My Dive into using Splunk
Anonymous | TrustRadius Reviewer
December 01, 2017

My Dive into using Splunk

Score 8 out of 10
Vetted Review
Verified User
Review Source

Overall Satisfaction with Splunk Enterprise

Splunk is being used across our whole organization. We try to have all/most of our logs get pulled into splunk to be able to use the splunk UI to search across information. We are able to give employees access to splunk and allow them to diagnose issues without giving them explicit access to production servers or other production locations.
  • Allow for separation of control where we don't let some employees have access to production but still can diagnose issues.
  • Common location to go for all logs even if the logs themselves aren't in the same place.
  • Ability to ingest logs from different locations without having to change the code to put logs in a certain place (pro and con).
  • At times some queries can run slowly if indices are not on a portion of the query you use.
  • Setup time initially can be difficult if your logs aren't stored in common locations or in a common way to write the log.
  • Ability to ingest logs from different locations without having to change code to put logs in a certain place (pro and con).
  • Searches can be a bit more difficult to look through if your log isn't pulled in a manner that is easy to read through splunk.
  • Splunk has allowed developers to diagnose production issues when access of control was taken away from them to be allowed to view items in production environments and I believe that is invaluable.
  • At times some developers weren't super happy about using it, but it was more of the fact that they were used to having production access and not creating their splunk queries to get information.
  • Going one place to view logs was very beneficial to have.
I didn't get to fully evaluate Logstash as our corporation was already using Logstash, but both seemed like viable solutions to the problem that we were having. I wanted to evaluate Logstash some more, both did seem like they would work for the business needs that we had, we went with splunk as many teams were already using it.
Scenarios, where Splunk is well suited, would be a larger organization where multiple teams have their own logs and a web ops team is trying to come in and get a central location to be able to ingest and report on those logs

Scenarios, where Splunk wouldn't be as well suited, would be a small org where all their logs are in one place, easy to find and report on.

Splunk Enterprise Feature Ratings

Centralized event and log data collection
9
Correlation
6
Event and log normalization
9
Deployment flexibility
Not Rated
Integration with Identity and Access Management Tools
7
Custom dashboards and views
8
Host and network-based intrusion detection
Not Rated