Splunk User Behavior Analytics Reviews

We primarily use this solution for security.

The solution offers good searching and allows for easy creation of dashboards and reports. It's intuitive and not very difficult. You just need to learn the SPL, Search Processing Language, in Splunk. This also helps you to clear more advanced use cases. 

Integration is very easy as well. It's quite good. If you want to add more devices and solutions, or other technologies for monitoring, it's easily done in Splunk, with all its firewalls, its switches, and network devices. 

They can improve the licensing scheme. They are moving from perpetual to term licensing, which is not good. That is an area they need to improve.

On the network monitoring side, if they can have additional features, similar to other solutions like QRadar. They need to add a feature similar to network behavior analytics.

If Splunk is able to add some of those features then the solution will be like perfect.

I think they could have a built-in user behavior analytics engine, and more advanced artificial intelligence features as well. One bad feature on the solution is the network and the behavior of anomaly detection. Their machine learning is good, but I think they can improve on that as well. 

They should work to add more built-in correlation searches and more use cases based on worldwide customer experiences. They need more ready-made use cases.

The solution is very stable; it's very good.

The solution is extremely scalable. Our customers are regularly scaling up after installing Splunk.

Technical support is average. It's not bad, but it's not excellent either.

The initial Setup is straightforward. It's pretty simple to set it up. You just have to configure it.

Deployment took about a month, including forming configurations and customizations. For just the setup, it's only about five days of implementation.

Right now, they have two licensing models, a perpetual license and a term license with an annual subscription. Splunk decided that they would stop the perpetual licensing model, which means that customers will need to buy a subscription going forward.

We use the on-premises deployment model of the solution.

The more types of clusters you have feeding into Splunk, the better the results you have. If you have a customer environment in which you have diverse solutions and technologies, which cater to a large network of applications you are able to inject more value for the customer. One of the key lessons from using Splunk is to have adequate hardware and pre-plan the implementation. It is reasonably balanced, in terms of how much it uses a CPU and the amount of memory it needs.

It's important that you start with good infrastructure when you implement Splunk, or you may run into issues.

Also, make sure to have trained people working on the solution. Otherwise, it will be a waste of investment. 

I would rate the solution nine out of ten. I would recommend the solution to others.

The primary use case for this solution is to collect data from multiple different sources to be able to use it to proactively prevent damages.

We have 81000 desktops and we could take logs off those machines and see patterns, and from those patterns, we've been able to reduce the outages going forward proactively.

The most valuable feature is being able to take data and put it into other systems so that we could see the output and see where we need to apply our focus.

I'm not that close to the actual hands-on usage to suggest improvements. One thing I would say is that they should continue to expand it on more devices. I would say continue to broaden the horizon where there are limitations now.

It's been very stable so far in its core. The company's been great.

It's very scalable. We have it on servers, around 19000 servers, 81000 desktops. We have it on a lot of security devices, so it's been very scalable.

The support's been good from what I've heard. If it weren't, it would've been escalated to me.

We have logs everywhere and trying to look at those logs on an individual basis is quite cumbersome, so taking a tool like this that brings all the logs together for us to dissect and analyze is something that we knew would provide great value.

The initial setup was straightforward. All that was required was a fundamental understanding of what needed to be installed, the virtual control, the backend database, and how you generate the reports. I would think from those aspects it was pretty straightforward.

We implemented through a combination of a reseller and integrator. I'd say for deployment, probably more so through the integrator, and the experience was positive. One company would be DSS. 

I have seen ROI but they're soft call savings, so hard call savings are hard to pinpoint. There's nothing that I could comment on that would be hard savings. Everything's been soft.

Vendors on our shortlist included IBM and DSS.

If I had to rate Splunk from one through ten, one being the worst and ten being the best, 
I would give it a nine. There's always room for opportunity, but I think it's been working pretty good. 

I rate it a nine because I think that the ease of use with the product, like the installation and the support that we receive. From what I hear everything goes well. There's nothing that stands out. We haven't had any vulnerabilities or compliance issues with the product, and we do with others, so those are the reasons why I'd rate it a nine.

Anyone else looking for a product that can consolidate logs this product does what it says it will do.

We use this product to support our operations.

Because of some of the visualizations that we utilize, we are able to understand strange, unusual traffic on our networks.

Being able to look at data rapidly to make a decision.

We have seen a measurable decrease in the mean time to detect and respond to threats. We are now 40 percent or more effective or faster.

I would like a bit more flexibility on how to configure it. It is still a little locked down, as compared to some open source offerings.

It is very stable.

It is pretty scalable.

The technical support is good.

We invested in this solution because our previous way of doing business was not scalable.

The initial setup was complex because some of the configurations that we required needed customization.

We used an integrator for the deployment. They did a pretty good job and continue to help support the product.

Some of the customization is a bit tedious. You really need an integrator to help you out.

The solution has increased staff productivity by around 20 percent.

There are additional costs associated with the integrator.

We currently have a blended environment of ELK, ELK Stack, Elasticsearch, and Splunk.

It helps us make decisions faster.

We are performing a couple of integrations with other products.

We are using the latest version that is available.

Right now we are working with them as partners, so is more of an integration play. I am not personally using it internally. There is another team that is using it as a consumer. For me, it's more of a technical integration.

The most valuable features are its data aggregation and the ability to automatically identify a number of threats, then suggest recommended actions upon them.

I would love to see more integration with other solutions and the ability to perform some actions straightaway from the dashboard.

It is stable.

It could be easier to scale the solution if you are using it on-premise, not in the cloud.

There is a lot of potential in the product. We have seen the product grow over time. There is potential to grow a bit more and become more proactive than it is right now.

First assess the use cases. Then, assess the scale and complexity of the use cases that you are trying to solve before implementing the solution. Do not try to find a solution which fits the use case after the implementation.

Threat hunting is our primary use case.

It hasn't really improved the way our organization functions. It has been neutral.

We have, however, seen a decrease in the mean time to detect threats, by about 15 to 20 percent. We can do more hunting so we can find stuff quicker, but we had other tools that could also do that. It's not bad. It's fine.

The most valuable feature is the ability to search through a large amount of data.

The feature set isn't too bad as is. My biggest complaint is the way they do pricing.

It is fairly stable.

It's scalable.

I don't like their support.

Our previous solution was a really limited version of what Splunk is. Splunk is the number-one leader in this area, so we went with it. It works. But it's the pricing model which is the problem. And you really don't understand upfront how bad the pricing model is until you get stuck with it.

The initial setup was complex. There were a lot of moving pieces. It took a lot to get it going.

We did not use an integrator or consultant.

There's a reason everyone is using other tools to reduce the cost of using Splunk. The ROI is not great, that's why. But once you already have all your data in it, if you have so much already invested in the infrastructure, it's hard to leave it, so you do other stuff to reduce the cost.

Pricing is the problem with Splunk. You can never know the pricing for next year. Every single time you adjust to something new, the price goes up. It's impossible to truly budget for it. It goes up constantly. You can plan for 2x and it will be 3x. You only find out in the long run.

I wouldn't buy Splunk because of the cost, because you can't budget for it. You think you can and then you find out later you can't.

The company is still using it, but they're adding other pieces in to reduce the cost of Splunk. They're spending money to buy another product to pre-process so then they can save money on it.

We've been improving and the maturity's pretty great. This is just one small piece in the overall platform. And the overall platform, from a cybersecurity maturity perspective, is doing well. If you look at it from that perspective, it's had a positive impact, it has not been a drag.

The product itself is a seven out of ten. It's somewhat efficient, if you have the right staff and if everything's working properly. You have to have at least one person do care and feeding at the backend to make sure the infrastructure's working.

In Egypt, we have phones that provide wide internet services to the customer and the customer wants to know what the customer satisfaction and service was. Then, they post on their Facebook or Twitter page to measure the customer satisfaction and after one or two days they start to take the comments and they enter these comments to Splunk and the UBA starts to make correlations and analytics on this data. Finally, the managers or the decision maker get the results, which is wonderful, and the customer is satisfied. These results help to improve customer satisfaction.

Splunk can improve the UBA. There are occasional bugs, but they're not so much of an issue.

We can definitely improve the features, but it depends on the customer's needs. We need to modify or create new dashboards that increase the customer's satisfaction and customer's needs. It depends upon the customer. Not all of the pre-defined dashboards are suitable to the customers or the customer needs on the pre-defined dashboard so we can create dashboards that meet the customer needs.

The scalability of UBA is very useful and helpful but in our country, there is no such need. The customers need UBA as latent data storage. They don't know the efficiency and the usefulness of the app but I think in the near future it will have a better use.

The last time we needed tech support help it was in order to restore some data from frozen parts. They clarified that the data was restored and the bug didn't affect restoring the data.

I hope we can increase the free license to be more than five gig a day. This would help people who want to introduce a POC or a demo license for the solution.

It is a helpful tool, especially for customers who deal with the service industry.

We have been using it for performing analytics for the logs. 

We resell it to our customers. We are also using the tool so that we can build more use cases for our clients. We basically look into understanding how it is performing analytics with Office 365 and how it is correlating those things. 

For us, it has been working great as of now.

We enjoy the overall usability. You just look at the dashboard and you have all the data that you need at a glance. That is probably the best part, I would say. It's easy enough to understand that anyone can pick it up.

My understanding is that the setup is easy.

The solution is stable. 

It's easily scalable. 

UBA is a separate tool and it should be a part of the Splunk base itself so that we can download it. It should be easier to use just like the normal Splunk in that we should be able to put in queries or add custom things. 

We'd like the ability to do custom searches. 

I've been using the solution for the last three months. 

It's a stable, reliable product with good performance. There aren't bugs or glitches. It doesn't crash or freeze. 

It is a scalable product. It can expand with ease. 

I've never dealt with technical support. 

We use all different types of solutions from Splunk, whether it is the SIEM, or ITSI, or even Splunk Enterprise. It's all Splunk. That it's.

We have not used SignalFx. We have been looking into it, however.

From what I have heard, the setup is easy, although I did not set it up myself.

I'm not sure of the exact licensing fees. 

I'm not sure which version of the solution we're using. 

We have been using Splunk for a while, and we were looking for some solutions that incorporate a lot of ML and AI to get insights into the activities that are going on in the user's end devices. We feel that UBA was a much better solution than other options. There are different products, however, we went with Splunk as we have been using other Splunk tools for a while now.

I'd recommend the product to others. 

I would rate the solution eight out of ten due to the lack of custom search and the fact it is sort of disconnected from the complete Splunk environment.