
  • "The complexity could be worked on so that it's even easier and faster."

What is our primary use case?

Typically, we use the solution for critical infrastructure companies. 

What is most valuable?

The speed is a very valuable aspect of the solution. 

The way Splunk handles low data and low-rate costs are great.

The level of robustness on offer is very good. 

The initial setup is very straightforward. 

We have found that the solution offers good integrations with other products.

Overall, the solution works very well.

What needs improvement?

The complexity could be worked on so that it's even easier and faster. However, I understand that, if some complexity was removed, there might be slightly more limitations.

Occasionally there are data sizing and data-related issues that need to be overcome.

For how long have I used the solution?

I've been using the solution for a couple of years.

What do I think about the stability of the solution?

The performance is very good. It's something that customers are always looking for. The product offers good stability. There are no bugs or glitches and it doesn't crash or freeze. It's reliable. 

What do I think about the scalability of the solution?

We have about five to ten partners that use Splunk.

Which solution did I use previously and why did I switch?

I'm a fan of QRadar. I use them as well.

How was the initial setup?

The initial setup is very straightforward. It's not overly complex or difficult. A company shouldn't have any issues with the process. The deployment process doesn't take too long. You can manage it with fewer people and smaller teams. This is especially true if it isn't the critical infrastructure that you are working with. 

For deployment and maintenance, you only need two to three people. That can include one manager and two professionals. Since Splunk is easier to handle, more people can join in on the client-side.

What's my experience with pricing, setup cost, and licensing?

We also use QRadar, and we make more money with QRadar than with Splunk as we can make bigger projects happen. However, we find that with Splunk, while we don't make as much money on each project, we can do more of them.

What other advice do I have?

I'd rate the solution at an eight out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Flag as inappropriate
Rajiv Warrier
Regional Head at a tech services company with 51-200 employees
Real User
Top 5Leaderboard
Good technical support, scalable, and very stable
Pros and Cons
  • "It's basically one of the best SIEM products on the market."
  • "You do need a lot of training and certification with this product."

What is our primary use case?

The solution is primarily a SIEM tool and it basically helps companies with security.

What is most valuable?

It's basically one of the best SIEM products on the market.

The scalability is great.

We have found the solution to be stable. 

Technical support is helpful. They respond in a timely manner. 

What needs improvement?

I'd like to see more documentation on the product.

The initial setup is not straightforward.

You do need a lot of training and certification with this product. Other than that, it's pretty good.

For how long have I used the solution?

I've been dealing with the solution for about three years. It's been a while. 

What do I think about the stability of the solution?

The stability of the product is very good. The performance is reliable. There are no bugs or glitches. it doesn't crash or freeze. We've had no issues. 

What do I think about the scalability of the solution?

The scalability of the solution is great. If a company needs to expand it, it can do so. It's not a problem.

We have about nine customers that are using Splunk.

How are customer service and support?

I've dealt with technical support and it's pretty good. They are helpful. I find them responsive. 

How was the initial setup?

The initial setup is not straightforward. It depends upon the IT infrastructure that the customer has. If they have a lot of security solutions, such as DLP and other security solutions, then it is more complicated. The more you have the more complicated it gets.

The deployment of Splunk takes about three weeks.

We have six or seven team members within our organization that can handle deployment and maintenance tasks. 

What about the implementation team?

I handled the implementation myself. It was done in-house. 

What's my experience with pricing, setup cost, and licensing?

Splunk requires a paid license. There's no free option. Customers have to pay for the license, implementation, support - everything.

What other advice do I have?

The solution can be deployed both on-premises and on the cloud. 

I'd rate the solution at a nine out of ten. We've been very happy with the product.

I would recommend the solution. It really is the best.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Flag as inappropriate