Splunk Cloud

I use Splunk Cloud Platform to monitor servers, databases, and Kubernetes infrastructure. Infrastructure monitoring is conducted through Splunk, and I also monitor application APIs through Splunk. I use Splunk in day-to-day operations to manage production environments and to investigate errors and troubleshoot production issues. For example, if any connection increase or connection drop occurs in any environment or infrastructure, I identify it through Splunk dashboards. Through historical data and pattern matching, I identify timestamps and correlate events to understand what is occurring.

Another use case with Splunk Cloud Platform is to correlate activities between production side operations and actual events that have occurred. Based on that correlation, I identify the root cause and provide analysis to the concerned team. I use Splunk for log monitoring, KPI degradation investigation, and incident investigation such as P1 and P2 issues. This helps the team identify issues quicker, understand the sequence of events, and reduce troubleshooting time.

Splunk Cloud Platform has improved operational visibility by bringing multiple database dashboards, server dashboards, and application log integration into a centralized platform. Everyone can now see what is occurring in the database or production side. This helps identify issues much faster and reduces manual troubleshooting efforts and investigation related to production incidents. The alert capability helps recognize recurring problems and enables proactive response. It also improves collaboration between infrastructure teams and application teams. Overall, it majorly helps reduce investigation time when any incident occurs on the production side.

When I observed a database issue causing multiple spikes on the database side and degradation on the application side, I used Splunk Cloud to search logs across multiple servers and quickly identify the source of error instead of manually checking each server. This reduced the initial investigation from around 30 to 60 minutes to 10 to 15 minutes. It removes the manual efforts required to investigate issues depending on the type of issues triggered. It also helps identify recurring errors that frequently occur on the infrastructure side and enables faster findings with the application and infrastructure teams. These improvements make incident response more efficient and reduce troubleshooting time and MTTR.

Belonging from the database end, I use Splunk in day-to-day operations with multiple monitoring activities such as process checks, connection spikes, memory spikes, and CPU spikes. All these aspects can be monitored in a single dashboard, and I receive scheduled reports every hour with proper updates on what is occurring in the infrastructure end.

The most useful features of Splunk Cloud Platform are powerful log searching, real-time alerting, and the ability to create customized dashboards that correlate data from multiple sources and environments as well as multiple events occurring in production. This helps correlate data with multiple sources across infrastructure, database operations, and features that help identify errors quickly and identify incidents occurring across servers and help with monitoring to reduce issues.

Another valuable feature is the ability to customize reports. I can create custom reports per environment and per need, which helps track database health, server health, and infrastructure health continuously. I appreciate the amount of logs handled by Splunk as I have never seen any other tool handle such volume. This provides better operational visibility through Splunk.

Splunk Cloud Platform provides good visibility across different sorts of environments with a centralized system and dashboards provided by Splunk. Services are deployed both on-premises and in the cloud, and I have integrated all those services into Splunk. This helps easily correlate events across all platforms in production and helps troubleshoot issues occurring and identify potential problems and root cause analysis in a single platform. This is especially helpful for hybrid infrastructure with both on-premises and cloud components, as it provides a centralized view of all infrastructures and makes it feasible to investigate issues and provide proper root cause analysis.

A zero setup AI approach is more helpful, especially for AI models, because it reduces implementation efforts and makes AI capability more accessible, helping explore without managing complex model infrastructure. It helps get started with AI assistant, quick log analysis, and troubleshooting more quickly. Built-in features enable log analysis and event-based triggers. I can create AI monitoring agents that, whenever something is repetitive, can set it like an agent, and whenever the event occurs, preventive maintenance tasks can be initiated automatically.

Splunk Cloud Platform's app ecosystem is more useful because it reduces efforts to integrate and add different data sources, cloud services, database monitoring, and monitoring tools within itself. It provides the centralized view of the overall system from different sources of the environment like hybrid cloud as well as on-premises and public cloud platforms. This simplifies data collection and improves visibility across multiple infrastructure. Managing updates is generally straightforward using support apps, but compatibility checks need to be tested, which is important. Before applying any update, I need to check production compatibility. Update guidance provided by the Splunk team can be more straightforward without any issues.

The main area of improvement is alert configuration, especially for new users. Searching through large volumes of logs and optimizing results quickly and troubleshooting complex queries can take time. Better out-of-the-box dashboards should be integrated. Some kind of template should be provided inbuilt so that everyone can use a plug-and-play dashboard approach with integration of multiple data sources. This would provide clear guidance on how queries are optimized through the platform and would improve cost visibility. Simpler data ingestion management would help control operational expense. AI integration should be included for log analysis so that no one has to read or analyze all the data. Some data can be analyzed and provide basic analysis that the end user can then correlate with events to understand what is happening and what exactly occurred in the database end.

For documentation, some documents are quite outdated and need improvement with the latest features. User experience should feature a more intuitive interface and simpler navigation. Sometimes I need to identify certain metrics, but I need to go through each dashboard. Instead, I should be able to search for particular metrics by selecting particular infrastructures and retrieve those metrics. This guidance can be integrated into the dashboard. Documentation should be more practical with step-by-step troubleshooting guides showing which dashboard to view to get proper metrics. Real-world examples such as slow queries can be integrated showing how issues are resolved faster, and best practices can be included.

I have been using Splunk Cloud Platform for the last two years for production monitoring.

I do not see any issues on the Splunk side so far. Most things are straightforward, and I do not see any issues related to downtime or related to Splunk. I rate Splunk 10 out of 10 based on my personal experience.

Splunk Cloud Platform offers good scalability for handling fluctuations in large volumes of monitoring needs that change. It helps accommodate data from additional services and applications without requiring me to manage the underlying infrastructure directly. This reduces the operational burden of my IT system and allows me to focus more on monitoring and incident response. However, increased data ingestion can affect licensing costs, so monitoring data volume and optimizing log collection are more important to maintain cost efficiency.

Splunk Cloud Platform, being a public cloud offering, provides much easier scalability as compared to setup costs for any other environment. When I need to set up an on-premises environment, I need to enable and set up all the infrastructure and then scale the environment. In Splunk Cloud Platform, it is a plug-and-play environment. As per the requirement or log volume growth, it can accommodate data in additional servers, databases, and applications without requiring me to manage the underlying infrastructure and helps reduce infrastructure management overhead and support centralized monitoring across different environments. However, data ingestion limit, licensing cost, and search platform need to be monitored to ensure scalability remains cost-efficient.

Customer support from Splunk is 10 out of 10. Whenever I need support from the Splunk side, I can get quick assistance, and they provide very detailed information whenever I encounter any issue. They help troubleshoot issues and provide more insights on how I can proceed and help guide the product itself.

Previously, I was using Grafana and other tools. With Grafana, there was a huge setup cost and everything was manual. Compared to Splunk, multiple things are automated in Splunk itself, whereas with Grafana I needed to do things manually. I relied on multiple manual tools for various functions. AI capability was not available for those tools, which is why I moved to Splunk, which is a plug-and-play solution that can be integrated into Splunk. Multiple tools are integrated such that I just need to provide the endpoint and credential, and it will directly scrape metrics from the environment and provide analysis.

The main benefit for production stability is that I have greatly reduced P1 and P2 incidents. Previously, I was conducting manual monitoring and troubleshooting, and identifying root cause analysis would take hours to get proper investigation and come to a decision. Through Splunk, I conduct this much more quickly, so the time-saving represents significant cost-saving. I also have much less manual human intervention through Splunk. Previously, I had a very large team for monitoring, but after Splunk, my team size has been reduced significantly with Splunk automation handling multiple tasks. Centralized log searching helps reduce the initial investigation from approximately 30 to 60 minutes to 10 to 20 minutes for certain issues depending on complexity. These saved 20 to 40 minutes per incident allow the team to focus more on root cause analysis and preventive maintenance. I do not have direct cost figures right now because I do not work closely with the budgeting team, but these are the main cost-saving aspects I can identify.

Splunk Cloud Platform helps reduce managing and maintaining the underlying infrastructure, which can lower setup cost and operation overhead. However, pricing cost needs to be checked carefully when data is being ingested by Splunk and I am providing all my data to Splunk because when data increases, licensing cost will also increase. Licensing requires careful planning because data ingestion volume, retention requirement, and additional features can affect overall cost. Initial setup also requires efforts for data source integration, configuration, and dashboard creation. I recommend monitoring ingestion volume, filtering unnecessary logs, and reviewing logging utilization regularly to control cost and get the best value of the platform.

I evaluated a couple of options like Dynatrace and DataDog before choosing Splunk. These platforms require setup costs and operational costs would be higher compared to Splunk based on my comparison with other environments. While these platforms provide necessary features, the setup cost, efforts, and AI capability are still lagging compared to what Splunk currently provides, which is very outstanding. This is the main reason I chose Splunk.

I rate Splunk Cloud Platform 8 out of 10 based on my actual experience.

I rated 8 out of 10 because Splunk Cloud Platform offers powerful log searching, centralized monitoring, and customization dashboard for effective alerting that helps improve troubleshooting and incident response. To bring it to a 10, dashboard configuration and complex queries require additional efforts for onboarding new users. A new user unfamiliar with Splunk queries experiences significant overhead when first using the Splunk server. Improvements to usability and documentation and cost visibility would make the overall experience even better. This is why I deducted two points from the rating.

I believe Splunk Cloud Platform's AI capability is valuable for improving log analysis, identifying patterns, and speeding up incident investigation. Governance and security are especially important when working with sensitive infrastructure and database logs. Strong access control, role-based permission, data protection, and audit logging, along with transparency in AI-generated recommendations, are essential. I would like clear control over how my organization's data is used by the AI feature along with human oversight to improve operational decisions. Overall, I see good potential from AI capability implemented with appropriate security and governance control. There is some concern that everyone is creating their own dashboard with production data in terms of logs and metrics going into production, so Splunk could provide more security to protect data and avoid data going to any third party.

I found the AI capability and dashboard trustworthy because some of the analysis I received from it is really useful and time-saving. I can get all those insights in just a minute without even needing to log into the system and check it. In some cases, however, the AI is not providing the actual root cause that happened. The correlation between events sometimes is not working properly. Improving log analysis, identifying patterns, and speeding up troubleshooting should work simultaneously for proper results. However, I believe the AI output will always be validated with actual logs by the actual user using it. For the infrastructure side, the operational accuracy and consistency of critical systems, especially during production incidents, is more helpful for the AI capability. I can consider the AI output as an initial starting point when an incident is just triggered in Splunk. I can check the summary provided by the Splunk AI and then use it for further investigation on what exactly happened in the database to make informed decisions.

Splunk Cloud Platform is used as a SaaS solution with AWS cloud. I am taking services through Splunk directly as software as a service, and deployment is in the AWS cloud only.

I prefer native models as they have provided the required functionality because they can offer smoother integration with Splunk workflows and simplify deployment and maintenance. They reduce compatibility issues and make governance easier to manage with the existing platform. However, third-party models are more valuable when they offer specialization, compatibility, and greater flexibility over the system, and the decision should depend on the accuracy, security, and cost to integrate the requirement rather than one approach over another.

I recommend Splunk Cloud Platform as a very useful tool compared to other tools based on my day-to-day tasks and my organization currently being monitored through this tool. The functionality provided by Splunk is very outstanding. Monitoring data volume and budget are important aspects of Splunk that are very useful and cost-efficient. It helps reduce manual efforts and automate processes through AI capabilities. This is a very good useful tool.

I have mostly been an integrator. I do utilize Splunk Cloud Platform's machine learning capabilities for creating detection logic and some use cases; I have used the MLTK.

In Splunk Cloud Platform, I would say the versatility is the most valuable feature. It is very easy to bring in the ingestion compared to some other tools. I think that is the easiest way to work with the SIEM platform.

For predicting system anomalies, I would say that for detecting a pattern, it is really good in Splunk Cloud Platform. When it really comes to detecting something which is very unique, then I think some other platforms excel compared to Splunk Cloud Platform. However, when it is simply detecting and behavioral-based observation, then it does a decent job.

My impression of Splunk Cloud Platform's visibility into multiple environments such as cloud, on-premises, and hybrid is positive. I have worked on all: on-prem, cloud, Splunk Cloud Platform on AWS, or any private cloud.

In Splunk Cloud Platform, if there is native support for Kubernetes and some other automation tools, then it would be a really massive upgrade, I would say.

For Splunk Cloud Platform, they should give native support, as I mentioned earlier, to the Kubernetes platform. Particularly for the SOC, I think they should improve their SOC capabilities. Other tools have been working on their real-time alerting much better than Splunk Cloud Platform. I think they have fallen behind a little, so they should catch up.

I have been dealing with Splunk Cloud Platform for at least eight years now.

The platform's ability to scale compared to my customer's demand fluctuations indicates that some other tools are working a little better than Splunk Cloud Platform because they natively support automation such as Kubernetes. Splunk Cloud Platform does not support it.

I would say for on-prem, if you are trying to build on AWS cloud or any private cloud, then it is a little hectic compared to other tools. However, it works well. Also, the amount of logs that pass through between the indexes means the billing can be more compared to other tools. There are some disadvantages and advantages.

I would rate their job from one to ten as really good. If you open a P1 case with them, they are very fast and eager to connect with you and solve the problems and issues. I would say they do a very good job.

For technical support, if it is a P1 case, I would give them a nine out of ten. However, what I have observed is that when the case is P3 or P2, I would rate them a seven out of ten.

My experience with the deployment of Splunk Cloud Platform is now straightforward. I have been working for about eight years, so for me, it is straightforward. However, during my initial working days, I can remember it could be troublesome depending upon the case. Now I find it very useful. I would say it is really simple.

Regarding the pricing of Splunk Cloud Platform, I think for what they offer at that price, they are perfect for the SIEM and the SOC. If you compare with the other tools, they do not excel as Splunk Cloud Platform does, at least personally for me. I would say the pricing is good and they are competitive. They can be expensive, but what they offer at that price, I do not think any other tool can match that.

I would rate Splunk Cloud Platform overall as an eight.

My customers purchase their Splunk Cloud Platform from third-party sources through their resellers, and my clients have bought from them.