Splunk Enterprise

Perfect solution to handle big data

Pros:

I love its versatility to handle different kinds of data. While monitoring our internal data, Splunk Enterprise saved a lot of code with its real-time data monitoring and logs analysis feature.

Cons:

With the growth of the data, costs grew intensively which was out of the budget for our startup company. Initially setting up Splunk was complex as we were new to this.

Great SIEM

Pros:

Incredibly powerful tool for log collection. It is very scalable and can be integrated with a wide variety of other tools and platforms. It is well-documented and supported by a large user community, making it easier to find solutions to common challenges.

Cons:

It feels somewhat dated compared to newer solutions on the market. Its interface and some functionalities haven't evolved as much as other modern tools. It can also be quite expensive.

Powerful tool to perform db queries

Comments: I used Splunk to surface and review platform logs

Pros:

Possibility to export query results in a variety of formats.

Cons:

User interface is not intuitive and it requires a steep learning curve

nice tool with functionality for everyone

Comments: very good tool to see your logging and get alerts when something is wrong.

Pros:

Splunk is easy to use, also non technical persons can also use and create their dashboards. Easy to implement and very easy to use the query language, the documentation is also sufficient

Cons:

We cannot setup the alerts for realtime. we only us it for logging and not for metrics. the maintenance of the dashboards are very time offering.

Splunk is a great data management tool

Comments: I use it daily to locate information on users and devices.

Pros:

The ability to parse data and locate critical information is unparalleled

Cons:

Search tools could be a little more user friendly.

Splunk, a must try for all data management persons

Pros:

1. Excellent ML background 2. Dashboard looks classy 3. Multiple external entries possible unlike a lot other tools

Cons:

1. Very limited variations in reporting 2. Real-time model is not great 3. Not mobile friendly

Platform that generates very good reports and data extraction

Pros:

Produces analytical information with highly interactive tables, charts and graphics. Highly customizable to obtain specific data.

Cons:

It can be complex at first to customize search queries since Slpunk handles its own terms and typing methods.

Bettering Cybersecurity With Splunk Enterprise

Pros:

It has amazing firewall protection features It makes handling security monitoring and improving networks security easy log monitoring is easy

Cons:

No regrets as Splunk Enterprise meets needs.

Splunk is a solution

Pros:

It so easy to use and it is very smart and fast.

Cons:

They want to take it to the cloud, maybe is good maybe not

I use Splunk Enterprise to analyze and visualize data for better decision-making.

Pros:

Splunk Enterprise has powerful search capabilities and customizable dashboards.

Cons:

The learning curve for setting up queries can be steep, and the pricing can be high for smaller teams.

Best Siem solution in market.

Comments: Overall experience is amazing, we are happy with this software as it can ingest any form of data and generate alerts quite swiftly.

Pros:

Easy to install agents on servers, it can parse any form of data easily, Splunk can detect anomalies quite easily and the UBEA feature is amazing.

Cons:

The cost of this solution is high, and customer service is bad. Apart from that Splunk SPL language is difficult to learn.

Alternatives Considered: ArcSight

Reasons for Switching to Splunk Enterprise: Cause its to implement as compared to other siems.

A better business companion when integrated with RPA

Comments: Overall, the experience was positive; even with a free trial license, it was much easier, and on the course and certification side, Splunk has a very good collection of videos and materials that help even a novice quickly setup the integration and indexing.

Pros:

The most useful thing about Splunk is the ease of integration with application. With uipath on-premises it was very much helpful as the business users can monitor the actions of robots through spluink without entering into uipath orchestrator

Cons:

Expression creation for indexing was bit hard as it is not user-friendly to business users if they wanted to create any new fields, also the forwarder was not able to directly connect with uipath cloud so that the logs has to be shifted to intermediate file before uploading into splunk, but that seems not an issue with splunk but more related to uipath cloud

Alternatives Considered: Microsoft Power BI

Reasons for Switching to Splunk Enterprise: Splunk was much cheaper than power bi and only little effort needed for implantation and the resources cost is also higher for power bi

Splunk Enterprise, not just a SIEM

Comments: We have been using Splunk Enterprise, ES, ITSI, and other Splunk parts for 6+ years in production. This has helped us reduce staff in some cases, increase response time in most cases, and allow non-IT teams to get data and metrics in a fast efficient way.

Pros:

The versatility is amazing. The same data in logs, such as IIS, can be used for Security, Application performance, and even error handling. This allows us to use one log to help multiple teams. This is just one example.

Cons:

Start up takes someone who has had some training. While searching and output is easy, its the onboarding of custom apps that takes the know how.

Alternatives Considered: LogRhythm Log Management and Sumo Logic

Reasons for Switching to Splunk Enterprise: Versatility with custom applications we create in house.

Great Choice for an SIEM

Pros:

Provides a single location for collecting and analyzing logs. Provides ease of use for non-technical users, but powerful features for security and IT. There is an add-on/app for anything you could imagine.

Cons:

Some documentation is vague, and when certain things don't work, it can be difficult to find out a solution to the problem.

Alternatives Considered: Sumo Logic

Reasons for Switching to Splunk Enterprise: We needed a product that we could host ourselves.

Splunk is a great solution for SIEM and also for monitoring your infrastructure

Comments: We needed a way to monitor our internal environment and start to be more proactive with issues, so we started sending all of our logs to Splunk and we we able to get insights we did not know we needed. It is a great solution and they are constantly innovating.

Pros:

Splunk makes it easy to search through various data including logs. In the past I have had to pour through logs in order to find the one lines among the 100 of thousands of lines. Splunk allows me to search through those logs in a matter of seconds vs the hours it used to take.

Cons:

Most of enterprise setup is done through the command line. It would be nice to have cluster configuration (index creation) as part of the UI.

Alternatives Considered: Elastic Stack

Reasons for Switching to Splunk Enterprise: Spelunking was simple to setup and the customer service is great. It performed very well and proved to be a valuable assets to run in Production.

Swiss Knife for everything about logs

Pros:

The product has a ton of Features. Everything what you Need when working with logs is already implemented

Cons:

Due to the rich set of capabilities regarding, searching, transforming and vizualzing data it‘s sometimes quite tricky to find all necessary query commands

Splunk Enterprise is a powerful data analytics software

Comments: I believe getting important data analysis in real-time saves us from threats

Pros:

Splunk Enterprise offers real-time data analysis tools makes it possible for my institution to see and take immediate action against security risks, performance difficulties, and other operational concerns.

Cons:

Splunk Enterprise is really expensive and it is a huge part in our annual budget because we require add-ons.

Powerhouse in data management and analysis

Comments: A complex but rewarding journey of data exploration and anomaly detection.

Pros:

Powerful and versatile data mining tool with excellent integration capabilities.

Cons:

Challenging initial setup and learning curve, particularly with query language and high cost.

Splunk Enterprise software review

Comments: It is great at working with big data coming from different data sets and sources

Pros:

I am able to quickly act on pending issues as and when they arise and data is well protected because of their authorization features

Cons:

We had to purchase additional computers with higher specs than what we previously had to be able to use Splunk effectively

Best log monitoring

Pros:

While Microsoft didnt provide a centralized log monitoring for enterprise machines, Splunk filled the gap. It is good one stop console to monitor logs on your every server.

Cons:

Reports can be more user friendly and descriptive.

Splunk the best analytic tool

Comments: It gives best Return on Investment as analyzing the data and giving proper insights in form of Dashboards and notifying with help of Alerts if any kind of threat running in infrastructure and apart from that Deployment and use is very easy.

Pros:

There are lot of features which Splunk offers - 1) We can onboard data from any server, device or system using Universal Forwarder 2) Onboarded data are later stored in Indexers and searched further in Search Head for analyzing the internal logs 3) Using the data we can create customizable Dashboards and get proper insights of data and create Alerts to identify any kind of Threat or anomalies running in environment 4) Deployment is very easy on-prem servers 5) We can also use Hybrid Deployment on Cloud as well.

Cons:

1) As it give large amount of features but licensing is too high 2) There are lot of other Open Source software which can be used as alternative of Splunk as Analytic tool because Splunk is paid one.

Splunk an Enterprise Business intelligent user tool

Comments: Is a robust and intelligent management tool that enables everyone with user computer knowledge to navigate in real-time, consolidate vast data into a visualized report of dashboard features , reliable and web based, no major equipment required for setup, user need a smartphone or compute to access the platform through the web, you can navigate the system as long as you have computer knowledge without any training required(user friendly) .

Pros:

It an intelligent business tool that provided me an opportunity to customize and build report from large volume of data from different departments within the 13 Africa countries in telecommunication sectors. The platform allows data to be consolidated accordingly to the organization need and produces visualized reports of dashboard features. I also noted that the system can analyst unstructured large volume of data speedily and is reliable and web based allowing for user flexible accessible from any part of the world if you have internet. The systems have been reliable and secured from the time (2 years) I started using it without any system intermittent, system errors and cyber-attack.

Cons:

The system is built and use-able with structured and unstructured organization though the price in foreign currency could hamper small and medium organization to use it especially in most Africa country where the local currency has depreciated against the major trading foreign currency.so the Forex pricing is a challenge. The navigation of the platform will require minor training though if the user is computer proficient, they would management with minor challenge and interpretation of the data. So, first time user it can be difficult to use it It will depend on internet for access and internet tend to be pricey in most African country and therefore could increase the business cost for small and medium enterprise. It can increase business cost if not fully used

Robust Solution for Enhancing Security and Resilience

Comments: Monitor endpoints to detect and remediate cyber threats in real-time.

Pros:

Block security threats on endpoints. It enhances applications development.

Cons:

The price is high but the results are remarkable.

Manipulate You Data

Comments: Splunk is widely used for manipulation of data and we encounter the use of this tool almostl twice a week. Even though it costs much more but still we have not found any alternative that is able to offer all these functionalities.

Pros:

Splunk is very easy to use due to high community support and many video tutorials available online for new users to learn. Functionalities are robust and simple to use. Data retrieval and visualisation is nice and easy if you know the right querying process. Machine Learning supports enhances performance for the cloud, especially. It collect wide variety of data and still it amaze you the way it retrievs it.

Cons:

There are many tools available in market which are potential competitors of this tool and that too at reasonable pricing. Splunk offers more functionalities but costs you too much if you look at the work it does. Complex queries may require large CPU usage and may even freeze or atleast slow down the system for a while. Need to be specific while querying the data.

Best tool for Distributed logs data analysis

Comments: We have several micro-services deployed in production which require to lookup application access as well as server logs and analyze data for their usage. We created several reports/charts for visualization. We use splunk as security logs tool to see the firewall traffic, tracing any vulnerable access, any database related crash ..etc.
It helps easily to find issue and fixed quickly by black listed in system.

Pros:

Splunk Enterprise is best tool to analyze the data based on different visualization. It help us to lookup distributed logs for micro-services . It enables field based lookup. For complex logging, we can use search query using expression. We can create multiple reports/charts for visualization such as a pie or bar chart for our data. Best feature what i like , We can visualize our search results and share them with others using dashboard panels. If Already have a dashboard, we can add a new panel from a report, clone from another dashboard, or add a prebuilt panel. Fully customization available. Interfaces is very flexible. We export it in different formats, or refresh it to visualize the newest data. Online Support is available through different community.

Cons:

Search query builder is fully based on technical. for Non technical users, its really difficult to lookup logs. Sometimes, error thrown by query builder is more difficult to understand. Deep Learning is required to use splunk for production data. For Large application installation, it need to manage more.