We changed our name from IT Central Station: Here's why
Senior security consultant at a comms service provider with 51-200 employees
Consultant
Threat hunting is a key feature for us
Pros and Cons
  • "One of the most valuable features is threat hunting. We can do threat hunting and identify if there is any malicious activity happening within our environment, which is a key feature for us."
  • "Splunk could be improved by reducing the cost. The cost is one of the biggest challenges for us in keeping to our production requirements."

What is our primary use case?

Our initial use case was for security investigation, with the intention of creating some use cases. We ended up adding operational aspects, monitoring certain operational activities, such as high CPU utilization or any other applicational basis. 

This is obviously a cloud solution, but it does have some presence on-premises as well, so it's hybrid. 

What is most valuable?

One of the most valuable features is threat hunting. We can do threat hunting and identify if there is any malicious activity happening within our environment, which is a key feature for us. 

What needs improvement?

Splunk could be improved by reducing the cost. The cost is one of the biggest challenges for us in keeping to our production requirements. 

As for additional features, I think they need to refine their AI capability. I know that everyone is talking about artificial intelligence and threat hunting, so I guess one of the key requirements for us is for the solution to automatically provide us some kind of indication and then mitigate any risk. So automation should be a feature. 

For how long have I used the solution?

I have been using Splunk for two years. 

What do I think about the stability of the solution?

This solution is excellent from a performance and stability perspective. There's very minimal maintenance required. Basically the only aspect we need to maintain is the one we have on-prem. So patching up everything and making sure it has the required updates. 

What do I think about the scalability of the solution?

There are no issues at all in terms of scalability, since this is a cloud-based solution. There are around 25 to 30 users in my company accessing Splunk. 

How are customer service and support?

Splunk's support is good. The process was smooth and they provided sufficient support, so there was no need to escalate anything. Also, they provide training on a regular basis, which is good. 

Which solution did I use previously and why did I switch?

I have never worked with other similar products. I've worked for three companies, all of which use Splunk. 

How was the initial setup?

The initial setup was very smooth. I think we got some support from the Splunk team. Since it's a cloud-based solution, it took us probably three or four weeks to actually start working. But deploying agents, configuration, refining, fine tuning, and other ongoing activities went on for about a month. 

What about the implementation team?

We implemented through an in-house team with some support from the Splunk team. It was a very smooth process, from our perspective. 

What's my experience with pricing, setup cost, and licensing?

This solution is costly. Splunk is obviously a great product, but you should only choose this product if you need all the features provided. Otherwise, if you don't need all the features to meet your requirements, there are probably other products that will be more cost-effective. It's cost versus the functionality requirement. 

Which other solutions did I evaluate?

I also evaluated IBM QRadar and LogRhythm NextGen SIEM

What other advice do I have?

I work in security architectures, not operations, so I don't actually work with Splunk on a regular basis, but the team that does is working on threat hunting and incident management. 

I rate Splunk an eight out of ten. 

Which deployment model are you using for this solution?

Hybrid Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Other
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Flag as inappropriate
Senior Informatica Administrator at a computer software company with 10,001+ employees
Real User
Top 20
The logging features are useful as are the dashboards and alerts
Pros and Cons
  • "Splunk is a user-friendly solution."
  • "In terms of the interface, it could include some improvements for the look and feel."

What is our primary use case?

We use Splunk on-premise. We mostly use it for log analysis and fraud detection. We are also testing using it in machine learning and other solutions. We have 10 people managing Splunk and we have approximately 150 people using the product in total.

How has it helped my organization?

With Splunk, we got more insights out of our data as it includes machine and secure data. It also has a logging attendance system and this helps to protect our resources from any  attackers hacking system information at a granular level

What is most valuable?

The logging features are useful as are the dashboards and alerts in addition to the organization of data. It has options for creating dashboards and alerts. You can also create queries in the SQL language. Splunk is a user-friendly solution.

What needs improvement?

Index performance is a bit slow but this is partly due to the huge volumes of data for our industry within our environment This makes the index very large and inefficient in terms of performance. Performance could be improved to cater to this, however. We have also had problems with the compatibility between Splunk and other systems. We have previously been on 5.3 and migrated to 5.5. We are now planning to migrate to version 7.7. It has been difficult to find documentation about the compatibility with Linux. In terms of the interface, it could include some improvements for the look and feel.

For how long have I used the solution?

We have been using Splunk for one year in our infrastructure environment.

What do I think about the stability of the solution?

The users access the native cloud solution. So we are taking advantage of the native cloud solution provided, and by using the gentle scaling approach this has helped stability.

What do I think about the scalability of the solution?

We scaled up gradually from three processes up to five, and the performance is okay. So we used gentle scaling  but this also helped stability.

How are customer service and technical support?

We have used Splunk tech support often. If we have a critical issue such as server down or frequently occurring issues they are always reliable and provide us with solutions to our problems. Technical support for Splunk is good.

How was the initial setup?

Setup is complex. We tried to cluster five indexes. This helped us migrate our data into the Splunk environment. We are using 20 applications which make use of this indexed data. The actual deployment took us about two to three weeks because of some problems getting the data into the system.

What about the implementation team?

We worked with a Splunk consultant who shadowed us to help ensure we performed the process correctly. 

What's my experience with pricing, setup cost, and licensing?

Licencing occurs yearly. We now have a three-yearly support contract as of now.  Licensing is a yearly, one-time cost.

Which other solutions did I evaluate?

We considered a few alternative products because the logging was faster. In the end, we decided to go to Splunk.

What other advice do I have?

I would definitely recommend Splunk. We will review performance within two years of our three-year contract and then decide at that point what other aspects we need to consider. I would rate Splunk 8 out of 10.

Which deployment model are you using for this solution?

On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Learn what your peers think about Splunk. Get advice and tips from experienced pros sharing their opinions. Updated: January 2022.
564,599 professionals have used our research since 2012.
Praful Bhatnagar
Principal Systems Engineer at a computer software company with 10,001+ employees
Real User
Top 5
A complete solution that satisfies the needs of our clients, but it is complex to set up and use
Pros and Cons
  • "It's the completeness of the solution that we like the most."
  • "Our two main complaints are about the difficulty of the initial setup and the licensing model."

What is our primary use case?

We are a software development company and Splunk is one of the products that we have implemented for our clients. It is used for log analytics as well as the mobile SDK for checking the stability of mobile applications.

What is most valuable?

It's the completeness of the solution that we like the most. It has a solution for backend log analytics, but also one for mobile applications.

What needs improvement?

Our two main complaints are about the difficulty of the initial setup and the licensing model.

The billing model is a little bit complicated because you have to predict in advance how much data you'll have and how much storage you'll need. When you start, you don't really have those numbers but to get the licensing, you need them. It is only at that point that you'll know how much the product is going to cost you.

For how long have I used the solution?

I have been working with Splunk for more than five years.

What do I think about the stability of the solution?

There have been no issues in particular. What we are using has not been that heavy.

What do I think about the scalability of the solution?

We have not had any problems with respect to scalability.

How are customer service and technical support?

Based on when we have been in contact with them, I think that technical support was fine.

I'm not sure if they have different support models but I think it took a long time for them to respond. It may be a consequence of the support contract our client had with them.

How was the initial setup?

This is a complicated product to use and you need constant help to set it up. I really wish that it was easier to set up and use.

What about the implementation team?

We do not have any dedicated people who are working on Splunk, but we have a team of approximately 100 people that are responsible for the development of mobile applications, backend systems, DevOps, etc.

What's my experience with pricing, setup cost, and licensing?

I think that most of the log analytics solutions are expensive and I'm not sure if it's worth it. However, I wish that they were less expensive. I am not talking about a single product but rather, all of the ones that are in the domain of log analytics.

What other advice do I have?

Splunk is a good product but I would definitely tell people to analyze their requirements to see if Splunk fits their use case, or not. The licensing model is very complicated, so if there is a product that has a better licensing model then it would probably be good to start with that. Then, later on, if the product is not working well enough, then they can switch to Splunk. At that point, they will have knowledge of the data they are using and will understand the costs that they might incur while using it. 

The only way that I would suggest somebody use this as their first solution is if they already had all of the data that is required to get a cost estimate.

I would rate this solution a seven out of ten.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
Ali Tamimi
Managing Director at Hayyan Horizons
Real User
Top 20
Low-maintenance and stable with very useful dashboards
Pros and Cons
  • "The log aggregation is great."
  • "Technical support needs to be more responsive."

What is our primary use case?

We primarily use the solution for security and operations monitoring.

How has it helped my organization?

Gives full visibility on operational and security posture in our organization. Integrations is straightforward and effective.

What is most valuable?

The log aggregation is great.

The solution offers good data analytics.

The dashboards are very helpful.

The initial setup is simple and straightforward. 

The solution is low-maintenance.

It's a stable product.

We have found that the solution scales well. 

What needs improvement?

The TERM licensing model is still not very useful. It's not helping us. They used to have a perpetual licensing model. Now Splunk is offering annual term/subscription only. That's costly and it's more expensive and it's putting some burden on us.

Technical support needs to be more responsive. 

We would like to see more AI. Through AI, artificial intelligence, not machine learning only. We want to see more AI-enabled kinds of functionalities just to reduce dependencies on manual interventions. We do that, however, automation and artificial intelligence-based kind of automation we would really like to see.

For how long have I used the solution?

I've been using the solution for six years. I've used it for a while at this point. 

What do I think about the stability of the solution?

It's not high maintenance. There are software or upgrade releases every now and then, however, in general, the product is very stable. There are no bugs or glitches. It doesn't crash or freeze. 

What do I think about the scalability of the solution?

We have 17 people that are using the solution currently. 

It's very easy to scale the product if you need to.

How are customer service and technical support?

We use technical support every now and then. The response times are not very good. This is the thing that I would need to see improvement on and probably in that area only. They are that good when they started handling cases, however, they take too much time to respond to customer requests.

Which solution did I use previously and why did I switch?

We did not use anything else on the production scale. Our first experience was with Splunk.

How was the initial setup?

The solution is straightforward and simple to set up. It's not complex at all.

What about the implementation team?

We handled the process internally. We did not need the assistance of any integrators or consultants. 

What's my experience with pricing, setup cost, and licensing?

Filter the noise out.

Which other solutions did I evaluate?

Yes all the other competitors, Splunk by far is the best.

What other advice do I have?

We're a partner and a customer. 

I'm using the latest version of the solution. 

I would highly recommend the solution. It's the best product out there. It's definitely easy to set up. The use cases are multiple. It's not restrictive in terms of the efficiency of the platform. Just make sure that you have enough resources or good counsel from people who can help with the use cases. If you do the sky would be the limit. It is a good solution.

I'd rate the solution at a ten out of ten.

Which deployment model are you using for this solution?

On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Flag as inappropriate
Assistant Vice President at a financial services firm with 10,001+ employees
Real User
Top 20
Easy to use with a simple setup and great integration capabilities
Pros and Cons
  • "The initial setup is pretty straightforward."
  • "On-premises scaling of the solution is a bit more limited than it is on the cloud."

What is our primary use case?

We primarily use the solution for monitoring our infrastructure.

What is most valuable?

The models that we use are pretty mature at this point, which means we can be assured we are given the best use cases right out of the box.

We can just plug into the applications and everything is set up. There's very little configuration necessary.

The integrations that are offered with different tools are all very good. They offer integrations for all levels of security and have offerings from some of the other major solutions in the space.

The initial setup is pretty straightforward.

What needs improvement?

Over the years, I know they've been doing what they can to continue to add integration capabilities to their solution. If they continue to do that, that would be ideal. However, beyond that, there really aren't any features that I find to be lacking in any part of the solution.

On-premises scaling of the solution is a bit more limited than it is on the cloud.

The pricing of the solution needs to be a bit lower.

It would be ideal if the hardware could meet more universal global regulatory requirements. It would be great it the solution better aligned with global standards.

For how long have I used the solution?

I've been working with the solution for three to four years at this point.

What do I think about the scalability of the solution?

In terms of the cloud, scalability is very straightforward. It's just about as expansive as we want to go. When it comes to an on-premise deployment, there might be some scalability limitations. We've found we just have to cut hard on the resources as it does a lot of processing. Whereas the cloud is easy and has very little limitation, I'd advise others that on-premise may have some difficulties. 

On-premises, it's definitely on the customer to ensure they have the right plates. If they're concerned and they need 100% scalability, it's best to be on the cloud.

How are customer service and technical support?

Technical support is very good. They know their product and they are responsive to requests. We're satisfied with the level of service provided to us.

How was the initial setup?

We didn't have any issues with the initial setup. It's not too complex. We found the process to be very straightforward and very simple.

What's my experience with pricing, setup cost, and licensing?

While I do understand that it is a premium tool, they could work to make it a bit less in terms of cost. It's a bit expensive.

What other advice do I have?

We use a mixture of public and private cloud deployments.

I would definitely recommend the solution, having seen it work for others so well. Its ease of usage and its man integrations make it a great product. The way you can access whatever you need on the solution is very similar to a Google bar where you can search for anything you need. It's just a super quick responsive, product.

Overall, I would rate it a perfect ten out of ten. We have no complaints.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
CEO at a tech services company with 11-50 employees
Real User
Top 5Leaderboard
Simple to install, with good monitoring, and correlation capabilities
Pros and Cons
  • "The scalability is good."
  • "In the next releases, I would like to see more pricing flexibility."

What is our primary use case?

We are resellers. We provide solutions to our clients.

Splunk is primarily used for developing CM solutions that are based on the Splunk platform for future security operation center development.

We are concentrating on assisting in the development of a security monitor as well as analysis.

If I am not mistaken, it's a standard CM system for identification, security verification, and event monitoring.

What needs improvement?

In my opinion, it is too expensive for our projects.

It is very competitive for small and medium businesses. Perhaps some should be set aside for developing markets. To begin with, similar to the current market, there may be some special conditions for large transactions.

In the next releases, I would like to see more pricing flexibility. It's a subscription-based service, and they don't sell professional licenses.

In some cases, particularly with large projects, we are not competitive in terms of pricing when compared to IBM QRadar and other solutions; even if we offer the maximum discount available, our prices remain uncompetitive.

For how long have I used the solution?

We have been selling Splunk for approximately five years.

What do I think about the scalability of the solution?

The scalability is good. It can be added on-demand in increments of one gigabyte or ten gigabytes. It's a per-gigabyte license, and you can add whatever you need at the time.

Our projects are sized per our current IT infrastructure.

Splunk is used by 10 of our customers.

How are customer service and support?

Our team provides technical support.

I have not communicated with technical support.

Which solution did I use previously and why did I switch?

We no longer resell Checkmarks. 

We were unable to assist in establishing their business on-premises because It could have been too expensive for our clientele.

How was the initial setup?

Installing Splunk is not difficult, but it can be complicated in some cases.

The issue is the integration with the customer's system, as well as the configuration of the rules for correlation, log collecting, and analysis.

It has good documentation and guides, but the main works should be focused on customer needs and customer resources for monitoring.

It can take three months to complete the installation.

We have a team of three certified engineers who will deploy and maintain this solution.

What's my experience with pricing, setup cost, and licensing?

The licensing fees and pricing models could be reduced.

It's a yearly subscription.

They don't sell professionally because it's a subscription service. As a result, it is only a subscription service that is dependent on the customer's IT infrastructure.

What other advice do I have?

We do not sell Compliance Control Limited solutions because our focus is on auditing and independent security assessments. We put an end to our selling program with Checkmarks.

I would recommend this solution to others. Splunk is appropriate for small to medium-sized projects, and it should be calculated for large projects.

It's one of the best CM solutions on the market for monitoring, and correlation, as well as IT monitoring security.

I would rate Splunk an eight out of ten.

Which deployment model are you using for this solution?

On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer: Reseller
Flag as inappropriate
Senior Network Engineer at a tech services company with 51-200 employees
Real User
Top 20
Useful search function, beneficial session reports, but performance could improve
Pros and Cons
  • "The most valuable features in Splunk are the search function and the ability to run selected session reports. The session reports are important because I can use them to see what is going on in our environment weekly. Additionally, we can use the graph to see how often that particular event is happening."
  • "Over time I will have more requirements and I can foresee the solution could improve the search algorithm to run and output the data faster."

What is our primary use case?

We typically use Splunk to collect and check all the logs and events around the diverse network environment which includes, firewall, switches, and routers. For example, we have traffic that needs to go from one part of the network to another and if we think there is a firewall blocking it along the path, rather than log in to all the firewalls to see what is happening, we simply go into Splunk and the check traffic going across the parts of the network to see where it is being dropped and what is the likely reason it has been dropped.

How has it helped my organization?

Splunk has saved our organization time by resolving problems in a quicker timeframe. Before if we had networking issues we would have to log into every single device, check the firewall to see why the traffic is not going across to solve the problem. With Splunk, you only have a single pane of glass to check what is likely happening. This has enabled us to easily go to the right environment and write the necessary security policy to permit such traffic. It brings about faster resolution of problems reduced with visibility.

What is most valuable?

The most valuable features in Splunk are the search function and the ability to run selected session reports. The session reports are important because I can use them to see what is going on in our environment weekly. Additionally, we can use the graph to see how often that particular event is happening.

What needs improvement?

Over time I will have more requirements and I can foresee the solution could improve the search algorithm to run and output the data faster.

For how long have I used the solution?

I have been using Splunk for approximately six months.

What do I think about the stability of the solution?

We have been satisfied with the stability of the solution.

What do I think about the scalability of the solution?

Slunk scale very well.

We have approximately 50 people in our infrastructure and applications teams using this solution in my organization.

We plan to increase usage in the future.

How are customer service and technical support?

I have not needed to open a ticket up with technical support. 

Which solution did I use previously and why did I switch?

Previously to using Splunk we only had some Syslog servers that we sent logs to. However, Syslog servers, do not analyze your logs, they only capturing them. Whereas, in Splunk, you can assess the logs and you can do other things with the log.

How was the initial setup?

I do not think the implementation is difficult.

What about the implementation team?

We have an internal team that does the maintenance of the solution.

Which other solutions did I evaluate?

I have evaluated DataDog.

What other advice do I have?

Splunk is easy to use and not having the need to log into every single network device for management is helpful.

I rate Splunk a seven out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Flag as inappropriate
Engineer at a financial services firm with 201-500 employees
Real User
Top 20
Great flexibility, pretty stable, and has great technical support
Pros and Cons
  • "The flexibility of the solution is quite good."
  • "The solution has a high learning curve for users. It's a little complicated when you're trying to figure out all the features and what they do."

What is our primary use case?

It's the primary place where I'd go to do an investigation if I want to see what's going on within an endpoint, or on a network, or with a user.

What is most valuable?

The flexibility of the solution is quite good.

The product is stable.

It offers good scalability if you are willing to pay.

The technical support on offer is responsive.

What needs improvement?

The solution has a high learning curve for users. It's a little complicated when you're trying to figure out all the features and what they do.

The solution needs a bit more functionality. For example, being able to save a search and select it when you're doing an investigation. I know you can create dashboards and things like that, however, sometimes being able to have a pre-saved search and just fill in whatever value you need would make everything so much easier.

For how long have I used the solution?

I've been using Splunk for four years so far. It's been a while.

What do I think about the stability of the solution?

I haven't had any stability issues with it. It's pretty stable. There aren't bugs or glitches. It doesn't crash or feeze.

What do I think about the scalability of the solution?

You can scale the solution, however, users need to be aware of the product increasing in cost as well.

How are customer service and technical support?

The technical support is very good. We're quite satisfied with the level of service provided. They are knowledgeable and responsive.

Which solution did I use previously and why did I switch?

When I came to the company, they were already using Splunk. It's only now that we're looking to possibly move to another vendor. The cost of Splunk is much too high.

How was the initial setup?

I wasn't here when this solution was put into place, however, from looking at the documentation and things like that, the setup is pretty involved. I'd say it's a bit more complex than straightforward.

What's my experience with pricing, setup cost, and licensing?

We find the solution to be quite expensive. Therefore, we're looking for other options.

I don't know of the exact costs, as licensing is handled by another department.

What other advice do I have?

We're just users. We don't have a business relationship with Splunk.

We're on a variation of version seven. I'm not sure of the exact one. It's not quite the latest.

I'd advise new users, if they have the budget for it, to go and take the training that they offer. Or, for casual users, you just want to spend as much time watching YouTube videos as you can. It will help lessen the learning curve.

As a solution, it's still pretty much industry standard. I would give it a nine out of ten overall, even though I have my gripes with it.

Disclosure: I am a real user, and this review is based on my own experience and opinions.