What advice do you have for others considering Splunk Enterprise Platform?

My advice to others looking into using Splunk Enterprise Platform is to research the product and utilize all the support that Splunk provides. I have rated this review a ten out of ten.

My advice to others looking into using Splunk Enterprise Platform is to make sure you have a defined use case you can measure against. Splunk Enterprise Platform is deployed on-premises in our organization. We don't have it at that scale, but I'm sure Splunk Enterprise Platform would work very well for managing data sovereignty at a petabyte scale within our environment. We don't use the trusted control plane, so I don't have experiences in maintaining granular control over data using it. We won't be using Splunk Enterprise Platform with any AI because of the client data we hold, which affects how we manage access to our operational data. My impression of Splunk Enterprise Platform's approach to managing governance within a private network environment is very good. The cost of it keeps it from being a perfect ten for me. For manual searches, we are very happy with the outputs of Splunk Enterprise Platform. I would rate this product an overall nine out of ten.

I cannot comment on Splunk Enterprise Platform's capability to manage data sovereignty at a petabyte scale within my environment because we're not at that level. We haven't been using Splunk Enterprise Platform's federated search for querying data in place, so there hasn't been much evolution or primary drivers for either expanding or limiting its use. I have no experience in maintaining granular control over data using the trusted control plane within Splunk Enterprise Platform; we don't use it much. I learned a lot at this conference about how we can manage access to our operational data through Splunk Enterprise Platform; we're not quite at that level, but once we are, then I'll have more feedback. I don't think we use the feature to track specific metrics to evaluate the success of reducing TCO with Splunk Enterprise Platform's non-indexing analytics approach. My advice to others looking into using Splunk Enterprise Platform is to start small; ingest a little bit of data that you can start to see returns on right away, and then expand from there as you learn how it works. My overall review rating for Splunk Enterprise Platform is eight out of ten.

I think there are always challenges to some things that you learn to build out. It was not anything technical, it was just learning how to manipulate the dashboards and manipulate the data to perform or show how you wanted it to show. Once you figure that out, you can make it as expansive as you would want to.I would say around AI, everyone needs to improve their governance and security. As great as AI is, it is also scary. While I as the engineer do enjoy having an agentic friend helping me out and making things more efficient, guardrails are still needed to be implemented as we move further into this agentic space. I think they are pretty accurate. I have not had any issues at this point, but as we go and continue to do our research and due diligence, I am sure things will get better. Continue doing the homework, continue researching, continue using the tool to the best of its capabilities, and building out your data sets as you see fit. I would rate this product a nine out of ten.

Regarding Splunk Enterprise Platform's AI capabilities, we have not used it because it is on classified systems, which are air-gapped networks. I have not used Federated Search. In maintaining granular control over data using the Trusted Control Plane within Splunk Enterprise Platform, we have a few users from cybersecurity who have everything under the Power User role, and then we have admins. That is all. Regarding Splunk Enterprise Platform's approach to managing governance within a private network environment, we use mostly business process as opposed to the technology, so we have not explored that yet, and I would be actually interested in learning about it. The advice I would give to others looking into using Splunk Enterprise Platform is to understand that it is closer to a marathon than a sprint. If you are new to Splunk Enterprise Platform, it will take a little time to wrap your head around it and understand it. The value is there and your skills will grow over time, and you should contribute time every day or every week to learning and expanding your knowledge in Splunk Enterprise Platform. It is an excellent product. The people in the Splunk world have been awesome. The conference is awesome. Splunk Enterprise Platform is awesome, and the value is awesome. I would rate this review a 9.

I would advise others to use the free training available initially so they can start using Splunk Enterprise Platform on the right foot. This allows running better, cleaner searches with fewer resources and easier platform navigation. Building a team of skilled individuals to handle data onboarding, search writing, and platform management is essential, along with implementing governance around data ingestion to avoid overloading the system. With the use of SmartStore, we have been able to reduce our storage usage, which I believe has also saved us money. I do not have specific numbers on how much that has saved, but by moving to SmartStore, we run fewer fast disks that are ultimately more expensive, pushing data to SmartStore and leveraging its capabilities. I have not worked at anything to the petabyte scale. I have worked at the terabyte level but not at the petabyte level, so I am not fully aware of what kind of problems we might encounter. The scaling work I have done in the past has been quite seamless, scaling very well linearly. I have confidence in the capabilities of other petabyte-level customers, so I believe it could be achieved. We have not actually explored federated search to S3 yet, but we have done federated search between Splunk Enterprise Platform instances in the past, and that worked very well. I hope federated search for S3 will let us ingest less data and store more directly in S3 from the source, saving us on workload and resources required for ingestion and storage on disk, as we can leverage cheaper S3 storage. In my organizational context, the AI workload inputs and functionality is managed in the same role-based access control methods as the existing knowledge objects, API endpoints, and capabilities. I would hope that what the AI agents can access is managed in the same way, ensuring specific roles only access necessary data. Splunk Enterprise Platform's role-based access control model works well for knowledge objects and indexes, and I hope that extends equally to AI. We are able to use single sign-on for login in our private network, which helps. Everything done within the platform is in the audit index, which we regularly monitor and manage to understand what our users are doing. I would rate this product a 9 out of 10.

Regarding Splunk Enterprise Platform's AI capabilities, I think it is important that it has the capability to use local models or in-house built models that conform to the environment that Splunk Enterprise Platform's architecture is in or Splunk Enterprise Platform's stack is in. I cannot say much about its accuracy and reliability of output as I have not used it too often. Overall, my experience with maintaining Splunk Enterprise Platform in an on-premises environment is pretty good, although there are some things that would be better in the cloud, reducing overhead for engineers or administrators, such as compliance. I track daily ingestion rates to see metrics related to my usage. My advice to others looking into using Splunk Enterprise Platform is to go through Splunk training courses, as they offer a lot of hands-on, valuable training to get you set up and ready to run your environment. I give this product an overall rating of 10.

Regarding Splunk Enterprise Platform's AI capabilities, I find its governance and security intriguing; I do not know a great deal about it, but I have been intrigued by what the possibilities could be. I am very confident in the accuracy and reliability of output from Splunk Enterprise Platform. We are not really at the petabyte scale for managing data sovereignty with Splunk Enterprise Platform. Our use of Splunk Enterprise Platform's Federated Search has evolved for querying data in place; we have expanded it for more visibility for more users, not just IT-based users. We do not use the trusted control plane within Splunk Enterprise Platform for maintaining granular control over data, so I cannot comment on its effectiveness. Splunk Enterprise Platform's governance and role-based access controls will be a big part of managing access to our operational data as we consider new use cases such as agentic AI. My advice for others looking into using Splunk Enterprise Platform is to take your time and learn what you are doing.

My advice to others looking into using Splunk Enterprise Platform is to look at your requirements, look at your data, and teach the valuable information to Splunk that your end users can leverage and act upon. Actionable data is the most important piece of information to use Splunk Enterprise Platform at its full capability. I would rate this product an 8.

Regarding Splunk Enterprise Platform's AI capabilities, I think its governance and security need to be figured out; I believe it is not completely matured as of now, so I need to figure out how things pan out. Regarding Splunk Enterprise Platform's AI capabilities, I expect some decent outcomes; I have not tried much on my end, so I will definitely venture into that and check it out to see how it works out. My advice to others looking into using Splunk Enterprise Platform is to dive in and use proper setup and configurations to make sure they are getting true value out of it and not just using Splunk Enterprise Platform, but utilizing it in a wise and useful manner. I would rate this product a nine out of ten.

From what I have seen with the AI capabilities of Splunk Enterprise Platform, its governance is very good. The capabilities are right exactly where we need them to be as just an assistant to assist our user base with things that they might not know or with new users. Accuracy and reliability is mixed. With AI, nothing is perfect yet. Sometimes it takes the wrong context or the information incorrectly, so it takes a bit of working with the AI assistant to get the correct or desired result. Splunk Enterprise Platform's governance and role-based access controls have a very large and significant role because we have to remain PCI and PII compliant. Splunk's governance of that information, especially when it comes to agentic AI, even with read-only permission, can expose a customer's personally identifiable information or their credit card information, and that needs to be tightened down quite a bit for the financial sector. I would advise others looking into using Splunk Enterprise Platform to be patient with it and take their time to develop it correctly. I give this review a rating of nine out of ten.

My advice to others looking into using Splunk Enterprise Platform is that they need to first define what they want to achieve with it, as there could be two different use cases: advanced AI analytics or alerting and taking actions from a perspective standpoint. First define that, determine the need in terms of data, and then use Splunk Enterprise Platform accordingly. I would rate Splunk Enterprise Platform a nine on a scale of one to ten.

Splunk Enterprise Platform does help us with data sovereignty requirements for Sony, but we manage that by structuring the data across different clusters. We find maintaining granular control over data using the trusted control plane within Splunk Enterprise Platform effective as it works very well, though we have to be careful to ensure that administrators do not use wildcard permissions; aside from that, it works very well. At present, we do not see a need to use AI or agentic AI specifically for managing role-based access control. My advice to others looking into using Splunk Enterprise Platform is to definitely purchase Splunk Enterprise Platform and host it in a scalable AWS infrastructure. I am providing this review with an overall rating of nine.

My advice to others looking into using Splunk Enterprise Platform is to attend open, free workshops to determine if Splunk Enterprise Platform is suitable for you and your data. I would encourage continued improvements to Splunk Show for presales purposes. I would rate this product a ten out of ten.

My main use case for Splunk Enterprise Platform is to demonstrate the opportunity to increase profit for companies. This is a demo for our partners who are selling this software to end users, so I am part of the transaction presentation. I love this software. The advice I would give to others looking into using Splunk Enterprise Platform is that you can use this software for several different scenarios through different models by working on the same data. I have given this review a rating of ten.

Regarding Splunk Enterprise Platform's AI capabilities, I think its governance and security seem to be on the right track from what we have seen. As for the accuracy and reliability of output from Splunk Enterprise Platform's AI capabilities, I have been impressed so far, as we are using the MCP server, and I have been impressed with the output. My impression of Splunk Enterprise Platform's capability to manage data sovereignty at a petabyte scale within my environment is that because we are entirely on-premises, I have no concerns about that. My experiences in maintaining granular control over data using the trusted control plane within Splunk Enterprise Platform show that we set up incredibly granular controls over data with very little issue. As my organization considers new use cases such as agentic AI, Splunk Enterprise Platform's governance and role-based access controls play a role in how we manage access to our operational data, as we are currently considering that and looking at how we can integrate. We have not tracked specific metrics to evaluate the success of reducing total cost of ownership with Splunk Enterprise Platform's non-indexing analytics approach so far. My advice for others looking into using Splunk Enterprise Platform is that it is an excellent platform, and to make sure you carefully consider cloud versus on-premises. I rate this product a seven overall.

The advice I would give to others looking into using Splunk Enterprise Platform is to consider the cost. I would rate this product a 7.

I would advise others considering Splunk Enterprise Platform to pay attention to the KV store and MongoDB and understand how they function once you use or upgrade the product. I would rate Splunk Enterprise Platform an eight or nine overall.

My advice to others who are considering using Splunk Enterprise Platform is to focus heavily on best practices from the beginning, using the additional features or add-ons provided by Splunk Enterprise Platform or the Splunk community in general right away and acting as consistently as possible in terms of add-ons, code, detections, or the like, and making as much as possible centrally controllable via either automation tools or similar. In my environment, I assess Splunk Enterprise Platform's ability to manage data sovereignty at the petabyte scale in the on-premises area as Splunk Enterprise Platform certainly having a leading role, as there is otherwise no SIEM provider that can handle data that well at that data size or volume. We don't use the federated search function of Splunk Enterprise Platform yet, but in the future, especially in view of rising costs and competition from other SIEM providers, it will become increasingly important and will be worth considering in the future. I cannot judge the options with Splunk Enterprise Platform's Trusted Control Plane for maintaining granular control over data as I haven't used it yet. My impression of Splunk Enterprise Platform in terms of governance within a private network environment is actually very good due to the control over the platform and the many settings and configuration options. I provided a review rating of 8 for Splunk Enterprise Platform.

I would encourage others looking into using Splunk Enterprise Platform to try it because, depending on what they are looking for, if they can find it, it is something that I will encourage because it is stable and there is always support for it if need be. As our organization considers new use cases with agentic AI, I believe when we get there, we will have a proper plan, but for right now, we do not have anything going. I have rated this review an eight overall.

My advice to others looking into using Splunk Enterprise Platform is to leave your data where it lives. Do not try to centralize it, particularly in a federal government space. That is no longer necessary according to the latest guidance. Find a product that lets you query across different products, vendors, tenants, geographical areas, and other entities, something that is product-agnostic. For the data that we store in Splunk, it does a fine job, but we do not store all our data in Splunk. We have a federated logging and telemetry posture, and I will not go into those other vendors and products that we use, but they all do a fine job of what we need. We do not use Splunk Federated Search. I maintain granular control over data using the trusted control plane within Splunk Enterprise Platform through role-based access and granular capabilities and index permissions on the roles. I find Splunk Enterprise Platform's role-based access and index permissions effective for controlling who can see or interact with specific data, but the interface for roles and the ability to report on the roles is somewhat limited, particularly where we have SAML integration and have to build reports using a combination of SPL and PowerShell queries. As my organization considers new use cases like agentic AI, we are still figuring that out, but the MCP server's added role capabilities are probably going to be adequate, but we are figuring out exactly how it will be implemented. Regarding Splunk Enterprise Platform's AI capabilities, I do not know much about Splunk's AI platforms other than the fact we have used Splunk's MCP server and have built our own agents. We have not actually used any Splunk-branded AI technologies other than the Machine Learning Toolkit a little bit or the AI Toolkit, and that was for development and testing. Regarding Splunk Enterprise Platform's AI capabilities, the accuracy and reliability of output based on my limited experience with the AI Toolkit or Machine Learning Toolkit is that it has limited statistical models and does not actually have many machine learning techniques and models available, and it would be nice to see more there. My overall rating for Splunk Enterprise Platform is seven out of ten.

The primary drivers for evolving my use of Splunk's federated search for querying data in place have been compliance and to some degree security. Trusted control plane does not sound familiar to me regarding maintaining granular control over data using it within Splunk. Role-based access control is going to always have to be there as my organization considers new use cases and agentic AI, and what role the AI agent needs to have is a good question. My advice to others looking into using Splunk Enterprise Platform is that it depends on your use case. If you are similar to our organization, then the clustering is probably the way to go. I would rate this product an eight out of ten.

The advice I would give to others looking into using Splunk Enterprise Platform is to attend Splunk University and learn how to use it.

Regarding staffing, the headcount for the number of staff that we would need typically to respond to an incident or event has been significantly reduced. An incident or event that used to take ten people to triage, respond to, and remediate accordingly has been reduced to where that job is now handled by four people. There has only been one use case for federated search within my environment, which provides search capability to another organization into my environment. It is good because it allows us to limit what data is available to that customer and limit it to a specific index. We can limit the kind of access and the kind of role that is assigned to the federated search users as they access our environment. It is very good because it helps us avoid crashing our entire environment if a rogue search or a search that is not well-structured is executed by that customer. It has worked for us to limit the search quota for that customer so they do not crash our entire environment and our broader environment is not impacted. Splunk's use of RBAC, role-based access control, has worked very well for us as we can limit certain roles to specific search quotas. We can limit index access to certain roles and app access to certain roles. This has actually worked very well and is well-implemented within Splunk. Splunk's approach is very good and is on a great track on a private network because for customers like us with on-premises instances, it lets us keep all our data within our network and do whatever we do within our environment without worrying about that data getting out to the public or outside of our environment. Since the implementation of Splunk, we have significantly reduced our TCO in maintaining data and collecting logs. In partnership with AWS and in some implementations with S3, that has really brought down TCO because we do not need to maintain so many hardware and data centers to be able to meet the same need. For others looking to use Splunk Enterprise Platform, my advice would be to get familiarized with the product. Even if you are just a customer and not supporting, implementing, or maintaining the environment yourself, it is really good to get educated on the software and its use cases. I would advise organizations to send their employees to get at least some Splunk training and use whatever credits they have to make sure their workforce stays updated on the new changes within Splunk. I would rate this product a nine out of ten.

My advice for others looking into using Splunk Enterprise Platform is to definitely find some good use cases for it. Even if you don't implement it immediately, install Splunk Enterprise Platform for the specific use case you are trying to satisfy, but also consider ways you could expand its use, as there are many more ways Splunk Enterprise Platform can assist than the initial reason for your installation. Therefore, keep an open mind on other ways to let Splunk Enterprise Platform grow within your system and take on more responsibilities. We do not use Federated Search where we are. I have not used that feature. I have not explored that yet; however, it is something I would definitely like to investigate more. That is beyond the scope of my knowledge, and I am uncertain about it. I provided this review with a rating of 9 out of 10.

My advice to others looking into using Splunk Enterprise Platform is to do it.

My advice to others looking into using Splunk Enterprise Platform is to not use it. I do have additional thoughts about Splunk Enterprise Platform. My overall review rating for Splunk Enterprise Platform is six out of ten.

Splunk Enterprise Platform's AI capabilities sound very good; I do not fully trust them yet as I would want to see them in a dev environment in my data center first, with just non-production systems, so I would need to see them to really trust them. I have not tested Splunk Enterprise Platform's AI capabilities, so I cannot speak much about its accuracy and reliability of output, but from what I have seen in the keynotes and presentations, it appears very promising. I do not have a clear answer regarding Splunk Enterprise Platform's capability to manage data sovereignty at a petabyte scale within my environment. I do not believe we utilize Splunk's Federated Search. I am not experienced in maintaining granular control over data using the Trusted Control Plane within Splunk. As my organization considers new use cases such as agentic AI, I believe Splunk Enterprise Platform's governance and role-based access controls would play a key role by controlling and applying security to our agents. My advice to others looking into using Splunk Enterprise Platform is to work with a partner to help deploy it and deploy it the right way the first time. I gave this review an overall rating of 10.

The advice I would give to others looking into using Splunk Enterprise Platform is to make sure you do your research because utilizing Splunk Enterprise Platform is one thing, but utilizing Splunk Enterprise Platform properly will give you an entirely different data set that is going to be more beneficial to your company. Using Splunk Enterprise Platform just to meet compliance is not taking advantage of all the different features that it has available. I would strongly suggest that anybody who is looking into Splunk Enterprise Platform research all the capabilities that it has to make sure that the capabilities that would be most beneficial for your company are actually deployed so you are not missing important data that could stop a bad actor from getting into your network or reduce productivity from internally. I would rate this product eight out of ten.

I rate Splunk Enterprise Platform a seven on a scale of one to ten. I give it a seven because cost is definitely the number one thing that keeps it from being higher; I would say mostly cost. Regarding Splunk Enterprise Platform's AI capabilities, I have not really used Splunk Enterprise Platform's AI. I imagine Splunk Enterprise Platform would probably manage data sovereignty at a petabyte scale fine. Our scale is much smaller than that, but I think it would scale up effectively if needed. I do not think I have used the trusted control plane within Splunk Enterprise Platform to maintain granular control over data. As my organization considers new use cases such as agentic AI, we will definitely have to restrict access control over everything AI-related across the network, so Splunk Enterprise Platform would be just another application in that regard. I feel that Splunk Enterprise Platform gives me the right tools and flexibility to manage things such as compliance, user permissions, and data privacy when it is running on my private network. I think it does a good job; it just requires us as administrators to determine exactly what it is going to be, but the controls are fine—they are good. We do not use Splunk Enterprise Platform with non-indexed data for evaluating the success of reducing TCO with its non-indexing analytics approach. The advice I would give to others looking into using Splunk Enterprise Platform is that it is a good product if you have a need for it. I would just say to consider using other third-party vendors in tandem with it, as there are other things that can work well with it and integrate with it. I rate Splunk Enterprise Platform a seven overall.

I have experienced lagging sometimes with Splunk Enterprise Platform, but this is not the fault of Splunk; it is the fault of deployment and some other team members. I am not familiar with the feature called Trusted Control Plane. I don't have any information about Federated Search. My company deals with the pricing, so I have no idea about it. Overall, I would give Splunk Enterprise Platform a score of eight point five out of ten. I would rate this product nine out of ten overall.

We use Agentic AI for other things, but we do not use it for granular access control. I have built entire Agentic AI workloads and I have extensive experience using Agentic AI. It has been a multi-year journey and challenge. If I am running it on-prem, governance management is great. I would rate this solution an 8 overall.

My advice for others looking into using Splunk Enterprise Platform is to start with clear use cases, onboard the right data, train your team on Splunk Enterprise Platform, optimize the searches and dashboards, and keep an eye on data ingestion to control licensing costs. Proper planning will help you get the most value from the platform. I would rate this product nine out of ten.

With respect to the use cases, we were able to create many use cases as well as fine-tune them, so thirty percent of the alerts were fine-tuned, and we have improved our detection logic and also the outcomes. In specific to the metrics, our detection rate was high. The mean time to detect was incredibly lower than when compared to the previous SIEM. With respect to Splunk Enterprise Platform, we can have a bunch of use cases though we already have a database where we get a list of use cases. Given the trend, we can improve them. Just with threat intelligence, if Splunk Enterprise Platform gets a new feature such as IOCs integration directly, that would be very helpful, just as the Falcon threat intelligence. It would be helpful if we get Splunk threat intelligence as well. As of integrations, we are good. Splunk Enterprise Platform can be integrated with multiple SOAR solutions, so I would prefer to focus on the threat intelligence side. Accuracy regarding Splunk Enterprise Platform's AI capabilities should be termed as a normal figure between sixty to seventy-five percent because sometimes it is not just AI capabilities; human intelligence is needed as well. So I would keep it around that range. With respect to cybersecurity, you have the best solution available. I rate this review a nine overall.

I have a team reporting to me, as I work for a company, serving a bunch of Splunk customers and other SIEM customers. In my organization, there are around four to five specialists who work with Splunk. My clients are enterprise and medium to large businesses. Splunk Enterprise Platform requires regular maintenance, and I find it easy to maintain. My impression of Splunk's approach to managing governance within private network environments is that it is straightforward. I suggest conducting a POC first and having one real customer who uses Splunk, because it will not work if you are just installing it locally. I would rate this solution a nine overall.

The whole bank uses the same tool to monitor their logs and analyze production data or any environment data. That is why I have not had any chance to use an alternative. I am not familiar with the pricing because being a junior developer. Splunk Enterprise Platform offers Federated Search, which I have not used. My overall review rating for Splunk Enterprise Platform is 9 out of 10.

My advice for others looking into using Splunk Enterprise Platform is that it is a great solution, but it is a little expensive. I would rate this review a seven out of ten.

Splunk Enterprise Platform does not require any maintenance on our end since it is a cloud-based system, so I do not think we require any maintenance for that. My impression of Splunk Enterprise Platform's capability to manage data sovereignty at a petabyte scale within my environment is that our data is collected at a centralized location for all our metrics and logs. Having it in one place helps us for better visualization and data sovereignty because our data is in one location, which reassures me that our data is not being leaked or used by other AI tools or any other third-party applications. My impression of Splunk Enterprise Platform's approach to managing governance within a private network environment is that governance is managed by the security team. From my experience, the governance and compliance for the data of our organization with Splunk Enterprise Platform follows mainly SOC 2. I am not fully aware of all the details, but I know that it aligns with best practices in the market, which is why our security team has approved it. I would rate Splunk Enterprise Platform overall 8.5 out of 10.

I would give this solution an overall rating of 9 out of 10.

We have an add-on of the Universal Forwarder that helps us check whether our forwarder server is down or not. We have our custom add-ons that are definitely helping us and easing our work. We use alerts about licensing every day. We have set an alert that triggers if our daily license exceeds 500 GB. We came to know that our licensing limit has been reached, so we had to remove unnecessary data. That's how we use that feature. We have just integrated Splunk Enterprise Platform with Amazon Web Services. It integrates well without any issue. It helps with suggestions about regression and has pre-built functions and algorithms to build with. I would rate my overall experience with this solution nine out of ten.

This is my first time, so I do not know much about this platform. We have our custom application, and we can directly use that to enhance end-user experience. My piece of advice will be if you are looking for a SIEM tool to monitor and have personalized dashboards, then Splunk Enterprise Platform is definitely for you. If your team has the budget and your company has budget, then you should definitely move to Splunk Enterprise Platform. I would rate this product a nine out of ten overall.

I would rate this review an eight overall.

I would recommend Splunk Enterprise Platform for bigger companies. In the future, I expect additional features such as threat intelligence, behavior analytics, log searching, and machine learning capabilities. As for any other functionalities I would like to see from them in the future, I do not have anything to add right now. I have something in my mind, and in case I remember, I will go ahead and add it. Splunk Enterprise Platform is very popular in my region. My overall review rating for this product is seven out of ten.

I am working with Splunk Enterprise Platform and Dynatrace, and my feedback was really valuable for us. I am using Splunk Enterprise Platform, and I am combining it with a Cloud platform, AppDynamics, and SOAR. I worked with Splunk Machine Learning Toolkit, but that is a different thing. I have not worked so much on the MLTK side, so I cannot say anything, I cannot give more of an idea or feedback on that. The ability to manage applications through Splunk Enterprise Platform is something I need to check. I am talking about Splunk Enterprise Platform, and there is a lot it provides to the end user. The first thing for Splunk Enterprise Platform is that I can organize my data, like the Common Information Model, CIM, where there are different departments in my company and different application owners. Accordingly, they can set their data, which they do not want, they can just skip that. Whenever they need, they just use the simple one, and that data will be present. In one umbrella, they can see different locations and different data. In any organization, I have to organize my data. If I do not organize my data, then it would be very difficult to find it. Directly, if I just check my application, I can enter my application, like in Linux. I just enter index equal to Linux, and it gives me all the details. Even in the dashboard, I select Linux, and it shows all the data, including vulnerabilities, CPU usage, and memory usage. This is a really good point. Because people are not working on their tool. If I tell any technical problem in Splunk Enterprise Platform to the CIO, I do not think he will understand. He has not worked on it; he does not know what I am talking about. But if you present to him that our UI is very helpful to everyone in your organization, no matter if they are on the leadership team, application team, development team, testing team, or application support team, they can all use our tool easily without any hesitation. Even if they need help, Splunk Enterprise Platform has introduced AI, which helps answer any questions regarding SPL. I purchased Splunk Enterprise Platform directly from the vendor. I rate the price for Splunk Enterprise Platform as a five because it is very high. If the price were lower, there would be no tools in the market capable of competing with Splunk Enterprise Platform. The only reason people think about moving from Splunk Enterprise Platform to another tool is the price. I would rate this Splunk Enterprise Platform solution with an overall rating of eight.

We have many use cases for using Splunk Enterprise Platform. We use Splunk to detect anomalies in our customers' IT environments, such as their network environments. We want to detect suspicious activity or anomalous activity from our customer environments. From Splunk, we utilize many applications from Splunkbase to support our deployment. Many of our services relate to the Security Operation Center, so many of our use cases are linked to SOC activities. Since the query capability in Splunk is extremely flexible, creating dashboards is also very easy. Dashboard creation depends on the SPL queries, and in the latest version of Splunk, we have two options: classic dashboards and Studio dashboards. Both options can be tailored to our needs, enabling us to create highly customized dashboards, for instance, by adding images. This flexibility makes crafting custom dashboards simple. I find deploying Splunk to be very straightforward because you can choose to install it on either Linux or Microsoft operating systems. Before deployment, we conduct sizing for the instance, including storage, CPU, memory, and network considerations. Once sizing is clear, we proceed with the installation, which offers multiple options such as Debian packages or RPMs. Overall, the deployment process is quite easy. Currently, many of our customers prefer cloud deployment for Splunk Enterprise Platform. We do not recommend specific cloud services, but we often see GCP, Google, and Microsoft Azure being used among our customers. I consider Splunk to be one of the best solutions available compared to other options. If budget is not a concern, Splunk stands out due to its extensive integrations, flexibility in scalability, and the simplicity of its deployment. I would rate this review an overall 8.

I have expertise in Splunk Enterprise Platform tools, including Splunk Cloud, having experience working with other tools such as IBM Security QRadar. We are a managed service provider (MSP), and we provide services using Splunk Enterprise Platform. Splunk Enterprise Platform holds the number one position in Gartner, and integrating different types of tools and creating use cases is much more streamlined compared to other tools such as IBM QRadar and AD audit, managing the log 360. The platform has a powerful search engine, allowing the integration of custom AI such as ChatGPT. It also has Phantom as a SOAR, which is more refined and gives more accurate results than any other AI integrated SIM tool. In anomaly detection, I can live track anomalies and change the registry. While working with Wazuh, when I integrated the Cortex XDR, there was a mismatch of events sometimes, making it tedious, but in Splunk Enterprise Platform, I just need to log into the console and everything is there, making it an all-in-one solution. I rate Splunk Enterprise Platform 9 out of 10.

My advice for those looking to implement Splunk Enterprise Platform is to know the product well and have hands-on workshops or create a lab to gain complete knowledge before proceeding. Regarding maintenance, it does not require much as it is on-premises. Overall, I would rate Splunk Enterprise Platform an eight.

My overall experience with Splunk Enterprise Platform rates around seven out of ten points. The main issues are regarding updating reviews and scalability, which may take some time when connecting via VPN. I would rate the overall solution 7 out of 10.

Overall, I rate Splunk Enterprise Platform ten out of ten. I am dissatisfied with Splunk’s graphics view and deep learning capabilities; they could be better, especially on Splunk Cloud. While I was able to enhance the platform using technologies like JavaScript, most of my clients struggle.However, it will be sufficient for the next few years with it's strong Machine Learning capability. Also, it would be preferable for Splunk SOAR to include sequential Splunk task execution and MCP/A2A support features.

For smaller companies, I recommend Stellar Cyber as an alternative to Splunk Enterprise Platform. Stellar Cyber is easier to implement and integrate, and it has solid AI capabilities, especially for automation. It is also willing to adapt to customer requirements. I would rate Splunk Enterprise Platform overall somewhere between six and eight, depending on the size of the company.

I highly recommend Splunk Enterprise Platform for organizations with large volumes of logs and multiple servers, as it provides good ROI for big companies. However, due to its cost, it may not be suitable for small organizations.

To first-time users, I can say that proper analysis and bandwidth utilization, cloud resource monitoring, and cost optimization are the things I would ask one to check in the tool. It is not easy for beginners to use, and for freshers, it will take time to understand the tool. From a security perspective, I rate the tool a nine out of ten. From a user and the console perspective, I rate the tool a seven out of ten. In general, I rate the tool an eight out of ten.

Before using the Splunk Enterprise Platform, basic knowledge of log analytics tools like Logstash is beneficial. While it does not require specific prerequisites, having some background knowledge will help. Remember that Splunk is a paid service, unlike other log analytics tools like ELK Stack, which may offer free versions. I rate the overall solution a nine out of ten.

Currently, we are on-prem. However, we have started cloud migration in the last few months. I rate the overall solution a ten out of ten. In daily life, every IT company should use it to monitor its logs. It is an emerging tool.

Splunk Enterprise Platform allows customized data processing, making it highly versatile and easy to maintain. It seamlessly handles tasks like data masking and filtering, ensuring efficient data management. When it comes to the visualization on the dashboard within the Splunk Enterprise Platform, we do have the chart available, and all its features are included. Additionally, if you require customization for a new customer's preferences, we can implement it using HTML or XML code. The primary approach for developing dashboards is based on XML. Therefore, if you need specific features like radio buttons or checkboxes, they are readily available for inclusion in the dashboards. I recommend the solution. Overall, I rate the solution a nine out of ten.

Our experience with the Splunk Enterprise Platform has been positive regarding administration and development. However, there are some concerns regarding visualization. Despite our team's proficiency in activating and completing tasks, the dashboard's complexity has decreased user satisfaction. Many users find the visualization lacking when viewing multiple panels simultaneously. They express difficulty in navigating the UI and feel uncomfortable with it. Addressing these concerns would enhance the overall user experience from end to end. Overall, I rate the solution a nine out of ten.

Splunk Enterprise Platform does not have a few application add-ons. Therefore, when we aim to integrate log sources from new or important ones that Splunk lacks add-ons for, we resort to developing custom add-ons. While this approach allows us to proceed with our work, it requires significant human effort and increases the likelihood of errors. Moreover, troubleshooting becomes time-consuming under these circumstances. Ideally, Splunk would offer add-ons for every possible application, significantly improving our efficiency and effectiveness. The Splunk Enterprise Platform offers excellent visibility through real-time monitoring. Whenever any data matches our client's SQL code, it triggers an immediate alert, allowing us to respond to incidents swiftly. This capability is highly beneficial during any incident, making Splunk an invaluable tool. There are various components, such as Universal Forwarder, Indexer, and Search Head. These components are relatively straightforward to set up. However, when implementing a distributed environment or setting up clustering, Splunk offers robust capabilities. Additionally, managing data storage sizing is also seamless. Overall, I rate the solution an eight out of ten.

The solution has helped us with our security information and event management. If someone performs deletion operations, we get an automated alert informing us that a privileged activity has been performed. We forward the logs in real-time. We are ingesting 10GB of data into the solution daily. We have some input filters in the solution's dashboard. Overall, I rate the solution an eight out of ten.

I use the Platform to monitor my IT infrastructure. There are apps for Linux and Windows servers that capture performance metrics like CPU and memory usage. These metrics are collected and sent to the blank index through forwarders. Splunk helps with security information and event management by detecting and monitoring network equipment and firewalls. It saves searches for specific terms, like threats, in firewall logs. When a match is found, it alerts about potential security breaches, helping to detect and address them. The real-time processing capability in Splunk enhances data monitoring by centrally collecting all data. This allows for easy searching and scheduling of searches, reducing the need for manual intervention. The dashboard and visualization features in Splunk impact data analysis by providing a clear status of data analysis. Users can create customized views for management, helping them understand what is happening within the infrastructure more effectively. I would recommend Splunk to others, especially from the CIM perspective. Its data analysis and visualization capabilities are unmatched, making it an excellent choice for SIM. Overall, I would rate Splunk Enterprise Platform as a nine out of ten.

I rate the overall product a seven out of ten. I would recommend it for incident management reporting. I would not advise it for understanding user behavior or usage. If I had to choose between Splunk Enterprise Platform and Amplitude, I would probably go with Amplitude, but I also have no familiarity with what their incident reporting is like.

There are some problems in managing the tool when it exceeds certain limits. Overall, I rate the product a nine out of ten.

I can recommend the product after considering the needs and budget of the customers, as well as the company's size. I rate the overall tool an eight out of ten.

Splunk Enterprise Platform is a good and easy-to-use solution. It has to be regularly upgraded to the changing network or customer needs. Overall, I rate Splunk Enterprise Platform an eight out of ten.

I would recommend the product to those who plan to use it, provided the pricing of the solution is brought down. I rate the overall product an eight out of ten.

We have annual automation for our automated building and availability building. The maintenance is easy. We will do a vulnerability scan. Then, we need to ask someone from the Splunk team to confirm that upgrading to this version of Windows or applying monthly or weekly patches will not impact the Splunk application. It's not easy or feasible to reach out to Splunk directly. Splunk is an enterprise software platform that monitors storage, CPU, RAM, Windows logs, and Cisco network logs on large machine setups. I suggest Splunk to anyone with these needs. Overall, I rate the solution an eight out of ten.

I would suggest using Splunk Cloud first, and then Splunk Enterprise because the maintenance and the infrastructure management are easy. I would rate it an eight out of ten.