Splunk Cloud [Private Offer Only]

My main use case for Splunk Cloud [Private Offer Only] involves multiple tasks, not specific to one area. I onboard data from multiple sources using a couple of data brokers like Universal Forwarder, OpenTelemetry Collector, apps, and add-ons from Splunk, along with writing scripts to onboard that data into Splunk Cloud [Private Offer Only]. I also use Cribl for one of the data brokers via cloud-to-cloud integrations to avoid coming to the private network and then going to the public cloud, which is Splunk Cloud [Private Offer Only]. Additionally, I create dashboards, reports, and alerts for consumers based on their use cases, and I utilize ITSI for production. I have multiple actions that trigger external actions mainly on Splunk ITSI to ServiceNow, Jira, Slack, and Teams for tasks like stopping or starting Windows or Linux machines. It involves multiple activities that I manage there.

A specific example of how I use Splunk Cloud [Private Offer Only] is when I have a consumer using Orbit as a data source. From Orbit, I get logs into Splunk Cloud [Private Offer Only] via HEC token, where I create alerts targeting errors, missing sets of logs, or applications being down. I also have a dashboard created for the consumer to visualize data such as error counts, warnings, and the types of applications having issues. It helps me check for errors in transactions and integrates with ServiceNow to trigger incidents directly to their queue whenever it meets the consumer's requirements. For critical P1s and P2s, I use Splunk On-Call functionality, which triggers an on-call feature to notify end-users about created P1 or P2 incidents in ServiceNow, prompting them to act accordingly because P3 or P4 incidents are less urgent with SLA considerations.

The best features Splunk Cloud [Private Offer Only] offers include the Ingest Processor, which allows me to filter out or stop data ingestion from the data source to reduce ingestion and storage licensing costs. I am currently exploring this good feature.

Regarding my experience with the Ingest Processor, I have a consumer whose application forwards data into Splunk Cloud [Private Offer Only]. Unfortunately, when there is a restart, old duplicate data is also ingested alongside the current data. For example, the last 24 hours' data amounts to 15 to 20 GB, and when the application restarts, an additional 15 to 20 GB of duplicate data ingests. Consequently, instead of the expected 15 to 20 GB, I am looking at almost 30 to 40 GB of ingestion cost. By using the Ingest Processor, I can effectively stop the duplicate data ingestion into Splunk Cloud [Private Offer Only].

Splunk Cloud [Private Offer Only] has positively impacted my organization in many ways. For instance, if something goes wrong with an application I monitor, without Splunk Cloud [Private Offer Only], notifications are unavailable, and support staff would not be notified, which saves time. I also have proactive alerts and predictive analysis, saving costs by preventing the ingestion of duplicate data into Splunk Cloud [Private Offer Only]. From a security standpoint, I have audit-related features to address issues or malicious attacks. Utilizing predictions and AI functions aids me in multiple areas of operations.

To improve Splunk Cloud [Private Offer Only], the latest version 10.5 introduces a UI that feels somewhat difficult to navigate compared to earlier versions, making it uncomfortable. A smoother transition from the older versions, such as 10.3 to 10.5, would be beneficial, and they should avoid making significant changes to the entire visualization.

I have been using Splunk Cloud [Private Offer Only] for more than eight years.

Splunk Cloud [Private Offer Only] is stable.

Regarding the scalability of Splunk Cloud [Private Offer Only], I can scale up or down based on the agreements I have made.

Customer support for Splunk Cloud [Private Offer Only] is quite good, but there is room for improvement that they should address.

I would rate the customer support for Splunk Cloud [Private Offer Only] as a seven to eight, although the time taken for responses could be improved.

My experience with pricing, setup costs, and licensing is positive since I am part of the Splunk Community, along with being a Splunk MVP and a member of Splunk Trust, which enabled me to secure a good deal.

Before choosing Splunk Cloud [Private Offer Only], I did not evaluate other options, as I have been part of Splunk for a long time and decided to continue with it without exploring other functionalities.

My advice for others considering Splunk Cloud [Private Offer Only] is that it is a powerful tool for log data management, allowing faster analysis to identify issues compared to other tools I have encountered. I would rate this product a nine overall.