Skip to main content
TrustRadius

Overview

What is Splunk Enterprise?

Splunk is software for searching, monitoring, and analyzing machine-generated big data, via a web-style interface. It captures, indexes and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards and visualizations.

Read more
Recent Reviews

Splunk enterprise stable solution

7 out of 10
January 05, 2024
Splunk Enterprise is used in the company by the IT department. Mainly to monitor security events on process-relevant systems where the …
Continue reading

TrustRadius Insights

Valuable Log Gathering and Summarization: Users have expressed positive opinions about Splunk's ability to gather and summarize log …
Continue reading

Great if you have the money

7 out of 10
October 24, 2023
We use Splunk Enterprise as a SIEM and a separate pool to use for medical record auditing. The SIEM catalogues information from multiple …
Continue reading

Real-time smart meters

9 out of 10
August 17, 2021
Incentivized
Splunk is being using to track the status of electric utility smart meters which record customer energy usage. Smart meters send power …
Continue reading
Read all reviews

Awards

Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards

Popular Features

View all 13 features
  • Custom dashboards and workspaces (54)
    8.5
    85%
  • Centralized event and log data collection (53)
    6.5
    65%
  • Event and log normalization/management (53)
    6.0
    60%
  • Correlation (52)
    6.0
    60%

Reviewer Pros & Cons

View all pros & cons
Return to navigation

Pricing

View all pricing
N/A
Unavailable

What is Splunk Enterprise?

Splunk is software for searching, monitoring, and analyzing machine-generated big data, via a web-style interface. It captures, indexes and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards and visualizations.

Entry-level set up fee?

  • No setup fee

Offerings

  • Free Trial
  • Free/Freemium Version
  • Premium Consulting/Integration Services

Would you like us to let the vendor know that you want pricing?

41 people also want pricing

Alternatives Pricing

What is Blumira?

Blumira’s cloud SIEM platform offers both automated threat detection and response, enabling organizations of any size to more defend against cybersecurity threats in near real-time. It's goal is to ease the burden of alert fatigue, complexity of log management and lack of IT visibility.

Return to navigation

Product Demos

Splunk Incident Review Demo

YouTube

Splunk Threat Intelligence Demo

YouTube

Splunk Enterprise Security | Splunk Enterprise Installation | Splunk Training | Edureka

YouTube
Return to navigation

Features

Security Information and Event Management (SIEM)

Security Information and Event Management is a category of security software that allows security analysts to look at a more comprehensive view of security logs and events than would be possible by looking at the log files of individual, point security tools

7.5
Avg 7.8
Return to navigation

Product Details

What is Splunk Enterprise?

Splunk Enterprise enables users to find out what is happening in a business and take meaningful action. It automates the collection, indexing and alerting of machine data that's critical to operations, so that users can uncover the actionable insights from data — no matter the source or format. Leverage artificial intelligence and machine learning for predictive and proactive business decisions.

Splunk Enterprise Technical Details

Operating SystemsUnspecified
Mobile ApplicationNo

Frequently Asked Questions

Splunk is software for searching, monitoring, and analyzing machine-generated big data, via a web-style interface. It captures, indexes and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards and visualizations.

SolarWinds Loggly and LogRhythm NextGen SIEM Platform are common alternatives for Splunk Enterprise.

Reviewers rate Incident indexing/searching highest, with a score of 9.

The most common users of Splunk Enterprise are from Enterprises (1,001+ employees).
Return to navigation

Comparisons

View all alternatives
Return to navigation

Reviews and Ratings

(465)

Community Insights

TrustRadius Insights are summaries of user sentiment data from TrustRadius reviews and, when necessary, 3rd-party data sources. Have feedback on this content? Let us know!

Valuable Log Gathering and Summarization: Users have expressed positive opinions about Splunk's ability to gather and summarize log messages from multiple sources. Many reviewers find this feature valuable, as it allows them to easily access and analyze log data in a centralized location without the need for manual aggregation.

Simplicity and Advanced Search Capabilities: Splunk's reporting functionality is highly regarded by users for its simplicity and advanced search capabilities. Several reviewers appreciate how easy it is to use Splunk's reporting features, while also being able to perform complex searches that provide detailed insights into their data.

Effective Web Traffic Catching and Dashboards: The effectiveness of Splunk in catching web traffic and providing helpful dashboards is another aspect praised by users. Many reviewers highlight how Splunk's web monitoring capabilities enable them to track website activity effectively, while the intuitive dashboards allow for quick visualization and analysis of important metrics.

Confusing User Interface: Some users have reported that the user interface in Splunk can be perplexing, leading to difficulties in quickly performing tasks and navigating the software.

Limited Integration with Excel: Users have expressed their desire for improved integration between Splunk and Excel when it comes to creating reports and dashboards. They feel that better connectivity and seamless data transfer would enhance their workflow.

Steep Learning Curve: Several users have mentioned the complexity of Splunk's architecture, requiring a dedicated team of engineers to effectively manage and optimize its performance. This steep learning curve can pose challenges for new users who may need additional time and resources to fully grasp the intricacies of the platform.

Based on user reviews, the following recommendations emerged for using Splunk:

  • Ensure the correct subscription: Users emphasized the importance of having the correct subscription for Splunk to avoid login issues and fully utilize its features. They recommend careful planning of the deployment and learning as much as possible before implementing a large installation.

  • Thoroughly investigate anomalies: While Splunk's great dashboards for troubleshooting are praised, users advise against relying solely on system alerts generated by Splunk. They suggest continuing to investigate any anomalies and carefully setting up sources and background data in Splunk.

  • Utilize Splunk's log analysis capabilities: Many users recommend Splunk as a valuable tool for log analysis and improving the quality of current processes. They find it helpful for debugging integration issues and consider it suitable for large-scale applications/systems. Users appreciate its ability to connect to individual boxes and view multiple logs simultaneously.

It should be noted that some users suggest that there may be better and cheaper alternatives for small to medium-sized businesses, while others propose improvements to the search result UI and pricing structure to attract more users in the industry.

Attribute Ratings

Reviews

(1-25 of 68)
Companies can't remove reviews or game the system. Here's why
Score 7 out of 10
Vetted Review
Verified User
Splunk Enterprise is used in the company by the IT department. Mainly to monitor security events on process-relevant systems where the degree of security must be as high as possible. Monitoring and rapid response helps reduce downtime of vital systems.
  • Ingest data and present it in a easy to read and process format
  • Correlation
  • Analysis and presentation of data
  • Ease of operation and maintenance compared to other solutions of its kind
  • Easier to implement and maintain than other solutions
  • It would be useful to have more standardization of some of the information stored
  • An expensive solution
  • Documentation could be more accurate and up-to-date
It will be suitable for large organizations. Easier to train users and scales well. Unfortunately, it will be too expensive for small businesses and enterprises.It is a consistent solution. By combining multiple tools from the same company, you can get a stable environment.My experience shows that it is not the most flexible solution on the market. Before selecting a SIEM solution, gather requirements and choose a solution according to your needs. If your organization has standard needs, Splunk will not be a bad choice.
Score 7 out of 10
Vetted Review
Verified User
We use Splunk Enterprise as a SIEM and a separate pool to use for medical record auditing. The SIEM catalogues information from multiple courses to provide efficiency and security data to the organization. Our medical record audit system is a custom written Splunk Enterprise app that takes audits from our EHR to determine suspicious activities
  • Searching of information.
  • Report building
  • Flexibility
  • Cost
  • Easier guides
  • Data normalization.
Primary issue with Splunk Enterprise is cost. The licenses can get extremely expensive very quickly in my opinion. If the organization can afford to have all of their data in it then the program is amazing. We have been able to solve multiple problems or find things that would normally take hours within seconds with the tool
Score 8 out of 10
Vetted Review
Verified User
Incentivized
We use Splunk Enterprise to do various types of monitoring across organizations using a clustered environment with distributed indexers, search heads, UF, and HFW i.e. Application Monitoring of various ETL tools such as Mulesoft, Airflow, Stream sets, etc REST API Monitoring Database monitoring HEC monitoring
  • Act as a Search Head, Indexer and Forwarder
  • Have full features to install Add-Ons
  • Is On-Prem, so we have full control on created lookups on file system
  • Better SPL Intelligence
  • Add-On's auto upgrade management and notifications
  • Implement more features on UI instead of config based implementations
This is best suited for limited and known scaling of nodes and where we don't want data to flow outside the organization otherwise we can switch to Splunk Cloud for better automatic scaling where scaling need is unknown but has an overhead of data to be encrypted
August 17, 2021

Real-time smart meters

Score 9 out of 10
Vetted Review
Verified User
Incentivized
Splunk is being using to track the status of electric utility smart meters which record customer energy usage. Smart meters send power outage & restoration notifications which we track in real-time with splunk. This capability is very important for enhancing our situational awareness to help ensure we deliver safe and reliable electricity to our customers.
  • Real-time status
  • Data integration
  • Live dashboards
  • Automated machine learning
  • Extract transform and loading
  • Data modeling
Handling millions of real-time data points can be achieved with ease.
Score 9 out of 10
Vetted Review
Verified User
Incentivized
Splunk Enterprise is the basis for our log correlation and analysis. We're using it primarily for IT Security, and occasionally to assist with operations was helpful. It is the basis of our SIEM, Splunk Enterprise security. We pull in events from a wide variety of data sources. The ability of Splunk to ingest and normalize just about any sort of data is one of its strongest points.
  • Gets data from anywhere
  • Variety of supported alert types
  • Real-time insights
  • They should not remove support for Duo 2fa.
Splunk is well suited almost anywhere an Enterprise can afford it. It does require some technical chops to support an on-prem installation, but less so with a Cloud subscription. If it involves data there is a good chance that is possible with Splunk. In particular, it is a great base for Security use cases, especially for disparate and non-standard data sources.
Score 10 out of 10
Vetted Review
Verified User
Incentivized
Splunk Enterprise is used by our Infrastructure and Enterprise Monitoring Team and Security Teams to monitor our infrastructure. Monitoring is enabled for the overall health of our systems. Data is collected from multiple data sources. Logs are analyzed and converted to meaningful metrics for the team to proactive monitor and take corrective actions.

Splunk has the ability to correlate data from disparate data sources and provide root cause hence reducing MTTR and improving our SLA's with our customers. The events logged in Splunk help our IT Analyst and Security Analyst take proactive action before impacting the services which our customer uses. The Event Correlation helps us find RCA and improve MTTD and MTTR.
  • Collect data from multiple data sources and correlate. Reduce alert noise from multiple monitoring systems.
  • Monitor alerts and report on data collected. Create custom dashboards.
  • Powerful machine learning and AiOPS functionality.
  • Helps with our security compliance and addresses the security team's need to remain PCI compliant.
  • Splunk data sizing and data collected. Worked with Professional Service to scale our environment.
  • Capacity data storage for Splunk data.
  • TuningSplunk analytics dashboards for performance.
Good for event correlation from multiple data sources, web monitoring, systems and application monitoring. Good as security information and event management tool. It collects data from logs and custom applications helping the business make informed decisions across the organization. Gain insights to drive operational performance and business results. Splunk's rich visualizations make results easy to understand and take necessary actions.
Score 9 out of 10
Vetted Review
Verified User
Incentivized
We use this across our different departments for security, app performance monitoring, host monitoring, data intelligence, correlation, alerting and much more. It's a Swiss Army Knife of IT products.
  • The power of it. It's a very good tool that does amazing things. Nothing comes close to it.
  • It can ingest any data and present it in a digestible, searchable format.
  • Flat file format makes it very fast and the best visualizations I've seen.
  • It can be cost prohibitive, but I still think it's worth it.
  • Training users is a little bit steeper, but once they have it, it's very powerful.
Overall security monitoring: It can take data in and correlate it across very different datasets. Some tools require you to ingest and format it their way, but being able to do ad-hoc searching during an incident has proven to be very valuable.
Score 10 out of 10
Vetted Review
Verified User
Incentivized
Splunk Enterprise is being used by mostly IT Department. [It's] being used to monitor security monitoring purpose[s] along with [business-relevant] use case monitoring.
  • Data Normalization
  • Correlation
  • Data Analytics
  • Use Case Development Capability
  • Cost
Splunk Enterprise is mostly suited for organizations where enough budget is available to maintain along with having dedicated resource[s] for it. While [it's] a great tool, you need to skilled resource[s] to get the best out of it.
April 14, 2020

Splunk leads the pack

Score 9 out of 10
Vetted Review
Verified User
Incentivized
Splunk is our one stop shop for all log data. We send logs from everything from servers, routers, firewalls, switches, sans and applications there to be analyzed and reviewed by different teams. This solves a critical issue by ensuring all teams are working from the same information. Prior to consolidating onto Splunk a number of different sources of truth leading different teams to work with different information.
  • Single source of truth for all log files.
  • Alerting system based on captured log data.
  • Reporting/Dashboard system to present data.
  • Complex overall architecture.
  • Long implementation time.
  • High cost.
  • Requires on-going staff time to keep running effectively.
Splunk is a great fit for organizations that need to consolidate log data. It's also a great fit for organizations that need to provide access to data to different teams of engineers. We send all of our log data to Splunk, index and report on it then provide access to different teams based on need.
Ahmet Fatih IRKLI | TrustRadius Reviewer
Score 10 out of 10
Vetted Review
Verified User
Splunk Enterprise is used across the whole department in our organization for Security information and event management. It improves our security aspect of the assets by collecting logs. Splunk offers log collection from all types of assets in the environment varying from vulnerability scanning tools to network devices. Centralizing all these logs and managing them from one place is the real deal. It manages huge amounts of log data with a robust operation. Every day our environment creates dozens of logs and Splunk enables us to see anomalies with alarms.
  • Maximize endpoint logging.
  • Can find and store logs from all types of assets.
  • Customization of dashboards.
  • Creating apps based on your needs.
  • Alarm feature alerts relevant people in the organization.
  • Data visualization.
  • Search queries can be saved for future or even can be converted to apps.
  • Slow interface.
I definitely recommend Splunk Enterprise to security and network teams as it is perfectly scalable for any size environment.
  • Network teams can easily see if there is a problem with the network device.
  • The security team can easily be notified about anomalies that may due to an intrusion.
  • The support team can follow the situation of assets and tools.
  • It can be integrated with most of the tools available on the market.
Score 7 out of 10
Vetted Review
Verified User
Incentivized
Currently our bank has different departments with their own Splunk infrastructure. We are currently building a larger infrastructure to incorporate all departments to join this centralized infrastructure with Splunk Enterprise. As Splunk is used for log analyzing, it is used for reports on different metrics built from logs collected from different servers. We try to consolidate the logs and put results onto a more centralized data center set as well.
  • Log analyzing.
  • Reports.
  • Forecast (ML model).
  • Stability on some components (e.g. indexers).
  • Complexity of install and maintenance of infrastructure.
Splunk is good for log analyzing from enterprise level of applications on different logs and consolidating results as reports. We can use such data to make forecasts for future trends if issues would occur more or less frequently.

Setup and maintenance would not be easy, so always plan ahead. Also always do health check for stability on some of the Splunk components such as indexers and HFs.
Fraser Clark | TrustRadius Reviewer
Score 10 out of 10
Vetted Review
Verified User
Incentivized
Splunk was initially purchased to be our replacement for our syslog server, but it has grown into much much more and this is because of how easy it is to get logs into Splunk and the flexibility of what can be done with those logs.
We are now using it as a security tool, ingesting logs from lots of different sources and even our cloud platforms.
Currently it is just our IT team that use Splunk.
  • Dashboards/visualisations.
  • Can ingest any type of data.
  • Flexibility with filtering, etc.
  • Steep learning curve.
  • Full stack reporting (though with SignalFX being purchased by Splunk, this is clearly a high priority).
  • Team needed to manage large installations.
Splunk is excellent in most situations where log collection and aggregation is needed. It can work as a small scale syslog server and be built on from that.
The obvious wall is the cost of the product and for that reason I would say smaller businesses would not be suited to this as there are free solutions that could bridge this gap.
Score 9 out of 10
Vetted Review
Verified User
Incentivized
We're using Splunk Enterprise to assist us with IT Operations and IT Security. We came to look at Splunk because when I entered the company I found over 500 devices with no centralized logging in any way, no ability to pinpoint problems across the whole organization whether historic or predictable and things like this. Splunk is helping us deliver a predictable, robust operation of our infrastructure instead of reacting to problems and working to find just what was affected and when.

We believe we can apply Splunk to other data, in time, specifically aiding the company with analyzing financial information, but this is not yet an active project.
  • Fast, efficient
  • Solid community of experts and training materials
  • Ingests data from many sources, with a large number of partner relationships
  • There is a high learning curve. If you go to a Splunk demo or class, get inspired, then install it yourself, you'll have no idea what you're meant to do. It's not intuitive to the first-time user in any way.
  • Pricing can be confusing. People ask how much data you want to ingest, and you don't know until after you've been using Splunk. It's not easy to sign up and start without guesswork.
  • I found online help pages are broken or out-of-date, or incomplete. e.g. pages on setting up the Java-based SQL Server driver don't even tell you where to download it or where to install it.
Splunk Enterprise is well-suited for any requirement to aggregate vast sums of data, no matter how structured or unstructured, and search across it all at speed, or report on it with visualizations, etc.

It's not suited for scenarios where you want to report on a single set of data, say, in a traditional way, for example, a typical scheduled report out of a finance system.
Score 9 out of 10
Vetted Review
Verified User
Incentivized
Splunk Enterprise has been used by our Cybersecurity Department for almost five years to be the single dashboard for our Security Incident and Event Monitoring. On top of that, we are also using the Enterprise Security, and it helps us to focus on the most notable events that need to be followed up asap.
  • Central dashboard for all logs
  • Enterprise Security
  • Better dashboard graphics
Splunk Enterprise is very well suited for correlating all the logs that need to be monitored and to be analyzed. It has performed very well with a vast amount of logs data. Furthermore, Splunk Enterprise can be pumped in and do parsing for numerous security device logs.
However, it needs certain technical skills to be able to correlate the logs and do the query in the Splunk Enterprise.
Score 10 out of 10
Vetted Review
Verified User
Incentivized
Splunk Enterprise is used as a repository for all our server and network infrastructure logs. This allows us to go to one place to review logs and potentially find a relationship between different systems with specific issues. For example, seeing failed login attempts to our switches and learning that a server was using old credentials.
  • Robust collection of plugins to support specific applications
  • Relatively easy to use
  • Strong and helpful support
  • Difficult to master
  • Can be very complicated to implement into an environment
  • Very expensive
If the organization is looking for a powerful SIEM solution and has the budget, then I would recommend Splunk Enterprise. Using the tool can be as simple or as complicated as you want it. My only hesitation will be the complexity of implementation. For smaller organizations, it shouldn't be an issue, but larger ones may find it challenging to follow Splunk Enterprise's best practices for implementation.
Johanes Siregar | TrustRadius Reviewer
Score 8 out of 10
Vetted Review
Verified User
Incentivized
Splunk Light is being used by our Operational and Maintenance team for transaction logging and event monitoring. It was the right solution for our organization since our IT internal policy stipulates that any solution which interacts with our subscriber's activity data must be deployed on-premise. Moreover, since we only have a handful of O&M team, Splunk Light is a lot more convenient to deploy and manage.
  • Splunk Light is perfect for standalone on-premise deployment.
  • Mainly works well for a small team
  • Scalability might be an issue
  • A small limit on the number of the user also poses a challenge for large team collaboration.
Splunk Light is perfect to be used by a small organization or a team within a large organization with internal IT policy which required any solution must be deployed within the organization's premise. It performs very well for event log monitoring and alerting purpose. It is also relatively quick to deploy and easy to manage.
ShuYun Du | TrustRadius Reviewer
Score 9 out of 10
Vetted Review
Verified User
Incentivized
We use Splunk to integrate all the logs for each of the applications. Building dashboards and alerts base on the logs by the Application team's requirement. The Application team will be able to search through their log from one centralized place rather than logging into multiple servers to try to define the issue manually. With the Splunk search language, it is very easy to look for possible errors within a certain time frame. Our organization also use Splunk for fraud investigation purpose. We have more than 100 application teams using Splunk today and most of them are using it for troubleshooting purposes when there is an issue that has occurred.
  • Log mining.
  • Able to consume multiple log sources.
  • Provides the possibility to upgrade the Splunk UF from a deployment server.
  • Splunk search language can be very expensive if the users do not know what they are doing.
Splunk is the best tool to use for log mining. It is also good at combining multiple sources of logs together and creates a single pane of glass. It can do lots of APM monitoring however at the end of the day it is more of a log mining tool but not an APM tool. It is best to use for business analyzing, debugging and fraud investigation. When it comes to monitoring part, get a proper APM tool will be a better idea.
Score 9 out of 10
Vetted Review
Verified User
Incentivized
Splunk Enterprise has been used across University of Minnesota as one of our IT monitoring and alerting tools. This has been a big help for our user base to provide timed email alerts as well as monitoring all of the threshold parameters we set up. We have a dedicated admin to make sure the Splunk agents have been deployed and configured across all the client tools.
  • Timely alerting
  • Sharing with end users automatically
  • Less impact
  • Sometime we see the Splunk agent taking higher CPU from OS prospects
  • Similar issues have been noticed in Oracle Databases
It is very easy to configure on Oracle Databases as well as on MSSQL/Window servers to monitor the pre-configured threshold.
November 20, 2019

Splunk: The log expert

Kuntal Das | TrustRadius Reviewer
Score 10 out of 10
Vetted Review
Verified User
Incentivized
Splunk Enterprise is a brilliant tool that we use in the University of Colorado, Denver to analyze logs obtained from various sources. Our team is responsible for maintaining the security of our campus and the University of Colorado, Anschutz medical campus.

The log sources are typically firewall logs, email logs, logs from the Intrusion detection system (IDS), logs of different services running on the google cloud, etc. It offers a very easy interface and a query language. We can build our own alarm rule and UI within it for visualization. The rules will run at a time defined by the user and will send metrics to the email. It helped in automating blacklisting as now we can get the most troublesome IP addresses and block them in a minute. It also helped us in tracing a list of most vulnerable on the campus. The most powerful feature is the correlation of log sources. Correlation of log sources is a very taxing process for any software. Splunk handles this gracefully. By correlating firewall traffic, wireless and IDS traffic we once spotted a machine that had a trojan in it and was trying to spread itself laterally through open SMB ports.
  • It is very useful in creating custom rules for analyzing system logs and display relevant information. The query language is very easy to learn.
  • We can create custom UI to visualize the output of our data. The interface is very flexible. It also allows the sharing of rules among users.
  • There is an open online community to help others. Stackoverflow also has a splunk community. These resources make it more convenient to learn.
  • They can introduce a query builder for non-technical users.
  • The query error messages could be more specific.
Pros: Splunk is very well suited if you have multiple log sources of related data. All of them can be correlated and tasks can be automated based on the requirement. Other than alerts, Splunk can also run a specific script of your choice, based on some defined conditions.
Cons: If you have a few logs but a large number of log sources, Splunk can be very expensive.
Johann Davila | TrustRadius Reviewer
Score 10 out of 10
Vetted Review
Verified User
Incentivized
Splunk is used by our Engineering Department. Splunk has been a valuable and useful tool for our company to monitor errors occurring at all times. We love the real-time monitoring system that helps us detect errors and get the right people to handle them when needed to get things back up and running.
  • Love the real-time monitoring system.
  • Easy to use.
  • I have no suggestions.
It is well suited with real-time monitoring and notifications sent when issues occur. It has been very helpful to monitor issues that applications are having so that we can get the right team to address these issues to get the company back up and running to continue business as normal.
Score 8 out of 10
Vetted Review
Verified User
Incentivized
Splunk Enterprise tool is being used across our Digital department. Using this tool we are able to search and analyze event logs of our customer sessions. We can see the error trends of our Digital Services. Set up alerts for multiple KPIs and create dashboards for monitoring the health of our Digital products.
  • Captures multiple different information about a customer and his/her session.
  • Intuitive and informative search options.
  • Option to set up precise alerts for different KPIs.
  • The speed of the tool could be improved.
  • It could store and allow to search for historical data older than 60 days (may be related to our company license).
  • Dashboard creation could be more user-friendly.
When needed to search for some specific event information triggered by end-user or by any other service, Splunk Enterprise tool can give that information and by reviewing the log of the event you can find a lot of needed information that could help you to find the solution or resolve the issue on the spot.
Score 8 out of 10
Vetted Review
Verified User
Splunk is being used by the entire organization for searching and reporting and to analyze the logs and entire organization’s data. Splunk is a great tool to work on. It helps in finding various threats inside and outside the organization. Five stars.
  • Versatile
  • Intelligent
  • Reporting
  • Searching
  • Log analysis
  • Costly
  • Needs training to work on
  • Needs hands on experience to get used to
Splunk is the best tool to work on if there is a need for analyzing the logs and the organization’s inside data. The way employees use search engines and browse for their personal use they can be caught easily. Also, if there are some outside threats within the company you can analyze those by setting up alerts.
Score 6 out of 10
Vetted Review
Verified User
Incentivized
We installed Splunk Light to get our feet wet with centralized log management. The primary use was in our network and security department. Splunk Light allowed us to quickly and easily search across all of our device logs, as well as gave us the ability to correlate log entries between machines. It also helped us satisfy our compliance requirements for logging.
  • Monitoring and Alerting: Creating custom actions based on log entries was the largest unexpected bonus for us. While we had other software configured to do this job Splunk was easy to implement and could be managed by a larger number of our team members.
  • Cross-Device Analysis: Seeing data from all of your devices in one location makes following event chains much easier.
  • Vendor Specific Add-ons: There is a large library of vendor-specific add-ons for the software allowing for automatic formatting and action for certain types of logs, greatly reducing the man-hours required to get started.
  • Splunk Light doesn't include the ability to create data models or tables without paying for a large upgrade. This is a rather basic feature, I wish it had been included.
  • High Availability is another basic feature that is excluded, greatly limiting Splunk Light's usefulness.
Splunk Light is highly useful for smaller companies without regulatory requirements for logging of data. It has all of the main features required for basic troubleshooting and log retention for internal use. Splunk Light is not a good fit for large deployments as it's not capable of high availability, data modeling, SSO, or clustering will cause issues.
Score 9 out of 10
Vetted Review
Verified User
Incentivized
Splunk is an excellent logging platform, allowing for short and long term log storage with top tier indexing and searching capabilities. We have deployed Splunk to aggregate all logs and act as a central logging platform throughout the company. This helps us solve operational issues by providing a centralized log monitoring platform to be used by our operations group. It also helps solve regulatory issues by being the central logging platform with strict access controls as well as tiered storage and archiving capabilities.
  • Tight access control via a variety of mechanisms to restrict users to specific logs.
  • Solves regulatory controls by providing access control and archival storage capabilities.
  • Provides a quick mechanism to search across multiple logs for issues between systems.
  • Splunk can be expensive since it's based on the amount of logging you do. The capabilities definitely make up for the cost, but there is a high bar to entry.
  • Splunk can be overly confusing for new users. The capabilities are quite vast and sometimes daunting.
Splunk is an excellent central logging system. For companies concerned about the cost, you can combine Splunk with an open-source logging engine such as rsyslog and only ingest the logs you need to search. Splunk is an excellent tool for handling web and systems logging and can help quickly identify issues in both.
Score 10 out of 10
Vetted Review
Verified User
Incentivized
Splunk Enterprise is used to monitor both Prod as well as all our lower environments. It is used for analyzing logs and tracing transactions. We write Splunk queries and create dashboards for monitoring several Key Performance Indicators. We first analyze metrics over a particular period of them to understand the trend and then set up alerts on these metrics for threshold violations.
  • Simplifies analyzing of big logs finds and helps in finding issues faster.
  • Splunk Alerts are great to be notified of possible issues so that necessary actions can be taken to avoid it from becoming a problem to our end users.
  • Dashboard reports can be scheduled to be generated and share with key stakeholders.
  • Comparison of two or more time series data in a single graph.
  • Search and make suggestions on Splunk commands as we type on the search window.
Simplifies analyzing of big logs finds and helps in finding issues faster. Splunk Alerts are great to be notified of possible issues so that necessary actions can be taken to avoid it from becoming a problem to our end users. Dashboard reports can be scheduled to be generated and share with key stakeholders.
Return to navigation