The use cases for Splunk continue to grow. I leverage it in the sales cycle and to demo security. That is only the tip of the iceberg for this product. If I had more time, I would experiment wiith many other use cases and become more proficient at the coding.
It solves my problems in this space rapidly, easily, and efficiently. It helps me get to the real problem and solve it without getting caught up in a large software installation (it doesn't become the problem).
Again the reason is price. It would not be justifiable for us to get a license to cover all our logs. Filtering out logs to avoid license costs or using alternate applications for less important logs doesn't make sense.
It's apparent that our business has so profoundly changed that it cannot be without Splunk unless a better product comes along or we have reached a dead-end on things we wanted to do but that Splunk cannot provide.
We are using Splunk extensively in our projects and we have recently upgraded to Splunk version 6.0 which is quite efficient and giving expected results. We keep track of updates and new features Splunk introduces periodically and try to introduce those features in our day to day activities for improvement in our reporting system and other tasks.
I'm not the final decision maker, but I think Splunk is excellent at what it does well (monitor operational performance). As a reporting tool, it is not ideal. It's great at being able to put together ad-hoc searches and look at different slices of the data but not at creating automated client-facing reports.
It's useful everyday and it's clearly like having binoculars on our logs. We could make our own grep++ but Splunk already does it nicely. So why would we waste our time to code something that's already done nicely?
Integration with Identity and Access Management Tools (40)
Custom dashboards and views (45)
Host and network-based intrusion detection (28)
About Splunk Enterprise
Splunk is software for searching, monitoring, and analyzing machine-generated big data, via a web-style interface. It captures, indexes and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards and visualizations.