We primarily use it for SIEM.

What is most valuable?

It has a big user base, so the community is useful.

What needs improvement?

The community surrounding the product is okay, but I would like more material supplied by Splunk around some more common integration stuff. I wish there was a bigger library, because we are building stuff. Where I often feel like other people have done things before, we are reinventing the wheel. While it is not a core piece of our organization and it is not a priority, it does inform our SIEM platform. It would be nice if there was a little more cookie cutter solutioning inside of it, and that they would take a little more time to shake it out.

The first year and a half was a little wacky with its usefulness, but now it is a solid piece of our infrastructure.

For how long have I used the solution?

Three to five years.

What do I think about the stability of the solution?

We don't have any issues with it now. We had some issues in the past, but we chalked those up to user error. We didn't know what we were doing at first.

What do I think about the scalability of the solution?

We haven't had any issues with it.

How is customer service and technical support?

I haven't heard any complaints about the technical support.

How was the initial setup?

The integration with all our tool sets felt like we were reinventing the wheel, which was a pain point for us.

What's my experience with pricing, setup cost, and licensing?

It would be nice if the pricing were cheaper. However, we did purchase it.

Which other solutions did I evaluate?

We evaluated Alert Logic and Splunk. We still use both products heavily.

We have different use cases for the products. At first, Splunk was free, so we started to take more advantage of it.

What other advice do I have?

Do your homework and make sure it fits your needs.

The product is pretty good. We are pretty satisfied with it. It does what it does.