Devo vs Splunk Enterprise Security comparison

Devo and Splunk are both solutions in the Security Information and Event Management (SIEM) category. Devo is ranked #26 with an average rating of 8.5, while Splunk is ranked #1 with an average rating of 8.4. Devo holds a 1.1% mindshare in SIEM, compared to Splunk’s 9.5% mindshare. Additionally, 95% of Devo users are willing to recommend the solution, compared to 93% of Splunk users who would recommend it.

Devo

Read 22 Devo reviews

2,078 Views
1,007 Comparison Views

95% willing to recommend

Splunk Enterprise Security

Read 308 Splunk Enterprise Security reviews

13,655 Views
11,094 Comparison Views

93% willing to recommend

Devo

Splunk Enterprise Security

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Apr 6, 2025

Splunk Enterprise Security and Devo compete in the security analytics space, offering comprehensive solutions for data analysis and incident response. Splunk seems to have the upper hand due to its extensive feature set, particularly in operational intelligence and data visualization, making it highly suitable for complex environments.

Features: Splunk Enterprise Security offers robust log management, real-time alert setup, and operational intelligence capabilities. It excels in data correlation from various sources using schema-on-read technology, enhancing its dashboards and visualization tools. Devo stands out for its high-speed, scalable analytics, seamless data storage efficiencies, and the innovative Activeboards feature that facilitates real-time data analysis across multiple data types.

Room for Improvement: Splunk Enterprise Security needs to improve its GUI for enhanced search and dashboard customization, better documentation, and more granular security controls with integrations. Devo could focus on better supporting complex dashboards, enhancing Activeboards' aesthetic appeal, and simplifying data ingestion and parsing.

Ease of Deployment and Customer Service: Splunk Enterprise Security is versatile with deployment models including Public Cloud, On-premises, and Hybrid Cloud, complemented by solid but improvable customer service in terms of response times. Devo offers straightforward deployment with clear pricing models and quality technical support, though platform documentation could be improved.

Pricing and ROI: Splunk Enterprise Security, expensive especially for smaller enterprises, carries high data ingestion costs but offers significant ROI through comprehensive data analysis features. In contrast, Devo offers a straightforward pricing model based on data ingestion, generally making it more economical. Both tools have distinct pricing models, but Splunk’s more extensive features justify its investment for enterprises needing comprehensive security solutions.

To learn more, read our detailed Devo vs. Splunk Enterprise Security Report (Updated: April 2025).

Buyer's Guide

Devo vs. Splunk Enterprise Security

April 2025

Download the complete report

Helped 851,604 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Devo

Ranking in Log Management

27th

Ranking in Security Information and Event Management (SIEM)

26th

Ranking in IT Operations Analytics

6th

Average Rating

8.4

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

AIOps (17th)

Splunk Enterprise Security

Ranking in Log Management

2nd

Ranking in Security Information and Event Management (SIEM)

1st

Ranking in IT Operations Analytics

1st

Average Rating

8.4

Reviews Sentiment

7.6

Number of Reviews

308

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of May 2025, in the Security Information and Event Management (SIEM) category, the mindshare of Devo is 1.1%, up from 1.0% compared to the previous year. The mindshare of Splunk Enterprise Security is 9.5%, down from 12.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Featured Reviews

Michael Wenn

CEO / Co-Founder at Aiops ltd

Has cloud-first architecture with SIEM technology to run security operations

When it comes to scale, they're architected quite well. They handle some of the biggest customers globally, with significant throughput on their platform, managing thousands of customers. One of the most impressive aspects of Devo is its customer community. A large majority, over 80 percent of their customers, actively participate on a Devo-specific community page. They're contributing to product development and support, events, and user group information, helping each other out. This high level of engagement is rare and demonstrates both the loyalty of their customer base and the quality of their product. They offer a range of small, medium, and large options to cater to everyone. I sold Devo products while working with them, focusing on enterprise solutions. However, as a small reseller, my customers were typically smaller businesses. I rate the solution's scalability a nine out of ten.

Read full review

ROBERT-CHRISTIAN

CTO at kyndryl

Has many predefined correlation rules and is brilliant for investigation and log analysis

It is very complicated to write your own correlation rules without the help of Splunk support. What Splunk could do better is to create an API to the standard SIEM tools, such as Microsoft Sentinel. The idea would be to make it less painful. In ELK Stack, Kibana is the query language with which you can search log files. I believe Splunk has also a query language in which they search their log files, but once you have identified the log file that you want to use for further security correlation, you want to very quickly transport that into your SIEM tool, such as Microsoft Sentinel. That is something that Splunk could make a little bit less painful because it is a lot of effort to find that log file and forward it. An API with Microsoft Sentinel or a similar SIEM tool would be a good idea.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Devo helps us to unlock the full power of our data because they have more than 450 parsers, which means that we can ingest pretty much any type of log data."

"The user interface is really modern. As an end-user, there are a lot of possibilities to tailor the platform to your needs, and that can be done without needing much support from Devo. It's really flexible and modular. The UI is very clean."

"It centralizes security management within a business, functioning as a core system for a SOC."

"The user experience [is] well thought out and the workflows are logical. The dashboards are intuitive and highly customizable."

"Devo provides a multi-tenant, cloud-native architecture. This is critical for managed service provider environments or multinational organizations who may have subsidiaries globally. It gives organizations a way to consolidate their data in a single accessible location, yet keep the data separate. This allows for global views and/or isolated views restricted by access controls by company or business unit."

"One of the biggest features of the UI is that you see the actual code of what you're doing in the graphical user interface, in a little window on the side. Whatever you're doing, you see the code, what's happening. And you can really quickly switch between using the GUI and using the code. That's really useful."

"The ability to have high performance, high-speed search capability is incredibly important for us. When it comes to doing security analysis, you don't want to be doing is sitting around waiting to get data back while an attacker is sitting on a network, actively attacking it. You need to be able to answer questions quickly. If I see an indicator of attack, I need to be able to rapidly pivot and find data, then analyze it and find more data to answer more questions. You need to be able to do that quickly. If I'm sitting around just waiting to get my first response, then it ends up moving too slow to keep up with the attacker. Devo's speed and performance allows us to query in real-time and keep up with what is actually happening on the network, then respond effectively to events."

"The most powerful feature is the way the data is stored and extracted. The data is always stored in its original format and you can normalize the data after it has been stored."

More Devo pros

"The search engine and indexes are fast and optimized, and the report generation dashboard is user-friendly."

"It's basically one of the best SIEM products on the market."

"Its integration is most valuable. Its UI is also pretty much easy."

"The initial setup is really straightforward. It's one of the easiest installations."

"Splunk has significantly reduced the time in performing the task of aggregating logs, reviewing as well as time spent during investigations."

"The solution's most valuable feature is risk-based alerting, focusing on building out user risks for individuals throughout the enterprise."

"It is easy to use in any environment."

"We can ingest and correlate data from virtually any type of system."

More Splunk Enterprise Security pros

Cons

"From our experience, the Devo agent needs some work. They built it on top of OS Query's open-source framework. It seems like it wasn't tuned properly to handle a large volume of Windows event logs. In our experience, there would definitely be some room for improvement. A lot of SIEMs on the market have their own agent infrastructure. I think Devo's working towards that, but I think that it needs some improvement as far as keeping up with high-volume environments."

"There are some issues from an availability and functionality standpoint, meaning the tool is somewhat slow. There were some slow response periods over the past six to nine months, though it has yet to impact us terribly as we are a relatively small shop. We've noticed it, however, so Devo could improve the responsiveness."

"They can improve their AI capabilities"

"Some of the documentation could be improved a little bit. A lot of times it doesn't go as deep into some of the critical issues you might run into. They've been really good to shore us up with support, but some of the documentation could be a little bit better."

"Some basic reporting mechanisms have room for improvement. Customers can do analysis by building Activeboards, Devo’s name for interactive dashboards. This capability is quite nice, but it is not a reporting engine. Devo does provide mechanisms to allow third-party tools to query data via their API, which is great. However, a lot of folks like or want a reporting engine, per se, and Devo simply doesn't have that. This may or may not be by design."

"Their documentation could be better. They are growing quickly and need to have someone focused on tech writing to ensure that all the different updates, how to use them, and all the new features and functionality are properly documented."

"There's always room to reduce the learning curve over how to deal with events and machine data. They could make the machine data simpler."

"Technical support could be better."

More Devo cons

"Splunk's ability to analyze malicious activities scores an 8 out of 10, but there's room for improvement. By analyzing emerging patterns, Splunk could identify and predict potential threats more effectively."

"The price of the solution could be cheaper."

"Its user interface for everything other than the charts can be improved. Some parts of it can be simplified a bit, such as when importing documents that have the network traffic. When you're going through the information about the network traffic, you have to have the expertise, but even if a program is supposed to be for IT support, it is good to make it user-friendly because it gets easier to train people. When something goes wrong, the more difficult a program is in terms of UI, the harder it is to fix the issue."

"Some of the search functions can be better. There has been a lot of talk at the conference about the update of SPL before each iteration. That will be a lot of help."

"It needs to improve the way to install third-party apps and enable installation without logging into splunk.com."

"The search could be improved. Now, it is a bit difficult to write search queries because they become quite long, then maintaining those long search queries is a quite challenging."

"It currently has limited default rules and customizations. If they can concentrate more on the compliance part and the security information part, it would be helpful. The platform part is good, but it requires many features from the security aspect."

"Its pricing model and integration with third-party services can be improved. We had faced an issue with integration. The alerting feature is currently not available with Splunk, but it is definitely available with Datadog and PagerDuty. They should include this feature. A few dashboards in Splunk look quite old and are not that modern. They aren't bad, but improving these dashboards will definitely make Splunk more attractive and usable. I read in a few blog posts that there were a few security incidents related to Splunk agents. So, it can be made more secure."

More Splunk Enterprise Security cons

Pricing and Cost Advice

"I'm not involved in the financial aspect, but I think the licensing costs are similar to other solutions. If all the solutions have a similar cost, Devo provides more for the money."

"It's a per gigabyte cost for ingestion of data. For every gigabyte that you ingest, it's whatever you negotiated your price for. Compared to other contracts that we've had for cloud providers, it's significantly less."

"Devo is definitely cheaper than Splunk. There's no doubt about that. The value from Devo is good. It's definitely more valuable to me than QRadar or LogRhythm or any of the old, traditional SIEMs."

"We have an OEM agreement with Devo. It is very similar to the standard licensing agreement because we are charged in the same way as any other customer, e.g., we use the backroom."

"It's very competitive. That was also a primary draw for us. Some of the licensing models with solutions like Splunk and Sentinel were attractive upfront, but there were so many micro-charges and services we would've had to add on to make them what we wanted. We had to include things like SOAR and extended capabilities, whereas all those capabilities are completely included with the Devo platform. I haven't seen any additional fee."

"Our licensing fees are billed annually and per terabyte."

"Pricing is based on the number of gigabytes of ingestion by volume, and it's on a 30-day average. If you go over one day, that's not a big deal as long as the average is what you expected it to be."

"Devo was very cost-competitive... Devo did come with that 400 days of hot data, and that was not the case with other products."

More Devo pricing and cost advice

"Splunk Enterprise Security is priced lower than competitors."

"I am not personally involved with the pricing of the solution."

"It is a pretty high cost solution, but if your organization has the funds, it can bring many benefits."

"The price of Splunk is reasonable."

"Setup cost is cheap: It is free, it is user-friendly, and it is fast."

"It's a yearly subscription."

"Splunk Enterprise Security is expensive."

"Pricing can be a limiting factor. You have to continuously tune what you are bringing in and make sure what you bring in is of value."

More Splunk Enterprise Security pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

851,604 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at Deloitte & Touche

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

18%

Computer Software Company

15%

Government

University

Financial Services Firm

15%

Computer Software Company

14%

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Devo?

Devo has a really good website for creating custom configurations.

See all answers

What is your experience regarding pricing and costs for Devo?

Compared to Splunk or SentinelOne, it is really expensive. I rate the product’s pricing a nine out of ten, where one is cheap and ten is expensive.

See all answers

What needs improvement with Devo?

They can improve their AI capabilities. If you look at some integrations like XDR or AI, which add to the platform to correlate situations in events, there are areas for enhancement. For instance, ...

See all answers

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...

See all answers

What is a better choice, Splunk or Azure Sentinel?

It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...

See all answers

How does Splunk compare with Azure Monitor?

Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring information from different sources. Splunk is very good at alerting us if we...

See all answers

Comparisons

IBM Security QRadar vs Devo

Compared 17% of the time

Microsoft Sentinel vs Devo

Compared 16% of the time

Wazuh vs Devo

Compared 6% of the time

LogRhythm SIEM vs Devo

Compared 6% of the time

Datadog vs Devo

Compared 5% of the time

More Devo Competitors

Wazuh vs Splunk Enterprise Security

Compared 9% of the time

IBM Security QRadar vs Splunk Enterprise Security

Compared 8% of the time

Dynatrace vs Splunk Enterprise Security

Compared 8% of the time

Datadog vs Splunk Enterprise Security

Compared 5% of the time

Security Onion vs Splunk Enterprise Security

Compared 4% of the time

More Splunk Enterprise Security Competitors

Product Reports

Buyer's Guide

Devo

May 2025

Download Devo product report

Buyer's Guide

Splunk Enterprise Security

April 2025

Download Splunk Enterprise Security product report

Overview

Devo is the only cloud-native logging and security analytics platform that releases the full potential of all your data to empower bold, confident action when it matters most. Only the Devo platform delivers the powerful combination of real-time visibility, high-performance analytics, scalability, multitenancy, and low TCO crucial for monitoring and securing business operations as enterprises accelerate their shift to the cloud.

Devo

Splunk Enterprise Security is widely used for security operations, including threat detection, incident response, and log monitoring. It centralizes log management, offers security analytics, and ensures compliance, enhancing the overall security posture of organizations.

Companies leverage Splunk Enterprise Security to monitor endpoints, networks, and users, detecting anomalies, brute force attacks, and unauthorized access. They use it for fraud detection, machine learning, and real-time alerts within their SOCs. The platform enhances visibility and correlates data from multiple sources to identify security threats efficiently. Key features include comprehensive dashboards, excellent reporting capabilities, robust log aggregation, and flexible data ingestion. Users appreciate its SIEM capabilities, threat intelligence, risk-based alerting, and correlation searches. Highly scalable and stable, it suits multi-cloud environments, reducing alert volumes and speeding up investigations.

What are the key features?

Comprehensive Dashboards: Provide a holistic view of security operations.
Flexible Data Ingestion: Supports various data sources for better analysis.
Robust Log Aggregation: Centralizes log management for easier monitoring.
Machine Learning Toolkit: Enhances threat detection and prediction capabilities.
SIEM Capabilities: Integrates security information and event management.
Threat Intelligence: Utilizes external information to improve security measures.
Risk-Based Alerting: Prioritizes alerts based on the risk they pose.
Correlation Searches: Identifies and correlates security events effectively.

What benefits or ROI should users look for?

Enhanced Visibility: Improves monitoring across endpoints, networks, and users.
Faster Incident Response: Speeds up identification and resolution of security issues.
Reduced Alert Volumes: Lowers false positives and enhances signal-to-noise ratio.
Scalability: Adapts to growing and changing security needs.
Improved Security Operations: Integrates multiple security facets into one platform.

Splunk Enterprise Security is implemented across industries like finance, healthcare, and retail. Financial institutions use it for fraud detection and compliance, while healthcare organizations leverage its capabilities to safeguard patient data. Retailers deploy it to protect customer information and ensure secure transactions.

Splunk

Sample Customers

United States Air Force, Rubrik, SentinelOne, Critical Start, NHL, Panda Security, Telefonica, CaixaBank, OpenText, IGT, OneMain Financial, SurveyMonkey, FanDuel, H&R Block, Ulta Beauty, Manulife, Moneylion, Chime Bank, Magna International, American Express Global Business Travel

Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.

Buyer's Guide

Devo vs. Splunk Enterprise Security

April 2025

Free Report: Devo vs. Splunk Enterprise Security

Find out what your peers are saying about Devo vs. Splunk Enterprise Security and other solutions. Updated: April 2025.

DOWNLOAD NOW

851,604 professionals have used our research since 2012.

See our Devo vs. Splunk Enterprise Security report.

See our list of best Security Information and Event Management (SIEM) vendors, best Log Management vendors, and best IT Operations Analytics vendors.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.