Splunk Enterprise

Splunk Enterprise Platform is used for creation of dashboards and monitoring of numerous use cases that could be specific to certain products. These segregated use cases are distributed across different teams, but primarily focus on security, log monitoring, and correlation. I use it to understand end-to-end information about a service and track the number of incidents. I have observed many use cases for Splunk Enterprise Platform, but for security, I have extensively used it for endpoint monitoring, incident response, incident tracking, ServiceNow tracking, and many other functions.

For a specific security scenario, I have used Splunk Enterprise Platform for email injection monitoring. I collect all logs related to whatever emails are going through and whatever activity users are doing over email, and I create correlation rules to identify gray listing or spam emails. In this case, I use Splunk Enterprise Platform extensively to monitor email activity from our email gateway or email tools. Endpoint telemetry is very crucial, and I ingest all logs and create dashboards. I use Splunk Enterprise Platform to identify which users or endpoints are deviating from standards or which endpoints have users not behaving according to our policy. This includes identifying users clicking links or downloading blocked items, as well as identifying endpoints that have older versions of specific software or endpoint solutions. I also use this for monitoring internal applications, which include specific applications for threat intelligence and user behavior monitoring.

I have enabled many correlations in Splunk Enterprise Platform that are worth mentioning. At times, there is a breakage from firewall, proxy logs, and endpoint logs. Over the last five to six years, I have been working toward achieving many correlations. For instance, if somebody is hitting from an external IP and I am getting many failed login attempts, I try to correlate that. I ingest a lot of Azure telemetry and cloud logs into Splunk Enterprise Platform, and I correlate any kind of notable threat intelligence feeds with the logs ingested to identify observables that can assist our threat intelligence team.

Many use cases, such as user behavior analysis, were not being monitored via a dashboard previously, which created a missing link in our incidents. Once I created analytics for user behavior and ingested telemetry from endpoints, proxies, and firewalls into Splunk Enterprise Platform, I gained many customizable outputs that strengthened our enterprise security posture. This significantly helped me reduce investigation time, which made our threat hunting and SOC teams more efficient. Additionally, day-to-day operational tasks, governance, and compliance activities operate smoothly since I started using Splunk Enterprise Platform for all these use cases.

I tracked compliance metrics and noticed that I was dealing with a lot of technical debt. After implementing Splunk Enterprise Platform and creating dashboards around the servers and technology I was using, I discovered that I had many obsolete or vulnerable products. The compliance dashboard helped me conduct a gap analysis and gradually bridge that gap, mitigating the findings. Over time, my compliance dashboard became greener, which is the desired state for a security-focused organization.

Another aspect is that endpoints play a crucial role in incident response or investigation, as many incidents stemmed from user actions. I established logs for user activities and created dashboards to visualize these incidents, leading to a significant reduction in user-centric incidents over six to eight months. I found that email and endpoint attacks were our main vectors, and after setting up dashboards around user email behavior, our security response improved drastically over time.

Splunk Enterprise Platform offers many features centered around creation of easy queries, requiring less learning curve compared to other counterparts. At times, what eases my work is the fast querying capability. It has excellent log collection and data ingestion that helps me create very granular, customizable dashboards, assisting my security team for monitoring and threat detection. Specifically for large enterprises, Splunk Enterprise Platform caters to the kind of scalability that I need because I am not centered around small deployments. I have many logs to ingest, and I need a lot of storage, indexing, and clustering, all of which this product supports.

It also has integration with other ecosystems like ServiceNow, Jira, and firewalls, with support for hybrid and multi-cloud environments. Real-time monitoring and alerting provide me visibility for security events or operational issues. Additionally, it has flexible deployment options, such as on-premises, private cloud, or even in isolated air-gapped environments. Splunk Enterprise Platform has matured enough because of the large community, extensive documentation, and strong ecosystem that assist me in deploying it effectively.

I find querying output quickly to be one of the most valuable features. When I write a customizable query, I need low-latency output as it assists me in my investigations. The second thing that appeals to me is the extensive integration capabilities. It integrates with a wide range of security, cloud, and endpoint application platforms. This large ecosystem simplifies data onboarding and ingestion. These are a few of the strongest aspects of Splunk Enterprise Platform, and because of its flexible search capabilities and extensive integration ecosystem, I find many use cases centered around using this product and deriving value from it.

Feature-wise, I often need many customizable queries from the data I already have, which is crucial in threat hunting scenarios. I can customize and structure the data for my investigations and operational troubleshooting. A lot of structuring and filtering is created by Splunk Enterprise Platform search processing language, which I refer to as SPL. I have also used KQL, and based on my work experience, I find it easier to work with Splunk Enterprise Platform than to struggle with other query language platforms, which add complexity to my investigations and operations.

The output accuracy and reliability of Splunk Enterprise Platform greatly depend on prompts, but I find it to be fairly accurate. Splunk Enterprise Platform provides capabilities to search and optimize queries effectively, aiding analysts to identify relevant data sources, execute searches, and summarize findings. This reduces investigation times and lowers the learning curve for new users. The AI capabilities offer natural language to SPL conversion, helping my SOC team perform AI-assisted threat hunting, optimize SPL, and conduct automated search analyses with some agent-based workflows that enable faster insights.

Splunk Federated Search allows me to search data residing in remote Splunk Enterprise Platform deployments or external repositories without needing to ingest all that data locally. The benefits include cost optimization, unified visibility, and the capability for cross-environment investigations. It also reduces data duplication since searching without complete ingestion avoids redundant copies. However, the limitations include the complexity of configuration due to trust relationships, permissions, and governance, which consume time. Troubleshooting can also be more challenging compared to a single Splunk Enterprise Platform deployment.

Maintaining granular control over data using the trusted control plane within Splunk Enterprise Platform ensures specific access and provides a centralized governance layer that secures communication, policy enforcement, and authentication. The benefits derived from the trusted control plane include consistent authentication and authorization controls, helping me meet compliance requirements and operational security standards, particularly in hybrid and multi-cloud deployments.

There is a lot of scope for improvement. One issue I often encounter is unpredictability of costs as telemetry volume grows. I find it hard to identify pricing and renewal costs, which is a key concern for me. I need features to assist me in making my usage of Splunk Enterprise Platform more efficient so I do not exceed cost thresholds. Additionally, when I have heavy workloads, I experience performance degradation; during high concurrency, CPU or compute becomes a bottleneck. I need solutions to optimize resource use effectively and guide me in scaling my workloads to prevent performance degradation. Integration struggles arise with several connectors that do not function as expected, needing more specialization and learning curves. I also want support for capacity planning to identify current and future needs, and I desire AI tools to assist in creating user-friendly dashboard experiences.

Documentation often feels generic and not tailored to my needs, which is an area needing improvement. AI assistance that can cater to my specific needs or scenarios would be beneficial. Regarding support, I sometimes struggle to identify the right person to assist me, particularly during integrations and with outputs. I have encountered situations where many concurrent sessions were unresponsive, leading to slower query mechanisms. While most interactions with Splunk Enterprise Platform support yield prompt and professional assistance, it varies depending on the engineer.

Regarding the AI capabilities of Splunk Enterprise Platform, I perform extensive investigations and understand that I am ingesting a lot of logs without clarity on the exact guardrails available. Governance is a concern as I must establish a proper governance layer before AI agents can use my information to assist me. While AI-powered search analysis has assisted me, transparency in guardrails is essential, especially in data masking to prevent the unintended exposure of sensitive information.

My association with this product spans seven to eight years.

Splunk Enterprise Platform is stable. It is a mature platform that offers streamlined log management, threat detection, security monitoring, investigation, and incident response capabilities. When conducting SPL-based analysis, I experience stable and fast search performance, even in AI-assisted investigations, which effectively correlate security events across endpoints and networks.

Splunk Enterprise Platform demonstrates robust scalability. When scaling, I utilized indexer clustering and deployed multiple components to enhance scalability. It scales horizontally effectively by adding dedicated components such as search heads, indexers, and forwarders. My data ingestion volume meets scalability needs, and Splunk Enterprise Platform provides workload management capabilities that facilitate resource allocation according to search and ingestion needs, maintaining performance while demand grows.

Customer support has struggled at times when accessing the right engineer, leading to instances where issues were not appropriately addressed. Despite this, most interactions yield competent support; the team's capability is evident. It is challenging when engineers lack familiarity with my environment and struggle to provide timely input.

In my previous company, I was using a solution that was costly and lacked flexibility and scalability.

Splunk Enterprise Platform's return on investment is largely reflected in my improved security posture. Many times, I considered hiring external managed service providers to handle logs and provide real-time investigations or correlations. Instead, with Splunk Enterprise Platform, I manage these processes in-house, saving costs and significantly enhancing my capabilities in incident response and threat hunting, expanding visibility into actionable data.

Without Splunk Enterprise Platform, hiring an external provider would have been more expensive, but I have built a more robust in-house team with various levels of engineers who can gather detailed insights for different operational needs.

While I use various external vendors to optimize cost in Splunk Enterprise Platform usage, the context of non-indexing demonstrates that SPL investigation adds value beyond merely storing and correlating data. I also engage external tools to minimize operational costs associated with Splunk Enterprise Platform.

Pricing, setup costs, and licensing remain areas of concern as I ingest large volumes of telemetry or data. I seek optimization around pricing scalability as I utilize significant public cloud storage. The amounts of ingested data lead to cost concerns, and I strive to determine strategies for reducing pricing while identifying logs that do not need ingestion. This remains a challenge as I explore efficient usage of Splunk Enterprise Platform.

Before choosing Splunk Enterprise Platform, many options were evaluated, as primarily open-source tools providing similar capabilities were assessed.

I rate Splunk Enterprise Platform a seven out of ten because I am happy with the value that it has delivered. However, there is always room for improvement. Cost is a major factor, and performance degradation hinders me from considering it as a more scalable option. Despite these concerns, Splunk Enterprise Platform delivers what my security team needs and provides value in compliance, incident response, and threat hunting.

Splunk Enterprise Platform is deployed in a hybrid model; I host some workloads in the cloud and have a few instances on-premises. I utilize AWS and Azure as my cloud providers for hybrid deployment.

My impression of Splunk Enterprise Platform's capability to manage data sovereignty at a petabyte scale centers around privacy considerations. I have a limited security context, understanding the metadata and user usage information available for AI features and the associated guardrails. Regarding data sovereignty in cloud workloads, it can be customizable to certain regions, but all indexing must comply with data privacy standards, which my oversight teams monitor closely.

My advice for others considering Splunk Enterprise Platform is to utilize professional services upfront. Planning your workload, setup, and capacity for two to three years is crucial for effective scaling and indexing. It is also vital to educate end-users on utilizing Splunk Enterprise Platform efficiently to avoid inefficiencies that can slow down capabilities.

The main use case for Splunk Enterprise Platform is collecting logs from across the enterprise and ingesting them so that we can use them to easily search and also for alerting if there are problems with all the different applications and pieces of software that we have installed here.

A simple example of how I use Splunk Enterprise Platform for alerting or searching is if we have a Linux server that is running out of memory. We have the Linux logs in Splunk and then we have an alert set up that if the memory gets below a certain threshold, then it creates a ticket for our team to address it. If the memory gets so low that it is a critical issue, then we get paged that it is an urgent issue we need to take care of.

Splunk Enterprise Platform is very user-friendly, and our users love the ability to use the search interface, which helps determine issues when you know something is happening, but you do not know where it is happening in all of our various items that exist, all the systems that produce logging data.

For our use case, the absolute best feature of Splunk Enterprise Platform is that you can get data into Splunk Enterprise Platform from anywhere, and that is really useful because there are just so many different sources.

We are primarily using Universal Forwarders, but we also use HEC forwarders and heavy forwarders to integrate different data sources.

Our users definitely love the ability to create their own dashboards in Splunk Enterprise Platform so that they can monitor the applications that they are involved in, making that a popular feature.

Splunk Enterprise Platform has made it a lot faster to find problems. This is very much Splunk Enterprise Platform's core functionality where instead of having to go and SSH into different servers and look at log files on each one, which can take a lot of time, you are able to search via the GUI and pull up logs across all of the applications being monitored.

I think making the user interface easier to navigate for users is important for improving Splunk Enterprise Platform. It may be that SPL2 takes care of some of this. I have not used that yet, but I know using just SPL, it takes quite a training for users to learn how to search Splunk Enterprise Platform most effectively.

I come from using Atlassian products a lot, and I found their documentation to be a lot easier to use, so I think Splunk Enterprise Platform could benefit from a lot more documentation out there. When I Google for an issue in Splunk Enterprise Platform, it is maybe 50-50 on whether I will pull back the information I need. It seems like I have to open a support request often with them.

I have been using Splunk Enterprise Platform for about 10 years.

Splunk Enterprise Platform is stable, but it could be better.

The scalability of Splunk Enterprise Platform is pretty good, as we have not had significant issues with scaling it.

The customer support for Splunk Enterprise Platform could be better in that the support agents could be more knowledgeable. It takes a lot of communication to get them on board usually with what we are experiencing.

It was fairly easy to do, and I appreciate the opportunity to provide feedback regarding my experience with Splunk Enterprise Platform.

I believe that Splunk Enterprise Platform is expensive, but that is about all I know regarding pricing, setup cost, and licensing.

I know we evaluated options before choosing Splunk Enterprise Platform, but it has been several years ago and I was not involved in that process, so I do not know what the other options were.

I would advise others looking into using Splunk Enterprise Platform to carefully evaluate if there is any less expensive option out there at this time that would do enough of what Splunk Enterprise Platform provides, as it is a very expensive product. I would rate my overall experience with Splunk Enterprise Platform an 8.

I am an admin for Splunk Enterprise Platform, so I mostly help other teams use it and enable it. I enable other teams to use dashboards or onboarding different apps and such.

More recently, we had an onboarding or ingestion of some extra data and as a POC for the HashiCorp app. It was a little challenging because we had to work around some of the different file types and they wanted them coming from specific locations to specific servers. That was a fun thing to do.

Splunk Enterprise Platform offers great observability into all my apps, as well as being able to use the GUI to edit different things and be able to provide the best experience for our internal teams so that way we can provide the best experience for our customers.

The overall visibility of Splunk Enterprise Platform is great, but I do really appreciate being able to do specific searches for different teams if they're missing data or if they need extra data in, as well as looking at dashboards and enabling those teams to have the most efficient and productive time.

I think it handles large data very well. It seems to regulate and maintain itself very well. It corrects itself back on course to resolve those errors.

I am pretty new to the product, so I haven't really found anything specific. I would really appreciate being able to see who edited certain dashboards or alerts. I think that would be really helpful in the future.

I have been using Splunk Enterprise Platform for about eight months.

It has been reliable.

It seems to scale very well, and we have never had issues with licensing or pushing up that license usage.

I have interacted with Splunk support and we have weekly or biweekly meetings with them. It has been great to be able to talk through some of the issues that we have, along with getting some links or putting in a support ticket.

I would say look into how you would use Splunk Enterprise Platform and maybe compare other options as well. Also, I have always had a really good experience with Splunk and onboarding has been pretty easy, as well as it being super scalable, allowing you to have great observability. It is really good at self-regulating. Any issues or errors, for example a slowed queue or suddenly ingesting a lot of data, it is really good at regulating itself. I think that is great. I would rate this product a 9 out of 10.