Devo vs Splunk Enterprise Security comparison

Devo and Splunk are both solutions in the Security Information and Event Management (SIEM) category. Devo is ranked #28 with an average rating of 8.5, while Splunk is ranked #1 with an average rating of 8.4. Devo holds a 1.0% mindshare in SIEM, compared to Splunk’s 9.5% mindshare. Additionally, 95% of Devo users are willing to recommend the solution, compared to 93% of Splunk users who would recommend it.

Devo

Read 22 Devo reviews

2,148 Views
1,023 Comparison Views

95% willing to recommend

Splunk Enterprise Security

Read 305 Splunk Enterprise Security reviews

13,819 Views
11,374 Comparison Views

93% willing to recommend

Devo

Splunk Enterprise Security

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jan 5, 2025

Splunk Enterprise Security and Devo compete in the security information and event management (SIEM) category. Based on feature robustness, data integration, and support feedback, Splunk Enterprise Security appears to hold the upper hand with its strong user community and scalability capabilities.

Features: Splunk Enterprise Security offers robust log management, rapid search capabilities, and sophisticated operational intelligence. It integrates data from multiple sources using the Search Processing Language (SPL) for analyzing and visualizing complex datasets. Devo focuses on real-time analytics, high-speed search, and user-friendly dashboards, along with strong multi-tenant support and data retention capabilities.

Room for Improvement: Splunk Enterprise Security can improve its visualization and user interface, cluster management, user access controls, security features, and simplify third-party integrations and setup complexity. Devo should enhance its GUI, data parsing capabilities, expand out-of-the-box integrations, improve pre-built monitoring modules, and make its pricing model more flexible to address metadata processing charges.

Ease of Deployment and Customer Service: Splunk Enterprise Security supports diverse deployment environments, including public, private, and hybrid clouds, as well as on-premises setups. Customer support is strong with a robust online community, although some users note potential delays in technical support. Devo offers flexible deployment options favoring cloud-native architecture, with generally well-regarded customer support that is responsive and clear documentation, though integration with professional services could improve.

Pricing and ROI: Splunk Enterprise Security is premium-priced, with high costs associated with data ingestion, often justified by its robust features for large enterprises. Users suggest more flexible pricing models. Devo offers competitive pricing based on data ingestion, appealing to many users, despite concerns about additional metadata processing charges. Both solutions are seen as providing significant ROI through enhanced visibility, efficiency improvements, and rapid incident response, yet careful cost consideration is important.

To learn more, read our detailed Devo vs. Splunk Enterprise Security Report (Updated: March 2025).

Buyer's Guide

Devo vs. Splunk Enterprise Security

March 2025

Download the complete report

Helped 845,040 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Devo

Ranking in Log Management

27th

Ranking in Security Information and Event Management (SIEM)

28th

Ranking in IT Operations Analytics

6th

Average Rating

8.4

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

AIOps (15th)

Splunk Enterprise Security

Ranking in Log Management

2nd

Ranking in Security Information and Event Management (SIEM)

1st

Ranking in IT Operations Analytics

1st

Average Rating

8.4

Reviews Sentiment

7.6

Number of Reviews

305

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of April 2025, in the Security Information and Event Management (SIEM) category, the mindshare of Devo is 1.0%, down from 1.1% compared to the previous year. The mindshare of Splunk Enterprise Security is 9.5%, down from 12.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Featured Reviews

Michael Wenn

CEO / Co-Founder at Aiops ltd

Has cloud-first architecture with SIEM technology to run security operations

When it comes to scale, they're architected quite well. They handle some of the biggest customers globally, with significant throughput on their platform, managing thousands of customers. One of the most impressive aspects of Devo is its customer community. A large majority, over 80 percent of their customers, actively participate on a Devo-specific community page. They're contributing to product development and support, events, and user group information, helping each other out. This high level of engagement is rare and demonstrates both the loyalty of their customer base and the quality of their product. They offer a range of small, medium, and large options to cater to everyone. I sold Devo products while working with them, focusing on enterprise solutions. However, as a small reseller, my customers were typically smaller businesses. I rate the solution's scalability a nine out of ten.

Read full review

ROBERT-CHRISTIAN

CTO Security & Resilience at Kyndryl

Has many predefined correlation rules and is brilliant for investigation and log analysis

It is very complicated to write your own correlation rules without the help of Splunk support. What Splunk could do better is to create an API to the standard SIEM tools, such as Microsoft Sentinel. The idea would be to make it less painful. In ELK Stack, Kibana is the query language with which you can search log files. I believe Splunk has also a query language in which they search their log files, but once you have identified the log file that you want to use for further security correlation, you want to very quickly transport that into your SIEM tool, such as Microsoft Sentinel. That is something that Splunk could make a little bit less painful because it is a lot of effort to find that log file and forward it. An API with Microsoft Sentinel or a similar SIEM tool would be a good idea.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The querying and the log-retention capabilities are pretty powerful. Those provide some of the biggest value-add for us."

"The most valuable feature is that it has native MSSP capabilities and maintains perfect data separation. It does all of that in a very easy-to-manage cloud-based solution."

"The strength of Devo is not only in that it is pretty intuitive, but it gives you the flexibility and creativity to merge feeds. The prime examples would be using the synthesis or union tables that give you phenomenal capabilities... The ability to use a synthesis or union table to combine all those feeds and make heads or tails of what's going on, and link it to go down a thread, is functionality that I hadn't seen before."

"One of the biggest features of the UI is that you see the actual code of what you're doing in the graphical user interface, in a little window on the side. Whatever you're doing, you see the code, what's happening. And you can really quickly switch between using the GUI and using the code. That's really useful."

"Devo helps us to unlock the full power of our data because they have more than 450 parsers, which means that we can ingest pretty much any type of log data."

"It centralizes security management within a business, functioning as a core system for a SOC."

"The real-time analytics of security-related data are super. There are a lot of data feeds going into it and it's very quick at pulling up and correlating the data and showing you what's going on in your infrastructure. It's fast. The way that their architecture and technology works, they've really focused on the speed of query results and making sure that we can do what we need to do quickly. Devo is pulling back information in a fast fashion, based on real-time events."

"The most valuable feature is definitely the ability that Devo has to ingest data. From the previous SIEM that I came from and helped my company administer, it really was the type of system where data was parsed on ingest. This meant that if you didn't build the parser efficiently or correctly, sometimes that would bring the system to its knees. You'd have a backlog of processing the logs as it was ingesting them."

More Devo pros

"Splunk is stable, and this is why many customers want it."

"Splunk's interface is user-friendly, and it has apps and add-ons for most applications. We can easily normalize the data to make it readable and understand the logs. We easily get all the field extractions and enrichment done by using the apps and add-ons. This helps us understand the application logs because the raw data is useless unless we extract some useful information from it. These add-ons make it so much easier."

"It is very simple to tweak or write a small piece of glue code to go ahead and create a new dashboard for a business unit to make near real-time decisions to focus more on other geographies when launching the product."

"I can create dashboards to collect and view information in a tabular, graphical format. This feature is important because it helps me understand time-series data over one or two hours."

"The solution has made us more secure."

"The most valuable features include the incident review and Dashboard Studio."

"It is easy to use in any environment."

"The correlation searches are most valuable just because we are able to do things like RBA."

More Splunk Enterprise Security pros

Cons

"Where Devo has room for improvement is the data ingestion and parsing. We tend to have to work with the Devo support team to bring on and ingest new sources of data."

"The price is one problem with Devo."

"There's always room to reduce the learning curve over how to deal with events and machine data. They could make the machine data simpler."

"There are some issues from an availability and functionality standpoint, meaning the tool is somewhat slow. There were some slow response periods over the past six to nine months, though it has yet to impact us terribly as we are a relatively small shop. We've noticed it, however, so Devo could improve the responsiveness."

"Some of the documentation could be improved a little bit. A lot of times it doesn't go as deep into some of the critical issues you might run into. They've been really good to shore us up with support, but some of the documentation could be a little bit better."

"Some third-parties don't have specific API connectors built, so we had to work with Devo to get the logs and parse the data using custom parsers, rather than an out-of-the-box solution."

"The overall performance of extraction could be a lot faster, but that's a common problem in this space in general. Also, the stock or default alerting and detecting options could definitely be broader and more all-encompassing. The fact that they're not is why we had to write all our own alerts."

"An admin who is trying to audit user activity usually cannot go beyond a day in the UI. I would like to have access to pages and pages of that data, going back as far as the storage we have, so I could look at every command or search or deletion or anything that a user has run. As an admin, that would really help. Going back just a day in the UI is not going to help, and that means I have to find a different way to do that."

More Devo cons

"The support and the pricing can be better"

"Resource usage can probably be described as an area with shortcomings in the product where improvements are required."

"In terms of training. I find that some things about Splunk aren't well-explained. I see features and then go to the website but don't find good explanations."

"The analytics of Splunk could be improved."

"You do need a lot of training and certification with this product."

"Splunk Enterprise Security offers a vast amount of information to learn and comprehend, resulting in a challenging initial learning curve."

"It can be tough to determine if you are getting all of the value out of your investment at times."

"The solution could use a different licensing model."

More Splunk Enterprise Security cons

Pricing and Cost Advice

"We have an OEM agreement with Devo. It is very similar to the standard licensing agreement because we are charged in the same way as any other customer, e.g., we use the backroom."

"I rate the pricing a four on a scale of one to ten, where one is cheap, and ten is expensive."

"I'm not involved in the financial aspect, but I think the licensing costs are similar to other solutions. If all the solutions have a similar cost, Devo provides more for the money."

"Devo is a hosted or subscription-based solution, whereas before, we purchased QRadar, so we owned it and just had to pay a maintenance fee. We've encountered this with some other products, too, where we went over to subscription-based. Our thought process is that with subscription based, the provider hosts and maintains the tool, and it's offsite. That comes with some additional fees, but we were able to convince our upper management it was worth the price. We used to pay under 10k a year for maintenance, and now we're paying ten times that. It was a relatively tough sell to our management, but I wonder if we have a choice anymore; this is where the market is."

"The way Devo prices things is based on the amount of data, and I wish the tiers had more granularity. Maybe at this point they do, but when we first negotiated with them, there were only three or four tiers."

"It's very competitive. That was also a primary draw for us. Some of the licensing models with solutions like Splunk and Sentinel were attractive upfront, but there were so many micro-charges and services we would've had to add on to make them what we wanted. We had to include things like SOAR and extended capabilities, whereas all those capabilities are completely included with the Devo platform. I haven't seen any additional fee."

"Devo is definitely cheaper than Splunk. There's no doubt about that. The value from Devo is good. It's definitely more valuable to me than QRadar or LogRhythm or any of the old, traditional SIEMs."

"[Devo was] in the ballpark with at least a couple of the other front-runners that we were looking at. Devo is a good value and, given the quality of the product, I would expect to pay more."

More Devo pricing and cost advice

"ROI is estimated at saving my team roughly 10 to 12 man hours per week in troubleshooting for our company as well as what our profits had been from our services of installing, configuring, and supporting other clients with the product."

"The Splunk Enterprise Security license is expensive."

"Splunk Enterprise Security is expensive."

"Splunk Enterprise becomes extremely expensive after the 20GB/month license."

"Luckily, we come under a large federal agency, and before the pandemic, they signed a large enterprise license agreement. It worked out great and to our advantage because we are a small organization. We got a 300 gig license, and we just did not have the buying power to be able to get products cheaply. Because we all partnered together under the agency umbrella, we were able to get Splunk Enterprise Security, UBA, and ITSI for cheap. This was good considering the fact that some of these premium apps require a minimum number of users, and we do not have the number of people needed to even justify buying it."

"It is a pretty high cost solution, but if your organization has the funds, it can bring many benefits."

"Although Splunk is an expensive product, it is designed to be utilized across your organization in order to maximize your ROI and lower your TCO."

"Splunk is not a cheap solution and the license is billed annually."

More Splunk Enterprise Security pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

845,040 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at Deloitte & Touche

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

17%

Computer Software Company

15%

University

Government

Financial Services Firm

15%

Computer Software Company

14%

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Devo?

Devo has a really good website for creating custom configurations.

See all answers

What is your experience regarding pricing and costs for Devo?

Compared to Splunk or SentinelOne, it is really expensive. I rate the product’s pricing a nine out of ten, where one is cheap and ten is expensive.

See all answers

What needs improvement with Devo?

They can improve their AI capabilities. If you look at some integrations like XDR or AI, which add to the platform to correlate situations in events, there are areas for enhancement. For instance, ...

See all answers

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...

See all answers

What is a better choice, Splunk or Azure Sentinel?

It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...

See all answers

How does Splunk compare with Azure Monitor?

Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring information from different sources. Splunk is very good at alerting us if we...

See all answers

Comparisons

IBM Security QRadar vs Devo

Compared 17% of the time

Microsoft Sentinel vs Devo

Compared 17% of the time

Wazuh vs Devo

Compared 6% of the time

LogRhythm SIEM vs Devo

Compared 6% of the time

Datadog vs Devo

Compared 5% of the time

More Devo Competitors

Wazuh vs Splunk Enterprise Security

Compared 9% of the time

IBM Security QRadar vs Splunk Enterprise Security

Compared 9% of the time

Dynatrace vs Splunk Enterprise Security

Compared 8% of the time

Datadog vs Splunk Enterprise Security

Compared 5% of the time

Sentinel vs Splunk Enterprise Security

Compared 4% of the time

More Splunk Enterprise Security Competitors

Product Reports

Buyer's Guide

Devo

March 2025

Download Devo product report

Buyer's Guide

Splunk Enterprise Security

March 2025

Download Splunk Enterprise Security product report

Overview

Devo is the only cloud-native logging and security analytics platform that releases the full potential of all your data to empower bold, confident action when it matters most. Only the Devo platform delivers the powerful combination of real-time visibility, high-performance analytics, scalability, multitenancy, and low TCO crucial for monitoring and securing business operations as enterprises accelerate their shift to the cloud.

Devo

Splunk Enterprise Security is widely used for security operations, including threat detection, incident response, and log monitoring. It centralizes log management, offers security analytics, and ensures compliance, enhancing the overall security posture of organizations.

Companies leverage Splunk Enterprise Security to monitor endpoints, networks, and users, detecting anomalies, brute force attacks, and unauthorized access. They use it for fraud detection, machine learning, and real-time alerts within their SOCs. The platform enhances visibility and correlates data from multiple sources to identify security threats efficiently. Key features include comprehensive dashboards, excellent reporting capabilities, robust log aggregation, and flexible data ingestion. Users appreciate its SIEM capabilities, threat intelligence, risk-based alerting, and correlation searches. Highly scalable and stable, it suits multi-cloud environments, reducing alert volumes and speeding up investigations.

What are the key features?

Comprehensive Dashboards: Provide a holistic view of security operations.
Flexible Data Ingestion: Supports various data sources for better analysis.
Robust Log Aggregation: Centralizes log management for easier monitoring.
Machine Learning Toolkit: Enhances threat detection and prediction capabilities.
SIEM Capabilities: Integrates security information and event management.
Threat Intelligence: Utilizes external information to improve security measures.
Risk-Based Alerting: Prioritizes alerts based on the risk they pose.
Correlation Searches: Identifies and correlates security events effectively.

What benefits or ROI should users look for?

Enhanced Visibility: Improves monitoring across endpoints, networks, and users.
Faster Incident Response: Speeds up identification and resolution of security issues.
Reduced Alert Volumes: Lowers false positives and enhances signal-to-noise ratio.
Scalability: Adapts to growing and changing security needs.
Improved Security Operations: Integrates multiple security facets into one platform.

Splunk Enterprise Security is implemented across industries like finance, healthcare, and retail. Financial institutions use it for fraud detection and compliance, while healthcare organizations leverage its capabilities to safeguard patient data. Retailers deploy it to protect customer information and ensure secure transactions.

Splunk

Sample Customers

United States Air Force, Rubrik, SentinelOne, Critical Start, NHL, Panda Security, Telefonica, CaixaBank, OpenText, IGT, OneMain Financial, SurveyMonkey, FanDuel, H&R Block, Ulta Beauty, Manulife, Moneylion, Chime Bank, Magna International, American Express Global Business Travel

Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.

Buyer's Guide

Devo vs. Splunk Enterprise Security

March 2025

Free Report: Devo vs. Splunk Enterprise Security

Find out what your peers are saying about Devo vs. Splunk Enterprise Security and other solutions. Updated: March 2025.

DOWNLOAD NOW

845,040 professionals have used our research since 2012.

See our Devo vs. Splunk Enterprise Security report.

See our list of best Security Information and Event Management (SIEM) vendors, best Log Management vendors, and best IT Operations Analytics vendors.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.