Splunk Software and Solutions

Splunk Enterprise Security is mainly used for enterprise defense like cybersecurity threat detection. We have SOAR and SIEM, Security Information and Event Management systems. We feed the data to them, SOAR.

Enterprise security tools, that's what SIEM is. It has multiple products too, including Anvilogic, which they integrate.

Definitely, it helps us to evaluate the threats, especially the risk. However, my scope is very limited to Splunk administration. I think we do use Splunk as primary. We still use the security modules, including the integration of the security modules or the multiple feeds, not only Splunk. We have Elasticsearch and other things, but Splunk is one of the major feeds for them.

I am using Splunk Enterprise version.

I have been using Splunk Enterprise Security solutions for almost the last five years.

The integration and plugin availability are nice. The AI module is also great.

The most challenge was identifying the problems within the infra. I think it's quite short when we compare to others. The reporting on Splunk is much faster than other solutions.

Overall, the product is good, but when it comes to some infrastructure issues, we have to dig into more logs. There is no straightforward indication of an issue. Health check kind of dashboards are not available.

More AI would help us, and more optimization, since security products run more queries. The AI module could suggest solutions, optimizing queries or workload balancing. If the product itself advises on running queries during peak times, it would be similar to what ChatGPT currently offers.

We see quite a few issues on stability. Even last week, we faced something, and identifying bottlenecks is not easy. We need more SMEs, and there is no mechanism to tell us about indexer or search head issues. Self-monitoring dashboards could be beneficial.

The technical support still requires more improvement. Often, primary support takes a lot of time and forwards most solutions to the engineering side. The primary support team has very limited knowledge to provide.

I have been using Splunk Enterprise Security solutions for almost the last five years.

We see quite a few issues on stability. Even last week, we faced something, and identifying bottlenecks is not easy. We need more SMEs, and there is no mechanism to tell us about indexer or search head issues.

Scaling, we have a lot of scale, which is why it took a long time.

Definitely, scalability-wise, it has quite a good feature, but still, I see there are a lot of improvements needed.

The technical support still requires more improvement. Often, primary support takes a lot of time and forwards most solutions to the engineering side. The primary support team has very limited knowledge to provide.

Positive

It was straightforward for our environment, but we had multiple things, including the Splunk universal forwarder and different data sources. This made it a little complicated. However, infrastructure-wise, deployment was easy.

We use it very vastly. We have around 1,200 servers in infrastructure, and it was a very big setup. The planning and execution took a long time. It was phase by phase. But product-wise, it is easy to install, with no complications.

I am part of it.

From overall, around 10 people. They are administrators. We have a segregation of duties, including engineers who do the testing, and once it's tested, we can package it and do the installation.

It is a little expensive, but the enterprise license is okay to have when compared with other solutions. Some products including Tripwire charge based on feeding rates. Enterprise license-wise, we see a benefit compared with other products.

The team I work on is a workflow team for the bank. We get a lot of traffic because of onboarding and workflow processes, which results in around a million hits per day. Whenever we have a release scheduled, Splunk Enterprise Platform is a very useful tool for me to monitor the logs.

Splunk offers an advantage where I can log and monitor all of the microservices in a single location. Search Processing Language (SPL), which is the query language for the product. SPL does take time to master as it is somewhat complex. When searches are straightforward, then it is quick, but if you need to perform complex searches with multiple pipes, sub-searches, or statistical functions, then it becomes somewhat confusing. You need time to become familiar with it.

I created some Splunk Enterprise Platform dashboards, which is the main focus of my work. I used a drag-and-drop builder, and it has real-time updates, visualization varieties, drilldowns, and token inputs. I built a dashboard for the application which answered these questions: which workflow combination has the highest hits and which users are triggering them. I wrote a query using SPL which aggregated the results from the API in the given timeframe that we can choose, and accordingly it will show a pie chart. Using the drilldowns and tokens, I built another panel where if you click a particular combination, it will list the number of users hitting that combination and how many times. This is something very useful I found in Splunk Enterprise Platform dashboards.

Regarding the downsides of Splunk Enterprise Platform, as I mentioned, one is the Search Processing Language is somewhat complex when it comes to complex filtering and searching. You need to become familiar with it to make complex searches. That is one thing.

There is not a no-code option for panels. You have to write an entire query for it. It would be better if they could introduce more drag-and-drop options so that people can add more features to their panels and pie charts and visualize the data they want.

I have been using Splunk Enterprise Platform for 1.5 years.

Considering the stability of Splunk Enterprise Platform, it is pretty stable. It sometimes takes time when I switch the timeframe, such as from 15 minutes to one hour. It takes some time in loading all of the logs from the application. Otherwise, it is very stable. It is a latency issue.

As I mentioned, the current application I was working on already has a lot of users. So it is a pretty scalable solution. We get millions of hits for the APIs.

When I joined the company, Splunk Enterprise Platform was already in place from the very start. Many of my friends work in several different companies, many uses DataDog, but here, I have only used Splunk Enterprise Platform.

I am not involved in those kinds of decisions yet. I do not know about the pricing.

The whole bank uses the same tool to monitor their logs and analyze production data or any environment data. That is why I have not had any chance to use an alternative.

I am not familiar with the pricing because being a junior developer.

Splunk Enterprise Platform offers Federated Search, which I have not used.

My overall review rating for Splunk Enterprise Platform is 9 out of 10.