I work in the data and analytics space where I deal with large data sets and system-generated logs. I use Splunk Enterprise Platform for monitoring systems. I analyze logs and create dashboards that help our technical teams.

Splunk Enterprise Platform is very efficient for us. We monitor logs and troubleshoot our issues, then create dashboards for tracking system performance. We bring in logs from different systems like Windows Event logs and AWS logs, so it is highly efficient for us. It is one of the best SIEM tools.

We use the Machine Learning Toolkit.

I love its search capabilities. It has a very strong search functionality using SPL. The dashboards are very flexible and easy to customize. One of the best features is how it can handle large-scale machine data efficiently.

The cost is definitely an area for improvement. The cost increases significantly as data volume grows. We ingest terabytes of data, so I can say Splunk Enterprise Platform is somewhat costly. Poorly written queries can impact our performance, so there should be suggestions provided to write queries in SPL.

As Splunk partners, as our data volume grows, our cost also increases significantly. From a pricing perspective, Splunk Enterprise Platform is somewhat costly for us.

I have been working with this solution for the past one year.

We have experienced no stability issues. It is highly stable and scalable for us. We are increasing our team vertically and horizontally dedicated to Splunk Enterprise Platform.

We have experienced no scalability issues. It is highly stable and scalable for us. We are increasing our team vertically and horizontally dedicated to Splunk Enterprise Platform.

During an upgrade we were having some issues, but after some time, they resolved our issue and we were satisfied with that.

I would rate their customer service nine out of ten because our issues were solved quickly after two to three hours.

We directly became Splunk partners. When I joined this firm, I directly used Splunk Enterprise Platform.

We had training sessions for the onboarding process. Since I come from an observability and SIEM background, it was quite easy for me to integrate Splunk Enterprise Platform.

We had training sessions for the onboarding process. Since I come from an observability and SIEM background, it was quite easy for me to integrate Splunk Enterprise Platform.

The cost is a concern. The cost increases significantly as data volume grows. We ingest terabytes of data, so I can say Splunk Enterprise Platform is somewhat costly.

We have an add-on of the Universal Forwarder that helps us check whether our forwarder server is down or not. We have our custom add-ons that are definitely helping us and easing our work.

We use alerts about licensing every day. We have set an alert that triggers if our daily license exceeds 500 GB. We came to know that our licensing limit has been reached, so we had to remove unnecessary data. That's how we use that feature.

We have just integrated Splunk Enterprise Platform with Amazon Web Services. It integrates well without any issue.

It helps with suggestions about regression and has pre-built functions and algorithms to build with. I would rate my overall experience with this solution nine out of ten.

My usual use cases for Splunk Enterprise Platform involve all NOC and SOC activities, where SOC-related alerts will be aggregated with NOC-related alerts, allowing for correlation between them, including use cases such as abnormal travel and anomaly detection, all of which are detected by Splunk Enterprise Platform.

For instance, if there is a DDoS attack indicated by an anomaly in the traffic when WAF is integrated, an alert is generated in Splunk Enterprise Platform, which our L1 and L2 teams will then visualize and remediate based on the alert.

I do not use Splunk Enterprise Platform's Machine Learning Toolkit directly, but my team utilizes it.

Splunk Enterprise Platform's Machine Learning Toolkit has helped us with predictive analytics in our organization significantly, as it automates the anomaly detection that previously required our L1 and L2 teams to spend three to four hours on.

It immediately triggers alerts upon detecting patterns such as WAF spikes or suspicious login behavior, allowing our L1 to avoid manual analysis and triaging. The predictive analysis reduces false positives, enabling our analysts to close tickets swiftly—previously taking two to three days, and now they close them before breaching the SLA due to effective pattern discovery and outlier detection.

Splunk Enterprise Platform's Machine Learning Toolkit is efficient in detecting abnormal login attempts and brute force attacks, effectively aiding our proactive defense planning through advanced analytics and anomaly detection.

Splunk Enterprise Platform's most valuable features include its integration with AI, as Cisco, which has taken Splunk Enterprise Platform recently, is building up AI functionalities, enhancing remediation capabilities and the orchestration part in the market. Additionally, Splunk Enterprise Platform shows the correct logs at the correct time, and inventory management is very good.

I assess the effectiveness of Splunk Enterprise Platform in detecting anomalies and preventing system outages as very strong; for over two to three decades, it has provided centralized log visibility, real-time monitoring, and analytics correlation, which is robust for threat detection and incident investigation.

Splunk Enterprise Platform's machine learning capability of the toolkit predicts trends and reduces many false positives, making Splunk Enterprise Platform an essential tool for both SOC and network operations, where it effectively detects anomalies that other SIEM tools cannot.

Splunk Enterprise Platform's personalized dashboards are superb, as I have been experimenting with them extensively, and new features have enhanced their quality, making them particularly effective for presentations to leadership, including direct engagement with the CISO.

In terms of improvement for Splunk Enterprise Platform, as more companies embrace AI, adding more AI automations is crucial and could parallel what competitors such as Xplain are doing. Managing duplicate alerts efficiently can optimize costs, as the current license-based data ingestion can quickly escalate if duplicate data is fed.

Better filtering of unnecessary log sources could greatly interest clients by demonstrating cost efficiency. From an architectural standpoint, data onboarding, normalization, performance, and scalability improvements would be beneficial, particularly in optimizing search speed and query execution to handle larger searches efficiently.

I have been working with Splunk Enterprise Platform for the last 10 years as a Splunk certified power user and advanced user, and along with Splunk Enterprise Platform, I am using Palo Alto's Cortex XSOAR and Azure Sentinel continuously for over 10 and 12 or more years.

I evaluate the stability and reliability of Splunk Enterprise Platform as very high; we utilize it for both SOC and NOC operations, and our L1 and L2 teams get real-time alerts and query the SPL effectively without delays that other SIEM solutions may impose.

Splunk Enterprise Platform is scalable; we have already adapted it from SOC to NOC operations while maintaining good indexing practices that prevent overload and ensure clear searches, maximizing performance in large SPL queries.

My L1 team regularly communicates with Splunk Enterprise Platform's technical support, which is very helpful.

I would rate the technical support from Splunk Enterprise Platform around eight on a scale from one to ten, where one would be the worst and ten would be the best.

Before using Splunk Enterprise Platform, I utilized Azure Sentinel in my previous company at Deloitte, prior to leaving.

Although I did not participate in the initial setup, I provided mentoring for the team under me who managed the implementation because I have spent 14 years in the industry, which included hands-on implementations earlier in my career.

Splunk Enterprise Platform's implementation is very straightforward; I do not feel there is a significant difference from the implementation point of view, as everything is clearly documented by Splunk Enterprise Platform.

We are a customer of Splunk Enterprise Platform, currently at Aramex, and we bought a vendor from Capgemini who has actually implemented Splunk Enterprise Platform for us, so we are not directly linked with Splunk Enterprise Platform but rely on our vendor to use Splunk Enterprise Platform for us.

Splunk Enterprise Platform's dashboards significantly improve data interpretation, providing immediate real-time visibility on top trending alerts and live data without needing to run queries repeatedly. They aggregate metrics and highlight trends such as threat overviews and MITRE ATT&CK mapping, which reduces the workload for our L1 and L2 teams.

Pre-built alerts for anomalies in login attempts, failed attempts, or geolocation mapping are very visible in Splunk Enterprise Platform's dashboard, which plays a critical role in providing real-time visibility into security events and network activities.

Splunk Enterprise Platform's application management feature enhances end-user experiences by providing organized dashboards that monitor application usage and configurations, facilitating faster detection and query execution. It logs metrics into applications that reveal usage patterns, anomaly detections, and attack occurrences, while also ensuring proper governance and versioning of applications.

I consider Splunk Enterprise Platform an expensive tool because budget constraints from license-based data ingestion costs are significant. Costs can escalate rapidly when duplicate data is processed, which Splunk Enterprise Platform can identify to help clients save directly on unnecessary spending.

I leverage Splunk Enterprise Platform for advanced threat detection, which is critical for our SOC operations. Threat intelligence and detection are vital, especially since Cisco's acquisition of Splunk Enterprise Platform has integrated Talos into it, enhancing our ability to monitor for IP reputation and potential attacks, while also keeping an eye on advisories regarding application vulnerabilities. I would rate this product overall at a nine out of ten.

Ingesting massive amounts of machine-generated data and running real-time searches to identify patterns, anomalies, or threats related to specific security issues was how I used Splunk Enterprise Platform for detection and investigation. The most significant aspect, if I must prioritize, is the data ingestion capability. Splunk Enterprise Platform usually collects authentication logs from various sources such as Windows event logs and SSH, which relates to Linux logs, and some web application-based logs as well. Apart from that, I use it for detection logic. The main search I use is Search Processing Language, based upon the queries I provide related to the machines I monitor.

Mostly for brute-force detection, I use it for monitoring multiple failed login attempts from a single source or multiple IP sources followed by a successful login, which often indicates a compromised account. I also use it for lateral movement and privilege escalations. For privilege escalations, it involves detecting when a normal user is added to a high-privilege group, such as Domain Admins. Additionally, I have capabilities related to IT operations, which involve web traffic analysis, mostly identifying slow-loading web pages or sudden spikes, errors such as 404 or 403 Forbidden, or even 500 errors.

When a specific condition is met, such as any brute-force attack happening, it is easy to investigate the alert, particularly in Splunk Enterprise Platform. Integration is a notable aspect of the features in Splunk Enterprise Platform.

Before using Splunk Enterprise Platform, I used LogRhythm, but after initiating Splunk Enterprise Platform, I noticed several positive impacts in my organization.