Splunk Cloud

Currently, our main use cases for Splunk Cloud Platform involve using dashboarding and alerting most of the time.

We also have scheduled reports that run daily to feed data into those dashboards, and we are actively using alerts to notify in the Webex channels about any issues that have occurred in production on a real-time basis.

I appreciate the fact that you can quickly click and create dashboards and alerts without having to spend too much time writing SPL queries to get your results.

Additionally, the fact that it is so much faster than Splunk Enterprise allows us to see things churn quickly.

Since the time I joined this organization, Splunk has been a very important tool for collecting the logins and the events. My organization has been using Splunk Enterprise for a very long time, and very recently, we migrated from Splunk Enterprise to Splunk Cloud Platform. My role has been as an end user of Splunk to see how all the migrations have completed successfully. Now in my current role, I am responsible for creating alerts and dashboards in Splunk Cloud Platform to assist with all the monitoring in the production environment.

I cannot say what improvements can be made right now because we have just migrated to Splunk Cloud Platform. I wish I could say more.

I have been using Splunk Enterprise for almost seven years. With Splunk Cloud Platform, we have recently migrated, and it has been just over a month.

We have not seen benefits right away because we have just started to migrate to Splunk Cloud Platform.

We have been using Splunk Enterprise for a very long time, which has had its benefits, and now we want to migrate to the cloud to see how that can help us.

Splunk Cloud Platform's ability to scale is a very important feature because it aligns with our demand fluctuations, which is why we migrated to Splunk Cloud Platform.

Splunk Enterprise was not scaling as the demand for Splunk usage grew, leading us to face issues that encouraged our migration to Splunk Cloud Platform to support the additional usage from multiple users.

We now expect it to scale and help all additional users benefit from Splunk Cloud Platform.

I rate the customer service technical support for Splunk Cloud Platform at seven, primarily because we have been getting answers from a Splunk POC who has been on-premises helping us out.

However, we have had some delays in getting answers to certain issues we faced during migrations, which has taken some time and resulted in some churn to get resolutions.

Our team has primarily been using AWS services, and the entire team has been using it for all of the seven years we have been here.

Currently, our workloads vary from a very low client headcount early in the day to peak times during the evening hours when people are using more of the network.

Our top priority for using AWS Cloud includes having a lot of different advantages, one of the primary ones being the serverless concept. Instead of having fixed VMs where everything is being hosted, we are now hosted on the cloud, which alleviates worries about scaling our performance at scale. There are many different advantages for which we migrated from on-premises to cloud, including avoiding issues with failovers, which has been facilitated by using AWS.

For cloud migrations, you have to really be aware of what you need to migrate. You need to prioritize everything that you need to work with and also take into account everything that is being done step by step to ensure a smooth transition from your current on-premises resources to the cloud.

You need to start with prioritizing what you really need to migrate, beginning with a prioritizing list. From that point on, you take small steps to migrate whatever is important, followed by migrating the less critical jobs or aspects. Once the migration is done, you verify everything to ensure that your business-critical aspects are taken care of, and you are not missing anything.

My experiences with deploying Splunk Cloud Platform are relatively new, but I can discuss Splunk Enterprise, which has really benefited us significantly. We have been able to do a lot of analysis using Splunk, and we have gained a lot of insight into our applications through it.

Something interesting that happened at the conference before we started is that I went into a session not knowing what to expect, and I went into a completely wrong session that was about edge processor, which is not what I intended to attend.

When I checked my schedule, I realized this is not where I was supposed to be, and I did not even know how to configure Splunk edge processor, so it was a completely different session than what I planned.

Splunk Cloud Platform serves as our primary observability solution, focusing on monitoring logs, metrics, and traces for our systems.

We primarily use Splunk Cloud Platform for log monitoring by setting up feature dashboards in my day-to-day work.

Dashboards are used to monitor business API and business-related metrics from logs, which enhances our workflow.

Splunk Cloud Platform offers exceptional features including quick upgrades, as Splunk Cloud receives the first upgrade for any GA release with rapid support.

Their team manages indexers and search head upgrades, allowing us to focus on bringing data and creating metrics from it and monitoring that output.

Splunk is very helpful in troubleshooting with its SPL, and the AI assistant significantly helps in troubleshooting issues.

Splunk MCP allows quick turnaround with integration into platforms.

The platform's ability to validate application logs, correlate microservices using trace IDs, and enhance security with threat detection greatly impacts our organization.

More guardrails can be implemented, and workload management can be improved in Splunk Cloud Platform.

Ad hoc searches are still being executed with index equal to star, which reveals opportunities for improvement, and there must be a way to enforce this.

Splunk should enforce predicates for users, requiring index equal to an index name instead of allowing index equal to star. This will improve compute utilization and help maintain stability in Splunk Cloud Platform.

I have been working in my current field for the last six years.

We have been using Splunk Cloud Platform for the last six years.

Splunk Cloud Platform is stable.

Scalability is good, as we work with our TAM to ensure our environment is right-sized, preventing any issues or load impacts.

Customer support is very good, and we have a dedicated TAM as well as a dedicated engineer to assist us.

We did not use any other solution previously. We were using Splunk Enterprise before migrating to Splunk Cloud Platform, so we have always been Splunk customers.

We are utilizing federated search with S3 in our organization, redirecting 20 terabytes of low-value logs into S3.

Using federated search heavily allows us to save significantly on costs, which is a very important metric for us.

My experience with pricing, setup costs, and licensing has been very good, as we did not face any issues.

We're receiving all the needed support from the start.

Teams should evaluate their business use case and compare whether that use case can be effectively implemented with Splunk Cloud Platform.

It's important to determine the retention period for logs and to identify high-value logs versus low-value logs; high-value logs can go directly into Splunk Cloud Platform while low-value logs can be redirected to S3, utilizing federated search with S3 for low-value log management.

I would rate this solution a 7 overall.

My main use case for Splunk Cloud Platform is general Splunk usage. Instead of on-prem, we are using cloud.

A quick specific example of how I'm using Splunk Cloud Platform is application monitoring, security monitoring, and enterprise security. Specifically for security monitoring, I'm looking for application-related logging, trying to understand how the applications are progressing, and monitoring the status of the servers and other infrastructure.

The best features Splunk Cloud Platform offers include ease of use, good integration, and easy scalability.

Regarding how the integration works and how the scalability has helped my team, when SVC usage is high or if there is lots of data coming in, the scalability is helping us with indexer clustering.

Splunk Cloud Platform has positively impacted my organization by reducing a lot of time, reducing a lot of incidents, and helping in mitigating issues without major downtimes.

Regarding time saved, we have caught many anomalies and issues related to applications or security data coming in through the data, which gave us proactive monitoring as well related to those.

I think Splunk Cloud Platform can be improved with some improvements on the ingestion pipelines related to edge processors, including all protocols, not only the HEC or other features. Improvements on the HEC side of things would be beneficial.

I have been using Splunk Cloud Platform for almost 10 plus years.

Regarding Splunk Cloud Platform's stability, I would say it is kind of stable, though not completely.

Splunk Cloud Platform's scalability is pretty much easy. It is auto-scaling, so we are not even bothering much about it.

I find the customer support to be good enough.

We previously used an on-prem solution.

I have not seen a return on investment yet; it is just the starting for us and it is completely a non-matured setup as of now on our side.

My experience with pricing, setup cost, and licensing is pretty much seamless.

Before choosing Splunk Cloud Platform, we evaluated our on-prem solution.

My advice to others looking into using Splunk Cloud Platform is to review your data. Do not bring all data; just bring in only what you need. I would rate this product an 8.

My main use case for Splunk Cloud Platform includes observability, log management, alerting, dashboarding, and serving as a centralized logging platform.

We have multiple customers in the company that forward their logs to Splunk Cloud Platform, and I help them onboard their applications, as well as creating their dashboards and alerts on Splunk Cloud Platform. I also use the Model Context Protocol, the Splunk MCP server, so that they can use the Agentic AI, as well as their Q and Cloud CLIs to query the platform using MCP.

The best features Splunk Cloud Platform offers include accessibility, uptime, redundancy, availability, and ease of use.

I find myself relying on availability the most day-to-day, as well as the features that are available such as MCP.

Splunk Cloud Platform has positively impacted my organization because earlier we were an on-premise enterprise having issues with availability and management. The cloud platform has made availability much better, and customers love the experience as it is very quick and responsive.

Uptime has significantly improved since moving to Splunk Cloud Platform, as well as the support that we get from our support peers at Splunk and Cisco, which is very helpful. The availability of the platform in general has improved, and queries run faster.

Splunk Cloud Platform can be improved by providing dedicated documentation, especially regarding the edge processors and MCP, along with continuous updates. Sometimes the model we face gets updated without notifying us, so we need proactive notifications if something is being changed on the back end to notify customers before they see issues.

I have been using Splunk Cloud Platform for six months.

Splunk Cloud Platform is stable most of the time.

Splunk Cloud Platform is highly scalable.

The customer support is rated eight out of ten.

Earlier, we were using a fully on-premise solution, and therefore we had all our servers, search heads, and indexers managed by us. Now we have moved to the cloud.

We did not purchase Splunk Cloud Platform through the AWS marketplace because we already had a license with Splunk Cloud Platform running the enterprise license, and we just migrated it to the cloud.

I cannot share metrics, but we have seen a return on investment.

I did not evaluate other options before choosing Splunk Cloud Platform.

I would rate Splunk Cloud Platform a 10 out of 10.

I chose this rating because the issues we were seeing previously with the on-premise platform are now much better handled, and we do not see them anymore. We do see some new issues occur, but we are learning as we go.

Regarding Splunk Cloud Platform's AI capabilities, I have not used its governance and security features, but I have appreciated the ability to secure data.

The accuracy of Splunk Cloud Platform's output is very good, and the reliability is always also very good.

My impressions of Splunk Cloud Platform's visibility into multiple environments are that we are completely on cloud. Earlier, we were on-premise, and while I have not used Splunk Cloud Platform in a hybrid environment or an on-premise environment, we truly love the cloud environment as it enhances the availability and speed of the platform, and the support provided is very useful.

Regarding Splunk Cloud Platform's zero setup feature for AI models, it works in the best way possible because it is very quick.

My experience with Splunk Cloud Platform's app ecosystem is that it is very easy to manage updates within this ecosystem.

The platform's ability to scale aligns very well with my organization's demand fluctuations, and this has a positive impact on our IT resources as it is very scalable, allowing us to deploy apps very quickly. As the organization demand grows, we can make that happen very quickly too, so the turnaround for customers is very quick.

I use a hybrid of native models over third-party integrations in Splunk Cloud Platform's environment, as some third-party integrations are much more resilient and much more developed than Splunk Cloud Platform's native integrations.

I would highly advise Splunk Cloud Platform to all other users or customers. I recommend they ensure that their support with Splunk and Cisco folks has been confirmed and documented appropriately. Documentation needs to be improved, but the platform overall is very stable and very useful. My overall rating for Splunk Cloud Platform is 10 out of 10.

We use Splunk Cloud Platform for three main purposes: Core, Enterprise Security, and ITSI. These are the three key platforms we utilize for Splunk Cloud Platform.

Splunk Cloud Platform is easy to manage and has a lot of automation in place where my end users can access and provide data detections, anomaly detections, and use it for certain use cases where they can create notables or use Enterprise Security. There are many features that they have seen which are more advanced when compared to the enterprise platform we had previously.

Many users are trying to build custom queries with their limited knowledge of Splunk Searching SPL2, so they use our Cloud AI feature where they can create searches, optimize the queries, and perform valuable visualizations from it.

The best features Splunk Cloud Platform offers include easily manageable instances where there is no need to manage dedicated infrastructure in our data centers, providing a lot of value to end users who can access and provide visibility from any place. Additionally, whenever a new user comes into the organization, it is very easy to handle their access-related issues using SAML, and the authentication process is very straightforward without the hurdles we had on-premises. It also features easily understandable code that they can build.

Previously, during our enterprise phase, we used LDAP as the authentication IAM feature. Now we have started using SAML based on the Azure Cloud platform, which allows us to easily authenticate or grant access to any user without time-consuming approvals. The easiest task in cloud is directly through SAML, where we can grant access to any end user whenever they need access to Splunk Cloud Platform.

In Splunk Cloud Platform, we do get all the relevant information either through XML code that we can deploy to set up any SAML authentication or SAML configurations. That is all process-related, but I have not seen any other good examples apart from providing access to the end users.

The main positive impact of Splunk Cloud Platform on my organization is in terms of cost and infrastructure. These are the two main things that changed our company's Splunk usage, allowing us to provide all integrations and analysis directly from the cloud instead of depending on multiple environments.

Improving Splunk Cloud Platform could be achieved by adding more advanced features such as using AI or observability to build custom props and generating basic templates based on the data, which would help end users who are not familiar with Splunk SPL2 or SPL3. Splunk should provide basic templates to enable end users to build their dashboards based on the data that is already ingested. I refer to this as automating the knowledge objects necessary for users.

The main change I have personally experienced is the need for low-level expertise in Splunk among new users who come and go daily. Since I cannot sit and train each individual, having basic templates and analysis based on data would help our end users effectively build the visualizations they need.

Regarding Splunk Cloud Platform's zero-setup feature for AI models, we still are not utilizing it fully within our organization, so I cannot answer that question.

When I add any data to Splunk for monitoring, it should automatically detect the data and recommend which data models I need to use. It would be greatly appreciated if Splunk could facilitate this feature.

I have been using Splunk Cloud Platform since 2022.

Splunk Cloud Platform is not entirely stable. In the last couple of months, we have experienced issues with instances approaching max resources without alerts, and there have been problems on the AWS side as well, where instances have gone down.

The scalability of Splunk Cloud Platform is good, although our organization is not currently scaled automatically. It is one of the positive features of Splunk Cloud Platform, as it adapts to increased resource consumption from add-ons whenever we request scaling for the necessary environment.

Assessing the platform's ability to scale in alignment with our organization's demand fluctuations can be challenging, and I do not have a clear answer at this moment.

Customer support is great; I would say it is effective as they respond in a timely manner and acknowledge cases properly.

While in the enterprise, we used a perpetual license with limited capacity, such as 15 terabytes, which caused us to encounter many issues when over the limit. With the cloud solution, we gain the flexibility to request increases in resources handled by Splunk Cloud Platform, which greatly benefits us compared to perpetual licensing.

I have seen a significant return on investment by identifying unnecessary applications still ingesting data, which were not in use but kept servers running. We have observed between five to seven percent of the overall enterprise-wide applications that were flagged for frequent analysis and necessary cleanup, which saved my SVCs and licenses, ultimately translating to significant cost savings for my organization.

Before choosing Splunk Cloud Platform, we evaluated other options such as Kibana, which is another visualization tool, SolarWinds for server metrics monitoring, and Dynatrace for similar service-related information. We currently use both Dynatrace and Splunk Cloud Platform, but our main use cases are centered around Splunk Cloud Platform for enterprise security and ITSI.

In on-premises, I have everything under my control regarding analysis, configuration, setup, and installations. However, in the cloud, it is useful as many things get automated and managed by Splunk Cloud Platform. Sometimes, I do not feel confident that the configurations I made are getting reflected in the cloud because I cannot instantly check the metrics, such as pre-deployment and post-deployment resource usage. I have noticed that Splunk Cloud Platform Monitoring Console is still not equipped with the instance resource usage dashboard, which we manage manually. I would appreciate if we can add a Monitoring Console dashboard for monitoring the resources of instances in our SaaS platform.

When compared to on-premises, I feel much more comfortable managing app upgrades or app installations in Splunk Cloud Platform. There are three different platforms: one for Core, one for ITSI, and one for Enterprise Security. I have full control over app upgrades or installations in Core instances, which automatically deploy to indexers. However, for Enterprise Security and ITSI, I need to open a support case, making it less easy for me to manage everything myself on the premium app instances.

I prefer using third-party integrations such as Cribl and BindPlane over native models in Splunk Cloud Platform environment. These third-party solutions offer better comfort for data parsing and routing to multiple destinations, which I have not found as effective in Splunk Cloud Platform.

The subscription model impacts our financial planning for data platform investments as we base costs on SVCs, which are sufficient for our ingestion needs. However, I do not have much financial planning to discuss on the governance aspect.

I would rate this review an 8 overall.