Splunk Enterprise

Vorteile

- Easy to triage and monitor alert (Very fast and gives effective results as compared to other produts)Arcsight,Devo etc- Customer Support is excellent- Threat Hunting can be done effectively with the help of Splunk(IOC based,Corellation based etc)- Log parising is very effective & intelligent.

Nachteile

- The only think i liked least about splunk is the cost involved/pricing model in case of high data volumes.

Vorteile

Splunk is a great platform widely used for log collecting and management but also for implementing some security tools necessary for hardening the cyber security of your company.The main feature I liked is the log collecting that can collect from virtually any IT device and can correlate events for rendering easy the investigating during some security event.

Nachteile

Splunk is a great log management and security platform the ony think I did'nt like is the price compared to others. However it has so many features that the price is right.

In Betracht gezogene Alternativen

Gründe für den Wechsel zu Splunk Enterprise

Vorteile

Splunk has an amazing user interface. It's pretty easy to find what we need on it. Its correlation_id resource is just fantastic.

Nachteile

Occasionally its search didn't work so week for me.

Vorteile

The customer service was incredible and the account rep was kind.

Nachteile

It was very difficult for us to configure with our currents data.

In Betracht gezogene Alternativen

Gründe für den Wechsel zu Splunk Enterprise

Vorteile

1. Provide real-time alerts to manage malware and threats.
2. We can integrate AI and ML as well to take help in detection.
3. Ease of use and implementation.

Nachteile

1. Little bit difficult to overcome the budget with features of splunk.
2. Issues with customer support help.

Vorteile

I love how detailed you can have the dasboards and charts go. It supports tons of chart types, and custom reporting elements. But above all, with the automaetd monitoring, you can have access to continuous insights from large data you wouldn't have been able to make sense of otherwise.

Nachteile

It's quite difficult to set up in the beginning. It took us a lot longer than expected to map our production data onto the system. But once you have it up and running, it works like clockwork

Vorteile

It's a really good tool for monitoring and query logs

Nachteile

The proprietary Query language is difficult to use

Vorteile

Powerful search language
Advanced visualisation
Flexibility to accept logs from any source
High availability
Ease of administration

Nachteile

The cost is too high compared to other log monitoring tools.

In Betracht gezogene Alternativen

Gründe für den Wechsel zu Splunk Enterprise

Vorteile

Splunk is really user-friendly and helpful service for SOC operations.
Dashboard is very good and easy to use.
Remediate threats and provides SOAR for it.

Nachteile

It is quite difficult to set up in the beginning.
It took us a lot longer time to load our data into the system.

Vorteile

Search capabilities
Logging and alerting

Nachteile

User interface
Access issues
Dashboard capabilities

Vorteile

The product has a ton of Features. Everything what you Need when working with logs is already implemented

Nachteile

Due to the rich set of capabilities regarding, searching, transforming and vizualzing data it‘s sometimes quite tricky to find all necessary query commands

Vorteile

It so easy to use and it is very smart and fast.

Nachteile

They want to take it to the cloud, maybe is good maybe not

Vorteile

I love its versatility to handle different kinds of data. While monitoring our internal data, Splunk Enterprise saved a lot of code with its real-time data monitoring and logs analysis feature.

Nachteile

With the growth of the data, costs grew intensively which was out of the budget for our startup company. Initially setting up Splunk was complex as we were new to this.

Vorteile

The visualization based on the metrics is great

Nachteile

Cant think of any cons that i want to write

Vorteile

The easy of setup and integration makes this one of my favorites As well as the real time dashboard

Nachteile

Not much i don't like yet, but maybe the interface can do with an update

Vorteile

Splunk Enterprise's versatility is highly valued by its users, as it is capable of analyzing and managing data from a variety of sources, including machine data, logs, and structured and unstructured data formats. This makes it a valuable tool for organizations with diverse data management needs. In addition, users appreciate the software's efficiency in processing and analyzing large volumes of data quickly, allowing them to make faster and more informed decisions. This is particularly important for organizations that need to respond to data in real-time, as Splunk Enterprise's speed and efficiency can help them stay ahead of the curve.

Nachteile

Splunk Enterprise to be complex and difficult to use, particularly for those who are not familiar with data analysis and management tools. The software has a range of features and capabilities, which can be overwhelming.

Vorteile

- Free to use for small 500MB or less daily ingress, quite nice for small use cases and learning
- No development work required to deploy and provide value.
- Deployment flexibility: client agents are available to use, or clientless configurations for multiple OS platforms. It's also very easy to deploy, not just flexible. its a very simple affair.
- Segmentation of logs: You can create separate instances of of logs to aggregate, based on organization needs. And those instances can have their own individual storage policies to optimize consumption of storage resources.
- Configuration design: Thoughtful and mature documentation and design of the application regarding enterprise-class scaling on network storage.
-POWERFUL tools: The user interface lends itself to learning more about your organization from the logs you collect, through metrics of trends of the logs being gathered. There are also specific modules/add-ons for popular applications to provide more value and event-based monitoring, all without having to develop in-house dashboards and intelligence of those logs.
- Customization: You can create your own queries of logs, and event-based alerts.
- Web-based GUI that clean is powerful
- Sales/Technical Reps are top notch in fielding questions and evaluating environment for deployment. They were extremely helpful in helping our organization develop procedures and scaling our environment for expansion with our existing infrastructure.

Nachteile

- Price: This product is not free for more than the minimal use. Pricing can be very expensive, relative to open source offerings. That is the trade-off you pay for not having in-house development of open source offerings. As this product is priced based on gigabytes of indexed logs, it is important to understand the scope of licensing necessary for your environment to determine if it is a good fit for your organization.
- Watch your saved queries and hardware resources: Users have the ability to create and save queries. Like in database queries, some are more efficient than others. Large inefficient queries can be very resource-intensive. If you notice slowness in day-to-day queries, or navigation in the UI, or resource use in contention, keep an eye on saved queries and user practices.

Vorteile

Splunk comes with lot of in-built templates for each and every feature like log visualisation, dashboarding, traces,etc This makes the developers life lot easier. I can't think of any other logging tool that is snappy as well as accurate.
I love the fact how easily I can plug it in my docker-compose to push container logs.

Nachteile

Even though, it offers numerous features for different needs, each feature has its own learning curve. For instance log visualisation needs querying skills, which may be in natural language but it takes bit of time to get familiar.

Vorteile

The simplified user interface which presents logs in a readable format. Also it's ability to quickly identify integration issues

Nachteile

A mechanism to hide system generated logs that are unimportant would be great

Vorteile

Splunk offers various features whether you need to setup monitoring on your server, application logs based on logs ingestion set alerts so that teams got notified on real time and take actions accordingly. In this way, it helps to monitor application which are mission critical. You can make dashboards in Splunk where you can configure various components such indexes, data inputs and schedule reports as well. To achieve additional functionalities we can install third party apps as well such as AWS Add on for cloud watch log ingestion.

Nachteile

From Admin perspective, I found user access management a little difficult. The roles of access management becomes complicated because some time the config files for that didn't came very handy. Other then that I think all in all Splunk provides fulfill all of the requirements.

Vorteile

If you need real-time grokking into your infrastructure, look no further than Splunk. I love love love the dashboards. It’s easy to tell a story with your data, and the live search is so FAST!

Nachteile

SPL is a little hard to get used to, but once you get the hang of it, it’s not so bad. I recommend downloading their community edition for some great examples of queries and dashboards.

Vorteile

Best tracking and data analysis tool which help to monitor and manage the server and system component in very effective way. Real time Visualization helps to take the quick decision so that desired action can be taken to avoid failure.Best data collection in the forms of log and which helps to define the best set of automation jobs to fix the issue.

Nachteile

There are few components or observation like,1. most of the time observes the slowness in the performance.2. Sometime observe the delay in the issue or updated log reflection on the portal. 3. Need more storage to manage and maintain the lo g which impact organizational costing and budget.

Vorteile

With Splunk Enterprise, it is easy to investigate, detect and remediate threats on devices and endpoints on our network.

Nachteile

It was full of technical overheads when we were customizing Splunk Enterprise features.

Vorteile

The system is highly intuitive to use. It is faster than other solutions I've used on the market and has a huge library of 3rd party plugins to get more from the system. It is easy to create scheduled searches, dashboards, reports etc. but there are a number of additional plugins (at an extra cost) to help with security, single pane of glass and metric collection.

Nachteile

It offers challenges for a decentralized working model. Where Splunk is centrally managed, it is easy to ensure that best practices are maintained. Where the system is opened up for an entire department to utilize and on-board their logs, it becomes more difficult. However, with some creative thinking and good process, this issue can be overcome.

Vorteile

They have a robust platform that I have used for monitoring and analytics. There are a lot of options and customization available when using it.

Nachteile

Because there is so much customization and options available, it can be complicated to learn.

Vorteile

Mi piace molto la facilità di ricerca dati del Prodotto. Molto user Friendly

Nachteile

Il costo elevato se confrontato con altri SIEM

Vorteile

Il linguaggio che utilizza splunk per le query e la facilità di utilizzo

Nachteile

Purtroppo devo ammettere che il costo di Splunk Enterprise è molto alto

Vorteile

Intuitive, customizable and really usefull in everyday work. The different section "smart, quick and detailed" gives you the freedom to choice how to interact with the tool.

Nachteile

Some bugs on the Alerts section to edit makes the experience worse than I expect.

Vorteile

Incredibly powerful tool for log collection. It is very scalable and can be integrated with a wide variety of other tools and platforms. It is well-documented and supported by a large user community, making it easier to find solutions to common challenges.

Nachteile

It feels somewhat dated compared to newer solutions on the market. Its interface and some functionalities haven't evolved as much as other modern tools. It can also be quite expensive.

Vorteile

Capabilities and features of the tools provided are useful

Nachteile

This is one of the costly tools Available in the market

Vorteile

L'interface utilisateur est assez intuitive pour une prise en main rapide et facile de la solution. Splunk Enterptise dispose de fonctionnalités puissantes pour rechercher, présenter sous format compréhensible par l'humain et analyser des données issues de différentes sources. Cet outil est d'une grande aide pour des prises de décisions éclairées.

Nachteile

L'installation et la configuration de la solution exige des connaissances approfondies ce qui peut être difficile à appréhender pour un nouvel utilisateur.

Vorteile

The ability to parse data and locate critical information is unparalleled

Nachteile

Search tools could be a little more user friendly.

Vorteile

Splunk is easy to use, also non technical persons can also use and create their dashboards. Easy to implement and very easy to use the query language, the documentation is also sufficient

Nachteile

We cannot setup the alerts for realtime. we only us it for logging and not for metrics. the maintenance of the dashboards are very time offering.

Vorteile

1. Excellent ML background
2. Dashboard looks classy
3. Multiple external entries possible unlike a lot other tools

Nachteile

1. Very limited variations in reporting
2. Real-time model is not great
3. Not mobile friendly

Vorteile

Possibility to export query results in a variety of formats.

Nachteile

User interface is not intuitive and it requires a steep learning curve

Vorteile

It has amazing firewall protection features
It makes handling security monitoring and improving networks security easy
log monitoring is easy

Nachteile

No regrets as Splunk Enterprise meets needs.

Vorteile

Produces analytical information with highly interactive tables, charts and graphics. Highly customizable to obtain specific data.

Nachteile

It can be complex at first to customize search queries since Slpunk handles its own terms and typing methods.

Vorteile

The software is user-friendly and has powerful data visualization tools.

Nachteile

I wish the pricing was more affordable for small businesses like mine, and some features can be overwhelming for beginners.

Vorteile

Utiizzzo Splunk da molto tempo e si è rivelato sempre eccellente. Nel mio lavoro attuale lo uso per l’analisi dei log di sicurezza e, a mio parere, può essere considerato uno dei migliori strumenti in circolazione per questo scopo. È possibile effettuare approfondite analisi dei log, fornisce informazioni di sintesi di qualità e consente la creazione cruscotti che semplifica la visualizzazione e la comprensione dei dati. Splunk permette inoltre di crede allarmi personalizzati e report bassi sui log analizzati.

Nachteile

È avido di risorse, quindi bisogna stare attenti alla macchina e l’host che si utilizza inoltre è necessario una buona conoscenza di XML per utilizzarlo al meglio e creare ottimi report.

Vorteile

Ease of use, really convenient, specially for logs reporting and search with the indexer

Nachteile

Can be tricky to use sometimes without the proper training

Vorteile

The way it can be integrated to collate all required information at one place

Nachteile

I have not see any least things so far in the usecases

Vorteile

Son moteur de recherche et ses tableaux de bord personnalisables offrent une visibilité approfondie sur les systèmes et les réseaux

Nachteile

Sa tarification basée sur le volume de données indexées peut rapidement devenir coûteuse

Vorteile

It helped me enormously in my job as IT INC Management including detailed reports and alerting any necessary information.

Nachteile

It has a somewhat complex paring curve and there are no simple tutorials or parallel design of tutorials for new managers

Vorteile

J’ai pu me servir de Splunk lors d’une mission chez un client. Nous étions face a un problème : beaucoup de datas sur nos serveurs de productions et des difficultés pour les récupérer quotidiennement et les analyser. Après une formation sur Splunk et quelques heures de travail nous avions notre premier Dashboard remontant beaucoup de données de nos serveurs de productions. Le plus intéressant était de voir en réel nos pannes serveurs. Grâce à Splunk la mission était plus facile.

Nachteile

Dès qu’il fallait aller vers un cas complexe de récupération de données croisées avec d’autres états de serveur, il fallait alors être plus compétent en programmation. Ça a bloqué certains membres de l’équipe car il leur fallait d’autres formations pour suivre.

Vorteile

great monitoring tool. We have been using it for monitoring puposes, creating visualizations and dashboards which helps us to keep track of how our service is behaving. easy UI and excellent search analysis

Nachteile

UI can be a bit more intuitive and dashboards support can be made btr and easy

Vorteile

Data visualization is very clear and easy to use.

Nachteile

The possible to share with many people data and dashboards.

Vorteile

Capable de bâtir des tableau de bord très personnalisé et devient un outil d'analyse très puissant. On peut monitorer facilement nos équipements

Nachteile

Pour bien profiter de Splunk, on doit connaitre beaucoup de fonction.
Peu efficace pour un débutant

Vorteile

I used a lot of SIEMs in my career,
Splunk is the best one out there.
Comfortable, Easy to use, Great big data platform.

Nachteile

Easy to use, versatile, A lot of options, dashboards

Vorteile

Splunk Enterprise has powerful search capabilities and customizable dashboards.

Nachteile

The learning curve for setting up queries can be steep, and the pricing can be high for smaller teams.

Vorteile

Splunk offers a lot of ways to connect with multiple data providers and sources to populate the reports and dashboards you need to show your business performance or data.

Nachteile

Customer support was a little slow. Requires a little knowledge of how to construct queries.