Splunk Cloud

My main use case for Splunk Cloud Platform involves working on desktop support and making dashboards for our inventory, which includes tracking computers going offline, handling break-fix issues, and managing various Windows projects.

For one of those projects, I pull data in from Active Directory, SCCM, Tririga, and CMDB, which are all multiple sources. In Active Directory, we have the version of the computer, whether it's Windows 10 or 11, and we have another external lookup that tells us when those are due for upgrade. So if a computer is due for upgrade, say in 2026 or 2027, I use Splunk Cloud Platform to filter that out through 3,500 machines, and it helps us keep track of where we are and what we need to do.

The biggest use involves all the data we pull from different sources such as AD, CMDB, Tririga, and ServiceNow, and we compile all that data into one table for compatibility comparisons. Sometimes they list different locations, and it helps us automatically create tickets if things are wrong, which we can then distribute to my tech team.

The best features Splunk Cloud Platform offers are primarily the lookups, as I rely heavily on them. I am not great with searches, but once I figure out the searches, I create big lookups that run every day, allowing me to pull all the data I need right from one master source, which is how I mostly use it.

The daily lookups and master source help tremendously because before Splunk Cloud Platform, I kept everything in Excel lookups, making multiple VLOOKUPs from different data sources almost weekly, which took a lot of time, filtering, and sorting. Now with Splunk Cloud Platform, it all happens automatically every day, and I can simply look at the results instead of continuously finding all the info.

Splunk Cloud Platform has positively impacted my organization tremendously since we have had it. While I provided my use cases, there are other departments with their own as well, including our scientists who can now see their data on Splunk Cloud Platform TVs showing whether computers are up or down. There is also a security team that utilizes Splunk Cloud Platform for their security measures. While I do not have information on what they do, they are the ones that brought it in and helped us set our setup. So my whole company is pretty much running on Splunk Cloud Platform now.

Regarding improvements for Splunk Cloud Platform, I do not have any complaints as I think it is pretty good already.

I have been using Splunk Cloud Platform for about three to four years.

Splunk Cloud Platform is stable.

The ability of Splunk Cloud Platform to scale aligns well with my organization's data demand fluctuations. My company has significant data needs, and the data engineers I communicate with are skilled at scalability and making searches smaller to avoid being too large. Overall, they do well.

Customer support is great; I attend the convention every year and can talk to whoever I need. I have taken classes and had discussions with proctors, and everyone has been very helpful.

I have not previously used a different solution; I am a first-time learner in this.

There is definitely a time and resource saving for my company with Splunk Cloud Platform. I do not know the pricing, so I cannot provide a return on investment, but I feel it has been very helpful for my team.

I did not evaluate other options before choosing Splunk Cloud Platform, as all I used before was Excel. Splunk Cloud Platform is my first platform.

Without looking directly at metrics, I can say it has saved me hours and days in a month. It has had a massive impact on my field. I could not live without it, as I do everything pretty much on Splunk Cloud Platform at work to keep us organized. It has been amazing.

I give Splunk Cloud Platform a rating of 10 out of 10. I choose a 10 because I enjoy having a single data source for all my data sets, and it has made my life much easier in managing our data sets, projects, and the various uses I get out of it.

I cannot provide insight into Splunk Cloud Platform's governance and security regarding AI capabilities, as I am not familiar with the AI features in Splunk Cloud Platform yet. I have only used some outside AI, such as Cloud Code, to help me create dashboards, which is really the most use I get out of it, not within Splunk Cloud Platform.

I feel that the accuracy and reliability of output in Splunk Cloud Platform depend on the person coding it. If the coding is right, it will be reliable, but I need to validate it, just as with anything else. If not, then it is going to be wrong, but that would not be on Splunk Cloud Platform; it would be on the person coding it.

I have only used cloud, so I have not experienced hybrid or on-premises. The cloud works fairly well; however, some really large searches can take some time, but since I mostly work in lookups, I have my setup to be pretty snappy, so I do not run into too many issues.

I have zero interest in Splunk Cloud Platform's AI models, using some external AI for help rather than the internal AI models, which I do not think my company has even adopted yet.

I do not know much about Splunk Cloud Platform's app ecosystem as it has not been an area I have gotten involved in yet. I know they exist, but I have just not worked with them.

I have only used Splunk Cloud Platform's internal models, so I have no experience with third-party integrations, leaving me unsure about any influence they may have on my data strategy.

The subscription model does not impact my financial planning for data platform investments, as I do not purchase Splunk Cloud Platform or anything; I am just a power user of it.

For others looking into using Splunk Cloud Platform, I advise to sit down and learn it. That is what I did. I did not know how to code or anything; I used some AI to help me get started and then kept learning. The more I learned, the more I saw how useful it was, and it has been great.

My main use case for Splunk Cloud Platform is security operations. For security operations, we ingest all internal logging into Splunk Cloud Platform, and that's where we get and do all of our internal review for malicious activity.

The best features Splunk Cloud Platform offers include its overall usability, which is good, as well as the native connectors with other applications that help in getting data from major applications like Okta and more. Additionally, features related to identity and asset management are also beneficial.

Splunk Cloud Platform has positively impacted our organization by allowing visibility into our organization in a positive light. It has also provided a central logging source for many of our applications, which has been good. It has improved incident response time as our partnering SOC uses the platform to surface alerts, reducing time. In terms of compliance, it serves as a source of audit evidence and allows us to ingest and hold logs longer than other apps natively hold.

Splunk Cloud Platform is on the pricier side for ingest and storage costs. There are many different features and things to use, with many built well. However, certain areas could improve usability, making it more applicable across different companies and more adaptable to various situations rather than being targeted to a single use case. Usability could improve in certain areas, including AI feature enhancements, and I find myself gravitating towards using Claude rather than Splunk Cloud Platform app or UI itself. Ingesting and storing data within Splunk Cloud Platform is expensive.

From my experience with Splunk Cloud Platform, the accuracy and reliability of output are relatively low when creating SPL and using it to find trends within the ingested data. I have seen better accuracy with the MCP, but the native AI capabilities within the console are not very accurate.

Over the last three years since our last contract, we've gone from 100 gigabytes of ingest to 300 gigabytes of ingest. In terms of scaling with the company, we have repeatedly hit the issue of trying to get as much data in as possible while being cost-conscious. Therefore, we're at a borderline of it being able to scale and it not scaling.

I have been using Splunk Cloud Platform for two years.

I find Splunk Cloud Platform to be stable.

Splunk Cloud Platform is scalable.

The customer support is pretty timely. I would rate the customer support a seven out of ten.

I have not previously used a different solution.

I think we're on the verge of seeing a return on investment with AI capabilities, especially related to AI-generated AI SOC or replacing our SOC needs. In the past few years, the return on investment has been mainly observed in the visibility aspect, but I wouldn't say there's been much impact on human or job duty aspects so far.

I have not dealt with pricing, setup cost, or licensing myself, but I have heard secondhand about our involvement with pricing and our last license increase.

Before choosing Splunk Cloud Platform, I did not evaluate other options.

Regarding governance and security in Splunk Cloud Platform, I think it provides a reliable source for audit logs and allows evidence to be tied out for compliance items.

Splunk Cloud Platform is deployed in our organization using a public cloud. We use AWS as our cloud provider. I don't think we purchased Splunk Cloud Platform through the AWS Marketplace.

I can only speak to the visibility into cloud environments, as I don't have experience with on-premises or hybrid setups. I have not had any experience with the zero-setup feature for AI models in Splunk Cloud Platform.

Our perception of using native models over third-party integrations in Splunk Cloud Platform's environment is that we have specific models approved for our data, which is the main focus of our strategy.

My experience with Splunk Cloud Platform's app ecosystem is that updates are pretty simple, and I haven't had any issues with that. Overall, the experience is pretty fluid.

My advice for others looking into using Splunk Cloud Platform is to understand the data you want to ingest and also consider if there are other tools that could better search a large amount of data for your needs, as it depends on the size of the company and the overall staff. I would rate this product an eight out of ten overall.

My main use case for Splunk Cloud Platform is building dashboards and alerts to help aid our Dev team and video team troubleshoot.

For our acquisitions team, I set up an alert to track the provider issues that cause the errors. From them, it leads to how many times a provider goes down, and it sends it to a web hook.

We mainly use Splunk Cloud Platform to troubleshoot through our logs and find areas of weakness or help us determine where something has gone wrong with our microservices through AWS.

The best features Splunk Cloud Platform offers are that it is easy to learn and the accessibility to the different features as well as step-by-step processes.

What makes it easy to learn is the querying style in Splunk, which is straightforward and simple in syntax.

Splunk Cloud Platform positively impacts our organization by allowing us to go through our logs more simply and filter out different material that we are looking at, as well as collect logs in one place for us to search through and build comprehensive dashboards to show leadership and dev.

Splunk Cloud Platform has reduced our errors and has helped us troubleshoot significantly with the alerts that we have set up with the logging that it offers. We have been able to trace issues faster and get more engineers to locate the errors, so visibility has been excellent.

I have not had too much interaction with Splunk Cloud Platform, with only three months of experience using it. I have not come across any flaws yet, but I am sure as always, things will come up.

I have been using Splunk Cloud Platform for three months.

Splunk Cloud Platform has been stable for the past three months.

I have not used Splunk Cloud Platform's AI capabilities.

I have not used Splunk Cloud Platform's zero-setup feature for AI models.

I do not have experience managing updates within Splunk Cloud Platform's app ecosystem.

The solution's visibility into multiple environments, such as cloud, on-premises, and hybrid, is very useful, but I am very siloed, so I do not really work with anything else. I would rate this product an 8.

The main use cases for Splunk Cloud Platform involve forwarding logs from our application database using Splunk Forwarder to the Splunk tools so that we can have dashboards to check in case of any production issues, vulnerabilities, or incident cases.

What I appreciate about Splunk Cloud Platform is that observability is strong, and we can have real-time data with fast time to value. We can conduct advanced searches by leveraging the search processing language, and AI assistants are available to query and analyze data sets. This makes it excellent for unified observability and advanced searches.

Splunk Cloud Platform improves the way the organization functions by being used during SIEM and ITSM tickets to enhance infrastructure monitoring so that we can have customizable dashboards, interactive visualization, and out-of-the-box reporting for all stakeholders, whether technical or non-technical. Through this, we can achieve unified observability and full-stack visibility.

I would like to see Splunk Cloud Platform become more user-friendly compared to others. For example, Grafana is very user-friendly where you can easily create graphs.

Regarding missing features or functionalities, I believe index management and performance optimization should be enhanced so that we can optimize the SPL queries instead of using transactions whenever feasible.

I have been working in my current field and in the industry for around 13.5 years.

I find Splunk Cloud Platform to be stable overall.

Regarding the platform's ability to scale aligning with my organization's demand fluctuations, scalability requires some changes to our architecture involving planning related to the framework so it can adapt to growing data volume and user demands. Every day MFT and integration demands are increasing, so we must choose the right topologies for a scalable architecture, and role distribution should be in place. We need to use load balancing and capacity planning. We should take advantage of what Splunk Enterprise is providing by reviewing components such as Splunk Enterprise deployment, distributing indexing and searching so that we can use that platform to manage all user objects and data storage.

I evaluate customer service and technical support from Splunk to be good. On a scale of one to ten, I would rate the technical support about nine.

Currently there are no IBM solutions in use, but earlier I worked on App Connect Enterprise and IBM Integration Bus, which are integration-related technologies.

The setup process of Splunk is straightforward. If we can provide the process document, it is easy. We conducted some development depending on the forwarder. By using the universal forwarder, we collected logs. We have to set up the indexes and search heads for medium enterprises. For large enterprises, the setup is more complex because we need clustering mechanisms such as load balancing, search head cluster, and index cluster. We can accomplish this by using the universal forwarder and indexes; Splunk will manage the indexes, storage, and upgrades, but as a customer we must manage the universal forwarder, data onboarding, and dashboards. These parts depend on the skill sets we have available.

My company has a business relationship with Splunk as we are a customer, and they onboard the vendor as per their policy. We are managing them and are not part of that setup.

I find Splunk Cloud Platform to be cost-effective. If we optimize it, we can achieve ROI by seeing reduced downtime and improved operational efficiency. We can make changes in one go by having perfect compliance automation related to GDPR and PCI DSS.

The key differences and strengths of Splunk Cloud Platform in comparison to other technologies indicate that Splunk Cloud provides consolidated capabilities such as SIEM, log management, reporting tools, and monitoring dashboards that deliver better performance in monitoring. Depending on cost, if we optimize that very effectively, we can achieve good ROI by reducing ingested data volume, using data retention tiers, or summary indexing. Through this approach we can improve Splunk Cloud Platform ROI and use that tool very effectively.

Regarding the pricing aspect, setup cost, and licensing of Splunk Cloud Platform, I have not directly joined that process, but it depends on the ingestion volume. It is based on the volume of data ingested per day, so we have to exclude unnecessary data sources and remove duplicate events to optimize cost improvement areas. We can establish data retention policies depending on hot and warm data so that the data will have summary indexing and reduce infrastructure cost and storage cost. We should have the right size infrastructure, and we have to monitor that license usage.

The key differences and strengths of Splunk Cloud Platform in comparison to other technologies indicate that Splunk Cloud provides consolidated capabilities such as SIEM, log management, reporting tools, and monitoring dashboards that deliver better performance in monitoring. Depending on cost, if we optimize that very effectively, we can achieve good ROI by reducing ingested data volume, using data retention tiers, or summary indexing. Through this approach we can improve Splunk Cloud Platform ROI and use that tool very effectively.

The main drawbacks of Splunk Cloud Platform include that while it removes the infrastructure management overhead, it has limitations such as volume growth becoming expensive. The licensing is typically based on ingestion volume or workload, so we must optimize that, and there is no direct access to the underlying server; we must use forwarding tools. Some advanced configurations are needed to support tickets or manage change processes. These are dependencies where we have to rely on vendor dependencies for maintenance windows. Data residency and compliance concerns also exist, where scenarios such as GDPR, banking, and healthcare have strict regulations regarding where data must be stored, so we have to consider that concern when making the decision.

Generally, most enterprises find that Splunk Cloud Platform is reducing operational overhead, and we should focus more on security. It is a good choice when needing a managed service or for cloud-first organizations. For security and compliance, when custom scripts and third-party add-ons are needed, there are restrictions, and for very large volumes of multiple terabytes, it is not advisable because the licensing cost is very high and optimization will be critical. If complete administrative control is needed, we can avoid using Splunk Cloud Platform. I would rate this review overall as a seven out of ten.