Snort vs Splunk Enterprise

• Real Time updates for security signatures via Talos
• Great signature blocking
• Excellent reporting via syslog to our Security Analytics collectors.

Read full review

• Allow for separation of control where we don't let some employees have access to production but still can diagnose issues.
• Common location to go for all logs even if the logs themselves aren't in the same place.
• Ability to ingest logs from different locations without having to change the code to put logs in a certain place (pro and con).

Read full review

• Due to the extensive interface, it can be quite overwhelming to try and manage the product. There are many different places to go to set up individual items. It would be nice to simplify the interface down a bit
• Upgrades can be somewhat hazardous. I think they are working to get the upgrade process streamlined, but currently moving major version (5.x to 6.x) there was a lot of additional work outside of the UI that if not done correctly can tank the system, requiring a fresh load or restore from backup

Read full review

• Even though there is a search tool as a help function, you still have to read through many documentation to find the answers you're looking for and sometimes you don't find it. The help function in Splunk could be improved to be more intuitive or have a built-in help per report, panel or dashboard.
• Creating a Splunk dashboard is rather straightforward however, customization is not. Splunk could be improved to provide more tools or features for customization such as adding colors and font options for text and graphs or graphics.
• My dashboard has a lot of useful information and I want the important panels and reports at the top but there is no easy way to do this. Perhaps Splunk could be improved to allow features such as adding URL links to other dashboards or some other clever way to emphasize the important data in my dashboard without compromising space.

Read full review

• Being open source, ROI on free is hard to beat for something that works.
• I believe it greatly enhances the security of my network.

Read full review

• I'm not a data analyst so I can not provide concrete examples on how the business has benefited from implementing Splunk. However, the analysts I have worked with have provided a wealth of support in reducing workstation issues across the enterprise. This alone reduces the time it takes to determine where the exact problem lies between a workstation and the servers it tries to communicate with.

Read full review