Try our new research platform with insights from 80,000+ expert users

ArcSight Logger vs Splunk Enterprise Security comparison

OpenText and Splunk are both solutions in the Log Management category. OpenText is ranked #30 with an average rating of 6.7, while Splunk is ranked #2 with an average rating of 8.4. OpenText holds a 0.8% mindshare in Log Management, compared to Splunk’s 7.3% mindshare. Additionally, 80% of OpenText users are willing to recommend the solution, compared to 93% of Splunk users who would recommend it.
ArcSight Logger
Read 31 ArcSight Logger reviews
  • 1,433 Views
  • 1,292 Comparison Views
80% willing to recommend
Splunk Enterprise Security
Read 308 Splunk Enterprise Security reviews
  • 15,020 Views
  • 12,343 Comparison Views
93% willing to recommend
 

Comparison Buyer's Guide

Download the report
Executive SummaryUpdated on Apr 6, 2025

Splunk Enterprise Security and ArcSight Logger are prominent in the security information and event management category, focusing on log management and analytics. Splunk appears to have the edge due to its comprehensive feature set.

Features: Splunk Enterprise Security provides flexibility, scalability, and advanced querying, integrating with various data sources and offering powerful operational intelligence. Its Search Processing Language (SPL) and visualization capabilities allow complex data analysis. ArcSight Logger focuses on robust log management and good searching capabilities, although it lacks some advanced features of Splunk.

Room for Improvement: Splunk Enterprise Security could enhance its user interface, integration capabilities, and provide better predictive analytics and machine learning tools. Its pricing could be more competitive. ArcSight Logger requires improvements in threat analytics, intelligence management, and user interface fluidity, along with better network integration and a streamlined setup process.

Ease of Deployment and Customer Service: Splunk Enterprise Security supports public cloud, on-premises, and hybrid cloud deployments, offering extensive support resources. Although technical support satisfaction is generally high, delays may occur. ArcSight Logger is seen mostly in on-premises environments with competent but often costly support, and its deployment complexity might necessitate deeper technical expertise compared to Splunk.

Pricing and ROI: Splunk Enterprise Security is generally considered a premium product with higher costs that are justified by its extensive features, though it offers substantial ROI for organizations needing advanced analytics. ArcSight Logger, while expensive, provides licenses comparable in traditional log management solutions, offering ROI based on feature alignment with enterprise needs.

DOWNLOAD THE COMPLETE REPORT
To learn more, read our detailed ArcSight Logger vs. Splunk Enterprise Security Report (Updated: April 2025).
Buyer's Guide
ArcSight Logger vs. Splunk Enterprise Security
April 2025
Download the complete report
Helped 851,604 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

ArcSight Logger
Ranking in Log Management
30th
Average Rating
7.8
Reviews Sentiment
6.7
Number of Reviews
31
Ranking in other categories
No ranking in other categories
Splunk Enterprise Security
Ranking in Log Management
2nd
Average Rating
8.4
Reviews Sentiment
7.6
Number of Reviews
308
Ranking in other categories
Security Information and Event Management (SIEM) (1st), IT Operations Analytics (1st)
 

Mindshare comparison

As of May 2025, in the Log Management category, the mindshare of ArcSight Logger is 0.8%, down from 1.1% compared to the previous year. The mindshare of Splunk Enterprise Security is 7.3%, down from 10.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management
 

Featured Reviews

Geraldo Freitas - PeerSpot reviewer
Enhances our security incident investigation but not good for correlation
Investigation is good when you know what you want to search for in Logger. The most difficult part is parsing the logs and configuring the parsers. For investigation, it's good. For correlation, it's not good. We use Sentinel, and Sentinel has pre-built use cases that are much easier to configure. So, it enhances our security incident investigation. We have inbound integration, but configuring the parsers is sometimes very difficult. We only have two use cases where we have a correlation set up. We send the information to Check Point to block IP addresses when we see a lot of blocks from the same source. We have a trigger. So, Logger automatically blocks these IP addresses. We could have Logger put them on a blacklist. So, it offers the ease of integration.
Read full review
ROBERT-CHRISTIAN - PeerSpot reviewer
Has many predefined correlation rules and is brilliant for investigation and log analysis
It is very complicated to write your own correlation rules without the help of Splunk support. What Splunk could do better is to create an API to the standard SIEM tools, such as Microsoft Sentinel. The idea would be to make it less painful. In ELK Stack, Kibana is the query language with which you can search log files. I believe Splunk has also a query language in which they search their log files, but once you have identified the log file that you want to use for further security correlation, you want to very quickly transport that into your SIEM tool, such as Microsoft Sentinel. That is something that Splunk could make a little bit less painful because it is a lot of effort to find that log file and forward it. An API with Microsoft Sentinel or a similar SIEM tool would be a good idea.
Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"I am impressed with the product's ability to pick up logs. It also has UEBA which has reduced the time to take charge of the events."
"The log digestion features from threat intelligence platforms like Recorded Future or Talos are valuable."
"The most valuable feature is the search capability, which is simple to use."
"In our country we are a little bit private in terms of solutions, so we are just starting to use the basic data capture. Now some users can start to use additional features that come with Micro Focus ArcSight like user behavior analytics for investigating."
"The machine learning is a good feature."
"The ability to customize the solution in great detail is its most valuable features. We can customize the use cases and also have the ability to do scripting. We can personalize our dashboard as well. The scalability the solution offers is quite impressive."
"The solution provides information about the risk factors."
"It's a brilliant log collection tool, and it can handle hundreds of thousands of servers in a single shot to ingest the data."
More ArcSight Logger pros
"Splunk allows us to customize processing and dashboards, which helps us take care of our customers' needs."
"The alerts are very effective."
"Splunk has machine learning which is a valuable feature."
"The consolidated overview of all the events that come in through our environment and an easy-to-access interface for all our end users are valuable."
"The most valuable feature of Splunk Enterprise Security is website activity monitoring."
"Being able to aggregate detection and alerts from various sources is valuable. Like everyone else, we have a wide range of tools in our shop. We are able to stop at one spot and look at all the data. All the data is able to come through, and we can then jump from source to source or index to index. We can dig deep whenever we need to and get a good high-level understanding."
"Splunk Enterprise Security is a valuable tool that allows us to monitor data from the APS daily."
"The solution's most valuable feature is that it helps with our use cases to detect anomalies in our data and it is important to my company since we have a lot of data on different logs on the systems."
More Splunk Enterprise Security pros
 

Cons

"The integration with other systems could be improved."
"It's not a new product and is a bit complex. So, it requires a person dedicated to working on it and to know about it in and out. It is a huge product, and the search operation is a bit complicated for a new user or someone who has not used it for long. So for that person, it becomes a bit difficult."
"The next release should have AI capabilities."
"I would like to see better scheduling in the next release of this solution."
"You have limited reporting capabilities and I wouldn't choose ArcSight Logger for this purpose."
"It would be better if the product is cheaper."
"I think the ArcSight team should try to simplify legacy products for the customers, because that product is not easy to use or to work with. It needs more more competency or appeal to use. We hope Micro Focus is trying to resolve this."
"The solution could be improved in maintenance settings."
More ArcSight Logger cons
"This is not really a monitoring solution."
"Splunk is more expensive than other solutions."
"The administration of the cluster and app deployment to indexers or search heads can be done only using ssh access and command line, there is no GUI tools for that."
"We'd like to have the number of devices covered under the license to be increased."
"It works as intended for us, and we are getting everything that we need out of it. If anything, its initial setup can be improved a bit."
"Its setup is a little bit complex for a distributed environment. Their support can also be better. If we miss the response for more than a week, they usually close the case. Sometimes, it can take us more than a week to reply."
"I would like to see more SIEM functionality and a better ticket tool."
"The configuration had a bit of a learning curve."
More Splunk Enterprise Security cons
 

Pricing and Cost Advice

"I would rate the product a seven out of ten since it's an enterprise product."
"Pricing is reasonable compared to similar tools on the market. They offer perpetual licenses."
"We have a lifetime license, so we don't pay a monthly fee."
"ArcSight Logger is very expensive compared to their competitors, but when we talk to the customer and explain what the features are and how we can scale, they understand. Still, ArcSight is more expensive than the competition."
"It's not cheap at all as it's a big product and has been in the market for quite some time now."
"I rate the product’s pricing a seven out of ten, where one is inexpensive, and ten is expensive."
"ArcSight is an expensive solution."
"The pricing is quite harsh."
"Splunk's cost is very high. They need to review the pricing. They have to go back and totally readdress the market."
"While Splunk offers generous developer licenses and obtaining annual licenses is straightforward, the cost is a major consideration."
"It would be nice if the pricing were cheaper. However, we did purchase it."
"Splunk is not free."
"It is economical than other solutions."
"Splunk has always been on the expensive side."
"The pricing model is expensive and a nightmare based on the amount of data."
"Expensive compared to other options."
More Splunk Enterprise Security pricing and cost advice
report
See which vendors are best for you
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
See recommendations
851,604 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
Read full review
 

Top Industries

By visitors reading reviews
Financial Services Firm
20%
Computer Software Company
17%
Government
9%
Educational Organization
6%
Financial Services Firm
15%
Computer Software Company
14%
Manufacturing Company
8%
Government
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about ArcSight Logger?
We have a trigger. So, Logger automatically blocks these IP addresses. We could have Logger put them on a blacklist.
See all answers
What is your experience regarding pricing and costs for ArcSight Logger?
The pricing isn't the problem. We have a lifetime license, so we don't pay a monthly fee.
See all answers
What needs improvement with ArcSight Logger?
The solution has room for improvement. We're currently upgrading to the newer version, where they have something like Kafka, a hub for all solutions feeding information into Logger. However, I thin...
See all answers
What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
See all answers
What is a better choice, Splunk or Azure Sentinel?
It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...
See all answers
How does Splunk compare with Azure Monitor?
Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring information from different sources. Splunk is very good at alerting us if we...
See all answers
 

Comparisons

IBM Security QRadar vs ArcSight Logger Logo
IBM Security QRadar vs ArcSight Logger
Compared 34% of the time
Elastic Security vs ArcSight Logger Logo
Elastic Security vs ArcSight Logger
Compared 10% of the time
Wazuh vs ArcSight Logger Logo
Wazuh vs ArcSight Logger
Compared 8% of the time
Grafana Loki vs ArcSight Logger Logo
Grafana Loki vs ArcSight Logger
Compared 4% of the time
LogRhythm SIEM vs ArcSight Logger Logo
LogRhythm SIEM vs ArcSight Logger
Compared 4% of the time
More ArcSight Logger Competitors
Wazuh vs Splunk Enterprise Security Logo
Wazuh vs Splunk Enterprise Security
Compared 9% of the time
IBM Security QRadar vs Splunk Enterprise Security Logo
IBM Security QRadar vs Splunk Enterprise Security
Compared 8% of the time
Dynatrace vs Splunk Enterprise Security Logo
Dynatrace vs Splunk Enterprise Security
Compared 8% of the time
Datadog vs Splunk Enterprise Security Logo
Datadog vs Splunk Enterprise Security
Compared 5% of the time
More Splunk Enterprise Security Competitors
 

Product Reports

Buyer's Guide
ArcSight Logger
May 2025
ArcSight Logger reportDownload ArcSight Logger product report
Buyer's Guide
Splunk Enterprise Security
April 2025
Splunk Enterprise Security reportDownload Splunk Enterprise Security product report
 

Also Known As

Micro Focus Arcsight Logger, HPE Arcsight Logger
No data available
 

Overview

HPE ArcSight Data Platform (ADP) offers a future-ready data solution that enriches data in real time and supports open standards for better threat detection. Using security data connectors, ADP collects data and enriches it in real-time to give analysts organized information that can be acted upon instantly.
OpenText

Splunk Enterprise Security is widely used for security operations, including threat detection, incident response, and log monitoring. It centralizes log management, offers security analytics, and ensures compliance, enhancing the overall security posture of organizations.

Companies leverage Splunk Enterprise Security to monitor endpoints, networks, and users, detecting anomalies, brute force attacks, and unauthorized access. They use it for fraud detection, machine learning, and real-time alerts within their SOCs. The platform enhances visibility and correlates data from multiple sources to identify security threats efficiently. Key features include comprehensive dashboards, excellent reporting capabilities, robust log aggregation, and flexible data ingestion. Users appreciate its SIEM capabilities, threat intelligence, risk-based alerting, and correlation searches. Highly scalable and stable, it suits multi-cloud environments, reducing alert volumes and speeding up investigations.

What are the key features?
  • Comprehensive Dashboards: Provide a holistic view of security operations.
  • Flexible Data Ingestion: Supports various data sources for better analysis.
  • Robust Log Aggregation: Centralizes log management for easier monitoring.
  • Machine Learning Toolkit: Enhances threat detection and prediction capabilities.
  • SIEM Capabilities: Integrates security information and event management.
  • Threat Intelligence: Utilizes external information to improve security measures.
  • Risk-Based Alerting: Prioritizes alerts based on the risk they pose.
  • Correlation Searches: Identifies and correlates security events effectively.
What benefits or ROI should users look for?
  • Enhanced Visibility: Improves monitoring across endpoints, networks, and users.
  • Faster Incident Response: Speeds up identification and resolution of security issues.
  • Reduced Alert Volumes: Lowers false positives and enhances signal-to-noise ratio.
  • Scalability: Adapts to growing and changing security needs.
  • Improved Security Operations: Integrates multiple security facets into one platform.

Splunk Enterprise Security is implemented across industries like finance, healthcare, and retail. Financial institutions use it for fraud detection and compliance, while healthcare organizations leverage its capabilities to safeguard patient data. Retailers deploy it to protect customer information and ensure secure transactions.

Splunk
 

Sample Customers

China Merchants Bank, Bank AlJazira, Banca Intesa
Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.
Buyer's Guide
ArcSight Logger vs. Splunk Enterprise Security
April 2025
Free Report: ArcSight Logger vs. Splunk Enterprise Security
Find out what your peers are saying about ArcSight Logger vs. Splunk Enterprise Security and other solutions. Updated: April 2025.
DOWNLOAD NOW
851,604 professionals have used our research since 2012.
See our ArcSight Logger vs. Splunk Enterprise Security report.
See our list of best Log Management vendors.

We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.