Splunk Enterprise

Avantages

The software is user-friendly and has powerful data visualization tools.

Inconvénients

I wish the pricing was more affordable for small businesses like mine, and some features can be overwhelming for beginners.

Avantages

Data visualization, Analytics skills with AI-powered and can handle data in TB/per day without any interruptions in services. Live dashboards, developing use-cases and their capabilities (correlation).

Inconvénients

complex architecture and efficient skills are required, financial is also not feasible for small and medium customers. no inbuilt query builders for beginners to understand the platform.

Alternatives envisagées 

AlienVault OSSIM

Pourquoi choisir Splunk Enterprise 

Its niche player was can handle only a few products data and not so feasible in terms of query building and customization in dashboards. Good for small businesses not for enterpraises.

Logiciel antérieur 

AlienVault OSSIM

Pourquoi passer à Splunk Enterprise

Not so feasible in handling data and its simple architecture cannot handle logs from all the data sources.

Avantages

Splunk makes it easy to search through various data including logs. In the past I have had to pour through logs in order to find the one lines among the 100 of thousands of lines. Splunk allows me to search through those logs in a matter of seconds vs the hours it used to take.

Inconvénients

Most of enterprise setup is done through the command line. It would be nice to have cluster configuration (index creation) as part of the UI.

Alternatives envisagées 

Elastic Stack

Pourquoi passer à Splunk Enterprise

Spelunking was simple to setup and the customer service is great. It performed very well and proved to be a valuable assets to run in Production.

Avantages

The product has a ton of Features. Everything what you Need when working with logs is already implemented

Inconvénients

Due to the rich set of capabilities regarding, searching, transforming and vizualzing data it‘s sometimes quite tricky to find all necessary query commands

Avantages

The search feature allows for quick searching of signatures for new KBs

Inconvénients

It feels very clunky to set up, explained by the whole certification track just for using splunk..

Avantages

The visualization based on the metrics is great

Inconvénients

Cant think of any cons that i want to write

Avantages

The easy of setup and integration makes this one of my favorites As well as the real time dashboard

Inconvénients

Not much i don't like yet, but maybe the interface can do with an update

Avantages

Splunk Enterprise's versatility is highly valued by its users, as it is capable of analyzing and managing data from a variety of sources, including machine data, logs, and structured and unstructured data formats. This makes it a valuable tool for organizations with diverse data management needs. In addition, users appreciate the software's efficiency in processing and analyzing large volumes of data quickly, allowing them to make faster and more informed decisions. This is particularly important for organizations that need to respond to data in real-time, as Splunk Enterprise's speed and efficiency can help them stay ahead of the curve.

Inconvénients

Splunk Enterprise to be complex and difficult to use, particularly for those who are not familiar with data analysis and management tools. The software has a range of features and capabilities, which can be overwhelming.

Avantages

There are lot of features which Splunk offers -
1) We can onboard data from any server, device or system using Universal Forwarder
2) Onboarded data are later stored in Indexers and searched further in Search Head for analyzing the internal logs
3) Using the data we can create customizable Dashboards and get proper insights of data and create Alerts to identify any kind of Threat or anomalies running in environment
4) Deployment is very easy on-prem servers
5) We can also use Hybrid Deployment on Cloud as well.

Inconvénients

1) As it give large amount of features but licensing is too high
2) There are lot of other Open Source software which can be used as alternative of Splunk as Analytic tool because Splunk is paid one.

Avantages

It is a very subtle program, when generating the setup it is not necessary to have a great knowledge of programming to install it, but to solve some configuration errors, when you start what I like the most is that you start from day one to organize your applications, then From that you can easily configure cybersecurity for each program, I particularly like the monitoring of data programs and that the program alerts you with notifications so that you see errors that sometimes jumps in the program.

Inconvénients

What I don't like and I see that it is something widespread is that it has very poor support in technical help, I think that the old technical support collaborators have left and people who are not so qualified have arrived to answer the tickets.For my part it is not a big problem since I am a researcher and with the information that is on the splunk website it is enough for me to generate the resolutions of problems.

Avantages

We are using Splunk for log monitoring . It is integrated with Kubernetes and pivot cloud via data bus. By Splunk we get Realtime log application. It provides best visualization of data generated by system. Splunk also provide option to filter data based on data range and time. We can configure email alert for specific issue. Splunk also provide ML model for data. Splunk use simple query to get data ,everyone can easily learn Splunk query.

Inconvénients

I haven't found any issue yet the only problem with Splunk I have that log in Splunk is scattered . We need to build good query or better logging mechanism at application side.

Avantages

It an intelligent business tool that provided me an opportunity to customize and build report from large volume of data from different departments within the 13 Africa countries in telecommunication sectors. The platform allows data to be consolidated accordingly to the organization need and produces visualized reports of dashboard features. I also noted that the system can analyst unstructured large volume of data speedily and is reliable and web based allowing for user flexible accessible from any part of the world if you have internet. The systems have been reliable and secured from the time (2 years) I started using it without any system intermittent, system errors and cyber-attack.

Inconvénients

The system is built and use-able with structured and unstructured organization though the price in foreign currency could hamper small and medium organization to use it especially in most Africa country where the local currency has depreciated against the major trading foreign currency.so the Forex pricing is a challenge.
The navigation of the platform will require minor training though if the user is computer proficient, they would management with minor challenge and interpretation of the data. So, first time user it can be difficult to use it
It will depend on internet for access and internet tend to be pricey in most African country and therefore could increase the business cost for small and medium enterprise. It can increase business cost if not fully used

Avantages

Through its robust log analysis and ability to collect data from different sources, we can easily perform analysis on various data and predict any future operational hazards. Splunk enterprise efficiently monitors our log activities and and gives results to any queries at faster speed than most SIEM tools.

Inconvénients

The searches can be complex at times and the messages on query errors aren't always specific.

Avantages

Block security threats on endpoints.

It enhances applications development.

Inconvénients

The price is high but the results are remarkable.

Avantages

Splunk is very easy to use due to high community support and many video tutorials available online for new users to learn.
Functionalities are robust and simple to use. Data retrieval and visualisation is nice and easy if you know the right querying process.
Machine Learning supports enhances performance for the cloud, especially. It collect wide variety of data and still it amaze you the way it retrievs it.

Inconvénients

There are many tools available in market which are potential competitors of this tool and that too at reasonable pricing. Splunk offers more functionalities but costs you too much if you look at the work it does.
Complex queries may require large CPU usage and may even freeze or atleast slow down the system for a while. Need to be specific while querying the data.

Avantages

Splunk Enterprise is best tool to analyze the data based on different visualization. It help us to lookup distributed logs for micro-services . It enables field based lookup. For complex logging, we can use search query using expression. We can create multiple reports/charts for visualization such as a pie or bar chart for our data. Best feature what i like , We can visualize our search results and share them with others using dashboard panels. If Already have a dashboard, we can add a new panel from a report, clone from another dashboard, or add a prebuilt panel. Fully customization available. Interfaces is very flexible. We export it in different formats, or refresh it to visualize the newest data. Online Support is available through different community.

Inconvénients

Search query builder is fully based on technical. for Non technical users, its really difficult to lookup logs. Sometimes, error thrown by query builder is more difficult to understand. Deep Learning is required to use splunk for production data. For Large application installation, it need to manage more.

Avantages

Mi piace molto la facilità di ricerca dati del Prodotto. Molto user Friendly

Inconvénients

Il costo elevato se confrontato con altri SIEM

Avantages

Intuitive, customizable and really usefull in everyday work. The different section "smart, quick and detailed" gives you the freedom to choice how to interact with the tool.

Inconvénients

Some bugs on the Alerts section to edit makes the experience worse than I expect.

Avantages

Splunk has an amazing user interface. It's pretty easy to find what we need on it. Its correlation_id resource is just fantastic.

Inconvénients

Occasionally its search didn't work so week for me.

Avantages

Incredibly powerful tool for log collection. It is very scalable and can be integrated with a wide variety of other tools and platforms. It is well-documented and supported by a large user community, making it easier to find solutions to common challenges.

Inconvénients

It feels somewhat dated compared to newer solutions on the market. Its interface and some functionalities haven't evolved as much as other modern tools. It can also be quite expensive.

Avantages

Il linguaggio che utilizza splunk per le query e la facilità di utilizzo

Inconvénients

Purtroppo devo ammettere che il costo di Splunk Enterprise è molto alto

Avantages

Search capabilities
Logging and alerting

Inconvénients

User interface
Access issues
Dashboard capabilities

Avantages

The ability to parse data and locate critical information is unparalleled

Inconvénients

Search tools could be a little more user friendly.

Avantages

Splunk is easy to use, also non technical persons can also use and create their dashboards. Easy to implement and very easy to use the query language, the documentation is also sufficient

Inconvénients

We cannot setup the alerts for realtime. we only us it for logging and not for metrics. the maintenance of the dashboards are very time offering.

Avantages

Possibility to export query results in a variety of formats.

Inconvénients

User interface is not intuitive and it requires a steep learning curve

Avantages

It has amazing firewall protection features
It makes handling security monitoring and improving networks security easy
log monitoring is easy

Inconvénients

No regrets as Splunk Enterprise meets needs.

Avantages

Produces analytical information with highly interactive tables, charts and graphics. Highly customizable to obtain specific data.

Inconvénients

It can be complex at first to customize search queries since Slpunk handles its own terms and typing methods.

Avantages

1. Excellent ML background
2. Dashboard looks classy
3. Multiple external entries possible unlike a lot other tools

Inconvénients

1. Very limited variations in reporting
2. Real-time model is not great
3. Not mobile friendly

Avantages

Ease of use, really convenient, specially for logs reporting and search with the indexer

Inconvénients

Can be tricky to use sometimes without the proper training

Avantages

The way it can be integrated to collate all required information at one place

Inconvénients

I have not see any least things so far in the usecases

Avantages

Utiizzzo Splunk da molto tempo e si è rivelato sempre eccellente. Nel mio lavoro attuale lo uso per l’analisi dei log di sicurezza e, a mio parere, può essere considerato uno dei migliori strumenti in circolazione per questo scopo. È possibile effettuare approfondite analisi dei log, fornisce informazioni di sintesi di qualità e consente la creazione cruscotti che semplifica la visualizzazione e la comprensione dei dati. Splunk permette inoltre di crede allarmi personalizzati e report bassi sui log analizzati.

Inconvénients

È avido di risorse, quindi bisogna stare attenti alla macchina e l’host che si utilizza inoltre è necessario una buona conoscenza di XML per utilizzarlo al meglio e creare ottimi report.

Avantages

It helped me enormously in my job as IT INC Management including detailed reports and alerting any necessary information.

Inconvénients

It has a somewhat complex paring curve and there are no simple tutorials or parallel design of tutorials for new managers

Avantages

great monitoring tool. We have been using it for monitoring puposes, creating visualizations and dashboards which helps us to keep track of how our service is behaving. easy UI and excellent search analysis

Inconvénients

UI can be a bit more intuitive and dashboards support can be made btr and easy

Avantages

Splunk offers a lot of ways to connect with multiple data providers and sources to populate the reports and dashboards you need to show your business performance or data.

Inconvénients

Customer support was a little slow. Requires a little knowledge of how to construct queries.

Avantages

The saying "you only get out what you put in" is rather apt when utilising Splunk as a SIEM tool - i.e. the more logs / data you can feed into the solution the better the results. Ingesting multiple log files from numerous systems / applications is essential when reviewing security incidents and ensures everything is in one place.

Inconvénients

For all that is good with Splunk, the costs are rather high and could force Customers to other solutions unless they make themselves more competitive in the pricing market

Avantages

Data visualization is very clear and easy to use.

Inconvénients

The possible to share with many people data and dashboards.

Avantages

It so easy to use and it is very smart and fast.

Inconvénients

They want to take it to the cloud, maybe is good maybe not

Avantages

Splunk Enterprise has powerful search capabilities and customizable dashboards.

Inconvénients

The learning curve for setting up queries can be steep, and the pricing can be high for smaller teams.

Avantages

Splunk Enterprise is a great tool for security analytics, IT operations, and business intelligence. I especially like the way it can help me identify potential threats and improve our IT infrastructure.

Inconvénients

The pricing for Splunk Enterprise may be out of reach for some small businesses.

Avantages

I used a lot of SIEMs in my career,
Splunk is the best one out there.
Comfortable, Easy to use, Great big data platform.

Inconvénients

Easy to use, versatile, A lot of options, dashboards

Avantages

es una herramienta de facin configuracion e implementacion, aparte de ser intuitiva.

Inconvénients

hay veces que se traba la interfas cuando se sastura el equipo.

Avantages

Splunk is a great tool for cyber security professionals wanting to build out their security infrastructure.

Inconvénients

There are other options out there that doesn't require as much configuration.

Avantages

I love its versatility to handle different kinds of data. While monitoring our internal data, Splunk Enterprise saved a lot of code with its real-time data monitoring and logs analysis feature.

Inconvénients

With the growth of the data, costs grew intensively which was out of the budget for our startup company. Initially setting up Splunk was complex as we were new to this.

Avantages

splunk is the best tool for real time analysis and monitoring tool and also it is providing the powerful threat incident response.

Inconvénients

from my perspective, these no downside of the splunk . but about costing is too much for single user

Avantages

Without worrying too much about data type or normalization, Splunk Enterprise can efficiently manage massive amounts of data from numerous sources. Data may be accessed in a flash, and there are a number of options for tailoring and integrating data analysis workflows to create bespoke dashboards or utilizing apps from our other product partners.

Inconvénients

There isn't much I dislike about splunk, however if we have to be picky, it would be that it's more difficult to maintain as an administrator when splunk is installed on outdated architecture.

Avantages

Powerful and versatile data mining tool with excellent integration capabilities.

Inconvénients

Challenging initial setup and learning curve, particularly with query language and high cost.

Avantages

Splunk Enterprise offers real-time data analysis tools makes it possible for my institution to see and take immediate action against security risks, performance difficulties, and other operational concerns.

Inconvénients

Splunk Enterprise is really expensive and it is a huge part in our annual budget because we require add-ons.

Avantages

It's giving live alert, triggers, dashboard system based on rules we already set. the dashboard helps to see and virtualize the data.

Inconvénients

The only concern I feel it consumes the system space due to this my system running slow. without knowledge of Splunk query language, it is difficult to handle.

Avantages

I am able to quickly act on pending issues as and when they arise and data is well protected because of their authorization features

Inconvénients

We had to purchase additional computers with higher specs than what we previously had to be able to use Splunk effectively

Avantages

Easy to install agents on servers, it can parse any form of data easily, Splunk can detect anomalies quite easily and the UBEA feature is amazing.

Inconvénients

The cost of this solution is high, and customer service is bad. Apart from that Splunk SPL language is difficult to learn.