Splunk Cloud

Splunk Cloud Platform  is used to monitor everything, as we have multiple applications from which we get multiple data and multiple logs. We centralized our logging system, centralized our APIs, and everything into it. If any APIs fail, we created multiple alerts over there. We use it for that purpose.

The best features of Splunk Cloud Platform  are the ecosystem that has been created. We do not have to worry about many small things or many big things because the cloud gives infrastructure that is handled on their end. That makes it very easy for us to get used to it. The main beneficial case for us is the dashboards, alerts, stability, cloud scalability, and everything.

The search capability is pretty good because we have been using it for the last one year and it works very smoothly. The search functionality works very smoothly with us. Recently, we faced one issue, and with this feature, we got to know from which end this problem occurred. We directly dived into it and solved that thing. It is useful.

The alerting mechanisms work very proactively because that is the main use case of Splunk Cloud Platform. One of our application APIs got shut down because of some random issue or error. Because of the alert message, during our peak time, we got to know something was wrong. We directly fixed it and the rest of the things worked easily.

The ingestion and visualization feature of Splunk Cloud Platform is very good. It helps us a lot to create multiple reports and multiple dashboards because visualization can help us create multiple things into it.

Splunk Cloud Platform is almost a nine out of ten, but the main improvement point is the user manual. Recently, we got stuck somewhere in an error, but because of the less documentation available in ChatGPT or in any LLM, we had to go through every documentation and then we got the result. If Splunk can provide some LLM or any AI tool for error solving, it would be better.

The deployment of Splunk Cloud Platform is easier. If we get a better user manual, it can be even easier, but it is quite easy.

We have been using Splunk Cloud Platform for almost one year.

Per our use case, Splunk Cloud Platform is very stable because we use multiple platforms. Even in high volume and high traffic, it works very stably.

Splunk Cloud Platform is more scalable and a very scalable thing. We used it in high volume during peak hours of our traffic, and it runs smoothly.

The technical support is pretty good. Whenever we get stuck, we have used it two or three times, and it is pretty good.

Splunk Cloud Platform is compared to other solutions because previously we were using DataDog for the same thing. The ecosystem provided by Splunk, the support they provide, better dashboards, better alerts, and everything is why we moved to Splunk Cloud Platform.

It took almost one hour to deploy Splunk Cloud Platform, or one or two hours.

In our organization, three people use Splunk Cloud Platform.

Using Splunk Cloud Platform saves us time because previously we took two to three hours troubleshooting any problem, but now we get to know which particular area of the API is throwing an error and everything. Almost one and a half hours, or almost two hours, are reduced by using Splunk Cloud Platform.

The pricing did not come under me, it is from the management department. We think it is more reliable to move with it, which is why we shifted from DataDog to Splunk Cloud Platform.

Splunk Cloud Platform rates as a nine out of ten, or 9.5.

We are a customer in our relationship with the vendor.

We have not used the machine learning tools yet.

The integration with third-party applications is pretty good. We have integrated our mail application into Splunk Cloud Platform. Whenever the alert comes, we get to know and we can work on it 24/7.

We highly recommend Splunk Cloud Platform. If you are working with any data or any APIs from any logging system, or any log you have to track, Splunk Cloud Platform is a very good platform to work with. The overall review rating is 9 out of 10.

We use both Splunk Cloud Platform  and Splunk Enterprise Security . We operate as an MSP and are also a customer for the on-premise solution. We use Splunk Cloud Platform  for monitoring purposes, and we use Enterprise Security for the incident monitoring tool, which is a premium solution for both Splunk on-premise and Splunk Cloud.

The best features of Splunk Cloud Platform are that you do not have to manage anything and do not have to worry about anything. It is scalable, easy to use, and reliable.

Regarding the machine learning tools in Splunk Cloud Platform, machine learning is great, but it requires specially trained people who understand it and have already worked with machine learning, making it challenging for those who do not have that expertise.

The price of Splunk Cloud Platform is very high, but you get all the advantages when you do not overpay for that. Some customers choose cheaper vendors, but for me, it is a perfect solution with many integrations, ready-to-go rules, and dashboards. It is feature-based.

Regarding the ingestion and visualization features in Splunk Cloud Platform, any device or system that can produce logs can be ingested into Splunk. There is no problem with many different possibilities to ingest the logs, making it a really great tool. Regarding the dashboards, there are also many possibilities to create them. If you know XML, you can write directly in XML and have your own custom dashboards, or you can do it via templates. These are great features.

One area that has room for improvement in Splunk Cloud Platform is support. The support knowledge base is the primary concern for me because we had several cases working with support teams, and they could not resolve our problem.

I have been using Splunk Cloud Platform for about three years.

I rate the stability of Splunk Cloud Platform as ten plus.

I also rate the scalability of Splunk Cloud Platform as ten.

I would rate support for Splunk Cloud Platform about six out of ten.

When assessing the effectiveness of the search capabilities in Splunk Cloud Platform, I notice that searches are slow, which is the main disadvantage of Splunk, but the rest is really great and the most mature. The alerting mechanisms in Splunk Cloud Platform are configured as well as possible, so you can get all the information that you need. They are really great.

As a certified Splunk Architect, I consider Splunk the best solution when comparing it with competitors including Elastic, Sumo Logic, Datadog , and Microsoft.

Regarding integration with third-party tools, Splunk provides federated searches, allowing you to search data even without integrating Splunk with other features such as AWS  or data lakes. This is separate pricing, but it is still possible and works really well. However, the downside is that you need to buy additional SOAR  if you want to automate certain things such as blocking an IP or user or removing a user or revoking their session.

Approximately thirty to forty people work with Splunk Cloud Platform.

Splunk Cloud Platform is hosted on Splunk Cloud, though this is a tricky question since we also have on-premise Splunk installed in the cloud of client infrastructure. I am discussing only Splunk Cloud Platform here.

My advice for Splunk is that it is the best SIEM  solution for me. Based on your needs, you will need a POC. It is good enough for small, medium, or enterprise clients, but you will also need to invest in people who need to learn how to write searches and work with the solution because it is not easy. If you have appropriate people, it will be worth its cost. The learning curve for Splunk Cloud Platform depends on which level you want to achieve, but the downside is that most of their really good trainings are not free, so you will need to invest in learning. I give this review an overall rating of ten.

I am a product developer who develops certain products in the insurance domain. We mostly use Splunk Cloud Platform  for checking the logs. Whenever a check goes missing or a status is not correct, we generally check the logs first. Splunk Cloud Platform  helps us to identify where the error is. We can search with various factors, and giving a proper prompt is important as it saves us a lot of time.

Recently, one of our branch networks where all the checks get stored had an issue. They had done IP whitelisting, and some of the IP addresses were not included in that IP whitelisting. This caused a global outage and all the claims or checks that were getting processed failed. When we tried to check through the logs, we found out that this issue was the cause. We had to reach out to another team that manages the environment which caused this IP whitelisting, the middleware. When we contacted them, they reverted most of the changes and we generated new payloads. Splunk Cloud Platform helped us in finding out the errors. Without knowing which error was affecting us, searching through Splunk revealed that the IP whitelisting was done.

Generally, in our scrum calls which start on our daily call, we go through our incidents and ServiceNow , and if we find anything stuck or any mismatch that has happened, the first thing we do is check the logs directly in the call. This allows the team to have a proper understanding of what is happening. At the start, if you are a fresher, it is not beginner-friendly because it is difficult to understand. However, over time, this would be the best tool that we will ever use.

I believe Splunk Cloud Platform's ability to show right from a payload is one of its best features. When a payload is generated, each log indicates what the user has done, including certain actions. We will know what the user has done. In case the person has missed a certain logic or we find an exception, we are currently finding an illegal state change exception where if the user is not following the check lifecycle. Our check lifecycle is from awaiting submission, requesting, requested, issued, and then cleared. If the user does not follow this lifecycle, for example if the user is trying to move the check from awaiting submission directly to issued instead of going from requesting to requested and issued, it will throw this exception. We will know about it in the logs itself. Splunk Cloud Platform helps us to check the logs and identify any possible errors that the user might have done, or any possible bad job or job failure that has occurred. Initially, to find anything for any troubleshooting, we go through the logs itself. That is the feature that stands out for me.

We have a customized prompt where, initially when you go to Splunk prod, we can search with a particular primary key. In my case, it would be a public ID or a claim number or a check number, anything. When we search with it, we can go right from the payload where we can see the operations and more. We tend to create a customized dashboard as well, so that any alerts that pop up will get displayed right there, so that any of the team members can pick up and solve that issue. We occasionally do manual searches also, but in lower environments. Splunk Cloud Platform does support our INT environment and DEV environment. In case we are trying to recreate some kind of scenario in DEV or INT, we could check the logs and see where the issue is recreating.

Splunk Cloud Platform's ability to show right from a payload is one of its best features. When a payload is generated, each log indicates what the user has done, including certain actions. We will know what the user has done. In case the person has missed a certain logic or we find an exception, we are currently finding an illegal state change exception where if the user is not following the check lifecycle. Our check lifecycle is from awaiting submission, requesting, requested, issued, and then cleared. If the user does not follow this lifecycle, for example if the user is trying to move the check from awaiting submission directly to issued instead of going from requesting to requested and issued, it will throw this exception. We will know about it in the logs itself.

Splunk Cloud Platform helps us to check the logs and identify any possible errors that the user might have done, or any possible bad job or job failure that has occurred. Initially, to find anything for any troubleshooting, we go through the logs itself. That is the feature that stands out for me.

We have a customized prompt where, initially when you go to Splunk prod, we can search with a particular primary key. In my case, it would be a public ID or a claim number or a check number, anything. When we search with it, we can go right from the payload where we can see the operations and more. We tend to create a customized dashboard as well, so that any alerts that pop up will get displayed right there, so that any of the team members can pick up and solve that issue.

I wish Splunk Cloud Platform is a little more scalable. Whenever we are trying to scale up our storage, currently it stores the logs up to three months. If we want to search for prior logs after three months, we cannot find it because it stores the logs only up to three months. Suppose an incident has come up and changed to a PRB, and that PRB was created more than five or six months back, we will not be able to find the root cause because logs will be deleted automatically after three months. That is one thing I wish it to be scalable.

It is not beginner-friendly because all the information or the payload that it sends or shows is kind of concatenated, compressed, and everything. To get used to it will take some time, but you will get used to it with time. It is a best tool, and I would recommend it.

I wish Splunk Cloud Platform did not search all of the logs. If you were to search with the primary key of a claim number, it searches with hundreds or millions of similar entities, so it takes a lot of time to search that particular log which I am trying to search. The searching time is a little more. We occasionally face a little bit of server issues, but the customer support is helpful. We lose some time as well in that server downtime.

I have been using Splunk Cloud Platform for more than a year.

We occasionally face server downtime issues whenever we try to search a large number of logs or when we try to apply a large number of filters and it tries to search logs. The customer support is really good. Whenever we face an issue, we reach out to them and they fix it for us or they give us documentation and we follow that.

It is not really scalable because whenever we are trying to scale up our storage in terms of when the user increases and the count of user numbers increase and our log capacity increases, it was not adapting very well. Whenever we are trying to switch environments or create and develop a new branch, we occasionally face issues. It is not that scalable.

The customer support is really good, actually. We reached out to them a considerable amount of times. When we try to reach out to them, they provide us documentation where most of the errors that we faced would be fixed before reaching out to them. They are really good.

We used to use local logs, where it used to take a lot of time. It used to track even the data of people who are viewing that particular claim or exposure. So it was inefficient. We switched to Splunk Cloud Platform.

Since using Splunk Cloud Platform, we saved a considerable amount of time. We saved a lot of effort as well because if we do not use Splunk Cloud Platform, the only alternative we have is to check the local logs, where it tracks even unnecessary data. It is very inefficient when you are trying to check the local logs. It has impacted us positively because we saved a lot of time and effort. I think we reduced the number of employees as well because we could multitask. The tasks that used to take two or three hours would be done in twenty or thirty minutes to find that error and to do a root cause analysis or a code fix.

If I were to speak about return on investment, it is a great return on investment because it saves a lot of time and effort. It boosted our team's productivity, so dealing with tasks every day became a little bit more easier. We saved a lot of money because we did not recruit any new employees. Since the start, we are the same team, and we never really had any need to employ new web developers or anything. I would say we saved a lot of money in that domain or that scenario.

I chose eight point five out of ten because this is slightly on the costlier side. Similar products with alternatives from its competitors that are present in the market are a little cheaper compared to it. However, its features are a little better compared to that of its competitors. That is why we are still using this product. The licensing and setup cost is also slightly expensive. If the server downtime issues were fixed and if it is a little scalable, I would give it a perfect ten. I gave it an eight point five because it really helps with our day-to-day work. It saves us a lot of time and increased our team's efficiency.

It is slightly on the costlier side. Apart from that, the setup and everything did not take a lot of time for us. It is really smooth. Our managing team deals with this kind of setup and licensing things, but they never really faced an issue. It was done very quickly with no issues.

We did not evaluate any other options because we did not want to waste time and effort. We just went through proper reviews and all of the documentation. We just moved ahead with this after carefully reviewing it.

If you are a beginner, joining a corporate MNC or trying to develop a product and want to check certain logs, I would say that Splunk Cloud Platform is the best tool and product that is there in the market. It is not beginner-friendly because all the information or the payload that it sends or shows is kind of concatenated, compressed, and everything. To get used to it will take some time, but you will get used to it with time. It is a best tool, and I would recommend it.

Splunk Cloud Platform is slightly on the costlier side, but if they improve their scalability and fix their server downtime, I would say it is a good product. I gave this review a rating of eight point five out of ten.