Splunk enterprise stable solution
Splunk Enterprise is used in the company by the IT department. Mainly to monitor security events on process-relevant systems where the …
Overview
What is Splunk Enterprise?
Splunk is software for searching, monitoring, and analyzing machine-generated big data, via a web-style interface. It captures, indexes and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards and visualizations.
Recent Reviews
Awards
Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards
Popular Features
- Custom dashboards and workspaces (54)8.585%
- Centralized event and log data collection (53)6.565%
- Event and log normalization/management (53)6.060%
- Correlation (52)6.060%
Reviewer Pros & Cons
Pricing
N/A
Unavailable
What is Splunk Enterprise?
Splunk is software for searching, monitoring, and analyzing machine-generated big data, via a web-style interface. It captures, indexes and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards and visualizations.
Entry-level set up fee?
- No setup fee
Offerings
- Free Trial
- Free/Freemium Version
- Premium Consulting/Integration Services
Would you like us to let the vendor know that you want pricing?
40 people also want pricing
Alternatives Pricing
What is Blumira?
Blumira’s cloud SIEM platform offers both automated threat detection and response, enabling organizations of any size to more defend against cybersecurity threats in near real-time. It's goal is to ease the burden of alert fatigue, complexity of log management and lack of IT visibility.
Product Demos
Splunk Incident Review Demo
YouTube
Splunk Threat Intelligence Demo
YouTube
Splunk Enterprise Security | Splunk Enterprise Installation | Splunk Training | Edureka
YouTube
Features
Return to navigation
Product Details
- About
- Integrations
- Competitors
- Tech Details
- FAQs
What is Splunk Enterprise?
Splunk Enterprise enables users to find out what is happening in a business and take meaningful action. It automates the collection, indexing and alerting of machine data that's critical to operations, so that users can uncover the actionable insights from data — no matter the source or format. Leverage artificial intelligence and machine learning for predictive and proactive business decisions.
Splunk Enterprise Integrations
Splunk Enterprise Competitors
Splunk Enterprise Technical Details
| Operating Systems | Unspecified |
|---|---|
| Mobile Application | No |
Frequently Asked Questions
Splunk is software for searching, monitoring, and analyzing machine-generated big data, via a web-style interface. It captures, indexes and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards and visualizations.
SolarWinds Loggly and LogRhythm NextGen SIEM Platform are common alternatives for Splunk Enterprise.
Reviewers rate Incident indexing/searching highest, with a score of 8.9.
The most common users of Splunk Enterprise are from Enterprises (1,001+ employees).
Comparisons
Compare with
Reviews and Ratings
(455)
Community Insights
TrustRadius Insights are summaries of user sentiment data from TrustRadius reviews and, when necessary, 3rd-party data sources. Have feedback on this content? Let us know!
- Pros
- Cons
- Recommendations
Valuable Log Gathering and Summarization: Users have expressed positive opinions about Splunk's ability to gather and summarize log messages from multiple sources. Many reviewers find this feature valuable, as it allows them to easily access and analyze log data in a centralized location without the need for manual aggregation.
Simplicity and Advanced Search Capabilities: Splunk's reporting functionality is highly regarded by users for its simplicity and advanced search capabilities. Several reviewers appreciate how easy it is to use Splunk's reporting features, while also being able to perform complex searches that provide detailed insights into their data.
Effective Web Traffic Catching and Dashboards: The effectiveness of Splunk in catching web traffic and providing helpful dashboards is another aspect praised by users. Many reviewers highlight how Splunk's web monitoring capabilities enable them to track website activity effectively, while the intuitive dashboards allow for quick visualization and analysis of important metrics.
Confusing User Interface: Some users have reported that the user interface in Splunk can be perplexing, leading to difficulties in quickly performing tasks and navigating the software.
Limited Integration with Excel: Users have expressed their desire for improved integration between Splunk and Excel when it comes to creating reports and dashboards. They feel that better connectivity and seamless data transfer would enhance their workflow.
Steep Learning Curve: Several users have mentioned the complexity of Splunk's architecture, requiring a dedicated team of engineers to effectively manage and optimize its performance. This steep learning curve can pose challenges for new users who may need additional time and resources to fully grasp the intricacies of the platform.
Based on user reviews, the following recommendations emerged for using Splunk:
-
Ensure the correct subscription: Users emphasized the importance of having the correct subscription for Splunk to avoid login issues and fully utilize its features. They recommend careful planning of the deployment and learning as much as possible before implementing a large installation.
-
Thoroughly investigate anomalies: While Splunk's great dashboards for troubleshooting are praised, users advise against relying solely on system alerts generated by Splunk. They suggest continuing to investigate any anomalies and carefully setting up sources and background data in Splunk.
-
Utilize Splunk's log analysis capabilities: Many users recommend Splunk as a valuable tool for log analysis and improving the quality of current processes. They find it helpful for debugging integration issues and consider it suitable for large-scale applications/systems. Users appreciate its ability to connect to individual boxes and view multiple logs simultaneously.
It should be noted that some users suggest that there may be better and cheaper alternatives for small to medium-sized businesses, while others propose improvements to the search result UI and pricing structure to attract more users in the industry.
Attribute Ratings
Reviews
(1-20 of 20)Companies can't remove reviews or game the system. Here's why
August 17, 2021
Real-time smart meters
Splunk is being using to track the status of electric utility smart meters which record customer energy usage. Smart meters send power outage & restoration notifications which we track in real-time with splunk. This capability is very important for enhancing our situational awareness to help ensure we deliver safe and reliable electricity to our customers.
- Real-time status
- Data integration
- Live dashboards
- Automated machine learning
- Extract transform and loading
- Data modeling
July 20, 2021
Robust IT Operations and SIEM Management Solution
Splunk Enterprise is used by our Infrastructure and Enterprise Monitoring Team and Security Teams to monitor our infrastructure. Monitoring is enabled for the overall health of our systems. Data is collected from multiple data sources. Logs are analyzed and converted to meaningful metrics for the team to proactive monitor and take corrective actions.
Splunk has the ability to correlate data from disparate data sources and provide root cause hence reducing MTTR and improving our SLA's with our customers. The events logged in Splunk help our IT Analyst and Security Analyst take proactive action before impacting the services which our customer uses. The Event Correlation helps us find RCA and improve MTTD and MTTR.
Splunk has the ability to correlate data from disparate data sources and provide root cause hence reducing MTTR and improving our SLA's with our customers. The events logged in Splunk help our IT Analyst and Security Analyst take proactive action before impacting the services which our customer uses. The Event Correlation helps us find RCA and improve MTTD and MTTR.
- Collect data from multiple data sources and correlate. Reduce alert noise from multiple monitoring systems.
- Monitor alerts and report on data collected. Create custom dashboards.
- Powerful machine learning and AiOPS functionality.
- Helps with our security compliance and addresses the security team's need to remain PCI compliant.
- Splunk data sizing and data collected. Worked with Professional Service to scale our environment.
- Capacity data storage for Splunk data.
- TuningSplunk analytics dashboards for performance.
July 19, 2021
Great for almost anything
We use this across our different departments for security, app performance monitoring, host monitoring, data intelligence, correlation, alerting and much more. It's a Swiss Army Knife of IT products.
- The power of it. It's a very good tool that does amazing things. Nothing comes close to it.
- It can ingest any data and present it in a digestible, searchable format.
- Flat file format makes it very fast and the best visualizations I've seen.
- It can be cost prohibitive, but I still think it's worth it.
- Training users is a little bit steeper, but once they have it, it's very powerful.
February 29, 2020
Splunk Enterprise - Log collection & aggregation
Splunk was initially purchased to be our replacement for our syslog server, but it has grown into much much more and this is because of how easy it is to get logs into Splunk and the flexibility of what can be done with those logs.
We are now using it as a security tool, ingesting logs from lots of different sources and even our cloud platforms.
Currently it is just our IT team that use Splunk.
We are now using it as a security tool, ingesting logs from lots of different sources and even our cloud platforms.
Currently it is just our IT team that use Splunk.
- Dashboards/visualisations.
- Can ingest any type of data.
- Flexibility with filtering, etc.
- Steep learning curve.
- Full stack reporting (though with SignalFX being purchased by Splunk, this is clearly a high priority).
- Team needed to manage large installations.
February 29, 2020
Won't you take me to Splunkytown
We're using Splunk Enterprise to assist us with IT Operations and IT Security. We came to look at Splunk because when I entered the company I found over 500 devices with no centralized logging in any way, no ability to pinpoint problems across the whole organization whether historic or predictable and things like this. Splunk is helping us deliver a predictable, robust operation of our infrastructure instead of reacting to problems and working to find just what was affected and when.
We believe we can apply Splunk to other data, in time, specifically aiding the company with analyzing financial information, but this is not yet an active project.
We believe we can apply Splunk to other data, in time, specifically aiding the company with analyzing financial information, but this is not yet an active project.
- Fast, efficient
- Solid community of experts and training materials
- Ingests data from many sources, with a large number of partner relationships
- There is a high learning curve. If you go to a Splunk demo or class, get inspired, then install it yourself, you'll have no idea what you're meant to do. It's not intuitive to the first-time user in any way.
- Pricing can be confusing. People ask how much data you want to ingest, and you don't know until after you've been using Splunk. It's not easy to sign up and start without guesswork.
- I found online help pages are broken or out-of-date, or incomplete. e.g. pages on setting up the Java-based SQL Server driver don't even tell you where to download it or where to install it.
February 26, 2020
Splunk Enterprise: A powerful, but expensive tool
Splunk Enterprise is used as a repository for all our server and network infrastructure logs. This allows us to go to one place to review logs and potentially find a relationship between different systems with specific issues. For example, seeing failed login attempts to our switches and learning that a server was using old credentials.
- Robust collection of plugins to support specific applications
- Relatively easy to use
- Strong and helpful support
- Difficult to master
- Can be very complicated to implement into an environment
- Very expensive
February 20, 2020
Splunk is a single tool that does everything
We use Splunk to integrate all the logs for each of the applications. Building dashboards and alerts base on the logs by the Application team's requirement. The Application team will be able to search through their log from one centralized place rather than logging into multiple servers to try to define the issue manually. With the Splunk search language, it is very easy to look for possible errors within a certain time frame. Our organization also use Splunk for fraud investigation purpose. We have more than 100 application teams using Splunk today and most of them are using it for troubleshooting purposes when there is an issue that has occurred.
- Log mining.
- Able to consume multiple log sources.
- Provides the possibility to upgrade the Splunk UF from a deployment server.
- Splunk search language can be very expensive if the users do not know what they are doing.
January 02, 2019
a very good log handling and analysis tool
Splunk is not used across my organization. It is being used by some of us and for some specific task. And yes, it is also used by other departments as well but according to their need. Specifically, we are using this tool for monitoring the application logs and doing some analysis over it. Splunk provides a very easy way to search your logs and perform some basic analysis.
- Log search is very good with this tool.
- Splunk search query language is just very good. You can easily run some analysis using this language
- Generating reports is a very good feature of this tool.
- Detecting anomalies and reporting them is just fantastic.
- Splunk requires some learning to use all of its features. Understanding its SPL is not very easy, and it will take long enough time to learn it.
- Regular expression is a bit tedious to learn and then use, it needs a good understanding of regular expression.
- I don't know why, but sometimes its search keeps on going forever and then I had to manually kill that job to start it again.
December 14, 2018
Monitor your monitors...
Splunk is used for application logs monitoring and system health checks for production environment and performance environment.
- Best tool to do log monitoring and creating intuitive dashboards and charts
- Best for setting up alerting for application logs
- The tool needs to integrate AI to understand the system logs and alerting should be based on the auto learning.
Splunk Enterprise is used by the organization to primarily analyze data. It looks at data generated by various on-premise systems and provides meaningful insights out of them. Many advanced features like custom reporting are used by business analysts on a regular basis to determine the course of action. Last but not least, it is also used to execute daily support tasks like log analysis.
- Data Analytics
- Reporting
- Indexing search data
- Searching machine-generated data at realtime to forecast trends
- Splunk is expensive.
- To use Splunk effectively, people must learn SPL.
- Splunk is good at what it does, but to create an efficient analytics systems other products like SW monitoring tools need to be used in conjunction.
We use Splunk Enterprise across the entire company to collect log data that allows us to see up/down times of servers and applications. We have customized Splunk a good bit and it is one of the main tools we rely to monitor our server environment and troubleshoot issues when an app/server is down or having errors.
- Monitoring of log data to gauge server status and health
- Dashboards that allows us to view data about servers in our environment
- MOnitoring for fraud/cyber security threats and risks
- We really like the product but there is a steep learning curve and training is definitely required
- Our environment is setup so that you have to be fairly technical to navigate it and get value from it. We need to make our dashboards/reports less technical so the business users get more value from the tool
- Tool is very module driven so you are constantly having to add modules and costs to get new functinality
March 28, 2018
Splunk is a great tool for helping make sense of logs
I'm using Splunk to aggregate logs from various servers and devices within my department. While I don't interact with it daily, or even weekly a lot of times, I do use it heavily when faculty or staff come to me asking when users were logged in, when there are any questionable incidents on websites, etc.
- Log aggregation is extremely well done. Whether sending it logs over Syslog, mounting log directories over NFS, or using their log forwarding service.
- Searching. I'm an amateur at best when searching and aggregating logs. The reporting functionality is amazing.
- I would love some better wizards to help build canned reports based off common data sets.
- An easy way to back out integrating a log that suddenly balloons you over your license limits.
- An easier way to help Splunk parse log types. You can give Splunk any data you have, but unless you're able to tell it how the random log is formatted, your ability to search on it is limited.
September 14, 2017
Splunk for new users
Splunk is being used extensively in our technology department. Many applications use Splunk to monitor business activity, system resources, exceptions/failures, and to overall system status. Splunk addresses more technology-related problems but it does provide the business greater transparency into the applications which in turn gives both the business and the developer's peace of mind.
- SPLUNK has a quick learning curve and can be easily self-taught. For example, there are plenty of resources available such as tutorials and search tools. There is really no prerequisite for learning how to use Splunk.
- SPLUNK Enterprise provides plenty of useful documentation and user support which makes it easy for anyone to learn and start using SPLUNK in a very short period of time. There are also examples and user feedback that is helpful if you need more advanced implementations.
- SPLUNK is very powerful, yet simple. For instance, you can set up a dashboard in one day provided you have admin rights and access to the data you want to Splunk.
- Even though there is a search tool as a help function, you still have to read through many documentation to find the answers you're looking for and sometimes you don't find it. The help function in Splunk could be improved to be more intuitive or have a built-in help per report, panel or dashboard.
- Creating a Splunk dashboard is rather straightforward however, customization is not. Splunk could be improved to provide more tools or features for customization such as adding colors and font options for text and graphs or graphics.
- My dashboard has a lot of useful information and I want the important panels and reports at the top but there is no easy way to do this. Perhaps Splunk could be improved to allow features such as adding URL links to other dashboards or some other clever way to emphasize the important data in my dashboard without compromising space.
Splunk is being used to capture logs from all Windows, Linux, and firewall devices in our enterprise. Currently it is being used by the IT infrastructure department only, but our hope is to make it available to other departments to follow trends in our business. Splunk addresses the issue of visibility into the network. It actually gives IT professionals access to view what is taking place on the network, and it provides something to look at in order to address issues occurring behind the scenes.
- It gathers logs very well from almost all machine types - most SIEM related products don't do this quite as well.
- It provides visuals to the user, giving you the ability to transform logs into visual charts (e.g. pie charts, graphs, tables, etc.).
- Splunk is very quick in reporting and alerting on anomalies. There is little delay.
- Splunk can be very expensive, and it is best to size out your environment first before procuring. Planning is key, and make sure to buy a license that is at least 2-3 times what you think you need.
- There is a learning curve to Splunk. It takes a bit to get up to speed with the application.
- Support is very good, but they will almost never tell you to ways to not use up your license. I had to figure that out myself, and ended up cutting out some useless logs that used over 50 % of my license.
December 11, 2015
Powerful tool with a big learning curve
We are using Splunk to collect relevant security logs and correlate across different data sources to look for abnormal traffic or activity. Other business units such as marketing and engineering are increasingly becoming interested in using Splunk as it offers on the fly access to their data with powerful visualization including charts.
- Easy log collection
- A large library of search commands
- Able to ingest many different log types
- Normalization of data is challenging
- Not all Apps/Add-ons are CIM compatible
- Big learning curve
December 08, 2015
Splunk: Dynamic and Fast compliance tool
Splunk is really useful while analyzing dynamic data. I have been using Splunk for 2 years and I really find it very useful, especially working with bigger datasets. I have used Splunk for my project to analyze and learn different patterns from [my] university dataset. It was really very easy and user friendly to use.
- Scalability. Splunk is really useful when you are dealing with a dynamic and bigger system and you want to make your system scalable.
- Reliable. Very reliable.
- Indexing and speed. Splunk really works very fast, even with bigger datasets.
- Cost! Splunk is a little costly when it comes to economical comparison.
- Speed is sometimes less when inflow of dynamic data is huge.
- Learning curve is there to become master of Splunk.
December 02, 2015
Splunk - the most flexible SIEM tool on the market.
Splunk is currently the SIEM for IT operations and IT security providing log aggregation and security event correlation for multiple departments. The IT operation groups use Splunk to trend operational data, trouble shoot issues, and send automated alerts when certain triggers are met. The security department utilizes Splunk for investigations and event management, leveraging automated alerts and dashboards. For our organization, Splunk provides the "single pane of glass" for users across several IT departments while also serving as our compliance tool for PCI-DSS and SOX.
- Splunk is flexible and extensible, able to ingest logs from disparate systems using disparate formats and disparate file types. If the ability exists to make the logs human readable (either natively or via a script), Splunk can ingest it.
- Splunk's flexibility in how you parse, format, and enhance your data is amazingly deep. When you start event typing, tagging, aliasing, and creating data models, you start to really open up Splunk's capabilities.
- Splunk scales very well in large environments. Adding additional indexers as your environment grows is pretty trivial and its ability to do multi-site clustering and search head clustering provides load balancing and redundancy that's inherent to the product.
- Splunk's search language goes very deep. To do some of the more advanced formatting or statistical analysis, there's a bit of a learning curve. Splunk training for learning the search language and manipulating your data can cost anywhere from $500.00 to $1500.00 (although a good number of free training exists).
- Splunk's dashboard capabilities are pretty decent but to do more exciting visualizations requires a bit of development using simple XML, Java script, and CSS.
- Splunk releases minor revisions very quickly but because of the sheer number of bugs we've run into, we've upgraded our environment four times in nine months.
July 08, 2014
Splunk in the Storage Arena
Score 9 out of 10
Vetted Review
Verified User
We use Splunk to monitor (performance, status, capacity, inventory) all our multi-ventor storage equipment. It is the best tool I've found to be able to monitor/alert on any type of equipment & no other tool is able to do what Splunk does.
- Provide custom dashboards. In our environment, we are prepping for offshore off hours administration & no other tool can provide the exact information we are wanting to monitor in on view.
- It doesnt matter what vendor. We have this tool monitoring Brocade, EMC, Netapp, Isilon & more exactly the way we want to see status.
- We are able to alert on exactly what we want to see.
- The learning curve for the tool is workable.
- I'd like better ability to make alerts look like what we want to see. better able to pass variables into the alert.
- I'd like to see Excel integration with the syntax when creating reports/dashboards. So many times I know what I want but excel syntax doesnt work
- Easier data inputs for syslog & related.
May 16, 2014
Splunk Excells at Business Visibility
Score 10 out of 10
Vetted Review
Verified User
Splunk was used in a variety of log collection activities for Linux and UNIX systems, both in our company and at our customers companies. It allowed for the easy collection of logs, searching, and automated actions resulting from the messages received. The multi-tier architecture was easy to install and operate, as well as provided significant flexibility for our customer implementations.
- Gathering log messages from a multitude of sources.
- Summarizing and gathering important information from those logs.
- Allows simple and advanced searches, as well as complex automations to be created, gathering more value from existing data.
- There is a bit of a learning curve for a multi-tier architecture, but with a little work its easy to understand from the instructional materials provided by Splunk.
- Searches can take a bit to understand, especially regular expressions and search syntax.
- As always, understanding your data is paramount to being able to derive value from it.
May 14, 2014
Splunk: a review
Score 8 out of 10
Vetted Review
Verified User
Splunk is used across our entire organization as a centralized location for all of the various data elements that we use to track performance of our internal systems and client facing interactions.
- Splunk is great at quickly finding the insights you need to start an analysis
- Once you understand the query syntax, Splunk is very easy to use.
- Great alert monitoring.
- Splunk lacks the ability to create professional looking customer facing reports.
- Steep learning curve.
- Large queries are slower than a more traditional DB.