Try our new research platform with insights from 80,000+ expert users

Icinga vs Splunk Enterprise Security comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Icinga
Average Rating
7.6
Reviews Sentiment
6.1
Number of Reviews
17
Ranking in other categories
Network Monitoring Software (17th), Server Monitoring (12th), IT Infrastructure Monitoring (25th), Cloud Monitoring Software (18th)
Splunk Enterprise Security
Average Rating
8.4
Reviews Sentiment
7.5
Number of Reviews
318
Ranking in other categories
Log Management (2nd), Security Information and Event Management (SIEM) (1st), IT Operations Analytics (1st)
 

Mindshare comparison

While both are Systems Management solutions, they serve different purposes. Icinga is designed for Network Monitoring Software and holds a mindshare of 3.3%, up 2.5% compared to last year.
Splunk Enterprise Security, on the other hand, focuses on Security Information and Event Management (SIEM), holds 9.4% mindshare, down 12.1% since last year.
Network Monitoring Software
Security Information and Event Management (SIEM)
 

Featured Reviews

Harrison Bulley - PeerSpot reviewer
A stable, scalable and cost-effective solution that helps with inbuilt scripts for easy modification
I think the software is quite good, but we have had problems with getting it to recognize certain areas and amend certain checks, where we needed so we would have to create backend scripts for those checks. Though, being open source, it has the support to create backend scripts, it would be better to have these scripts in-built.
ROBERT-CHRISTIAN - PeerSpot reviewer
Has many predefined correlation rules and is brilliant for investigation and log analysis
It is very complicated to write your own correlation rules without the help of Splunk support. What Splunk could do better is to create an API to the standard SIEM tools, such as Microsoft Sentinel. The idea would be to make it less painful. In ELK Stack, Kibana is the query language with which you can search log files. I believe Splunk has also a query language in which they search their log files, but once you have identified the log file that you want to use for further security correlation, you want to very quickly transport that into your SIEM tool, such as Microsoft Sentinel. That is something that Splunk could make a little bit less painful because it is a lot of effort to find that log file and forward it. An API with Microsoft Sentinel or a similar SIEM tool would be a good idea.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"An affordable solution for small organizations to do basic network monitoring."
"There's a module called Icinga Director, which helps us configure the product using an intuitive interface through clicks instead of creating a text configuration. It's very helpful for us."
"It is really easy in Icinga to create your own plugin and integrate it without any fuss. And it works just perfectly fine."
"The best thing about the solution is how it highlights errors, the issues, and what needs my attention. The solution directs me to areas that I should look for first."
"The value of Icinga is that it has hundreds of plugins, so it's really easy to monitor pretty much anything."
"This solution has a self-healing handler where if the service is down, it is automatically restarted."
"Icinga has multiple automation and integration features. There is an API for everything and a web UI for configurations. The APIs enable you to automate tasks in Icinga. We can also use plugins to talk to the API. The Icinga Director talks to a database in the background, and you can import settings from the CMDB to all systems in Icinga."
"The ability to customize scripts and build your own queries to request information from the infrastructure elements you want to monitor. This level of personalization and customization is highly appreciated."
"The solution's most valuable feature is that it helps with our use cases to detect anomalies in our data and it is important to my company since we have a lot of data on different logs on the systems."
"The logs on the solution are excellent."
"The correlation search functions that generate all the notables are valuable. That can get pretty complicated, and it handles that pretty well."
"Splunk Enterprise Security helped us with faster detection of threats."
"We can easily configure things as required in relation to our use cases."
"Splunk would be my choice for the presentation layer because it comes with inbuilt reports and a dashboard that you can customize."
"Overall, Splunk is among the top three SIEM tools due to its capabilities and agility in bridging business analytics with security needs."
"Compared to IBM QRadar, Splunk Enterprise Security offers faster alert resolution."
 

Cons

"The installation and configuration are very complex."
"In general, the product does not look good. However, it does what it is supposed to do. So, the improvements should focus on usability and UI."
"Icinga is a complex solution that's hard to learn. It's a powerful product for monitoring, but new users will have a hard time figuring out what to do."
"Icinga’s automation could be improved."
"We have found some problems with Nagios, and support isn't very responsive."
"The solution lacks many features important to higher-level IT management and network support."
"There is room for improvement in multi-tenancy. It's not perfect, not even really good. It's average, but it should be improved."
"At this time, the layout of the website is a bit difficult. It should be more user-friendly for changing the background and logos."
"We don't have SOAR products from Splunk. I believe that's an important piece."
"It needs more thoroughly tested releases. Every new big version (6, 7, etc.) has had so many bugs that it makes me wary of customers upgrading right away."
"The default threat intel feeds create many false positives and noise, which is counterproductive."
"It is very complicated to write your own correlation rules without the help of Splunk support."
"There is improvement needed when importing from some types of data sources."
"It does not give us permission to implement on-premise so we implement them on the cloud."
"An improved user interface along with multi-tenancy support would be beneficial."
"We do have to educate developers on how to not blow it up. It is a little to easy to write an expensive query and overly stress the system. This could be improved."
 

Pricing and Cost Advice

"It's an open-source solution."
"This is an open-source solution with paid support."
"It is cost-effective, and the return on investment can be very interesting because the price is low."
"Even though Icinga's financial cost is low, it is an expensive product regarding the resources required to maintain and operate it."
"The solution is cheap."
"The solution is free to use."
"The product is inexpensive compared to other DBM products."
"We're using the free version of Icinga."
"Splunk Enterprise Security is not at all cost-friendly to be deployed in very small enterprises like start-ups."
"Splunk is not a cheap solution and the license is billed annually."
"Splunk Enterprise Security incurs a significant cost because of the amount of data we send, but we are fine with the value we're getting for that price."
"I would highly recommend anyone evaluating this option to download the free trial which allows for the ingestion of 500MB of data per day in order to get a feel for what Splunk does at its core. It will get pricey once your ingestion rates start to sky rocket, but I would consider it expensive given the amount of information that it allows you to analyze and react on straight out-of-the-box."
"I think that most of the log analytics solutions are expensive and I'm not sure if it's worth it."
"Splunk is expensive based on our current requirements, but it's obviously worth what we pay."
"The pricing is very complicated, and it is very pricey. You do require a lot of different licenses in order to get a comprehensive solution that is not just the SIEM solution."
"Splunk is a bit pricier, but the benefits and ROI are huge."
report
Use our free recommendation engine to learn which Network Monitoring Software solutions are best for your needs.
861,490 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Computer Software Company
12%
Financial Services Firm
11%
Comms Service Provider
11%
Manufacturing Company
8%
Financial Services Firm
14%
Computer Software Company
14%
Manufacturing Company
8%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Icinga?
The best thing about the solution is how it highlights errors, the issues, and what needs my attention. The solution directs me to areas that I should look for first.
What is your experience regarding pricing and costs for Icinga?
It is cost-effective, and the return on investment can be very interesting because the price is low. If you want to include this product in the services you offer to your customers, the return on i...
What needs improvement with Icinga?
There is room for improvement in multi-tenancy. It's not perfect, not even really good. It's average, but it should be improved. For instance, multi-tenancy for monitoring the virtual infrastructur...
What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
What is a better choice, Splunk or Azure Sentinel?
It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...
How does Splunk compare with Azure Monitor?
Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring information from different sources. Splunk is very good at alerting us if we...
 

Also Known As

Icinga Cloud Monitoring
No data available
 

Overview

 

Sample Customers

Puppet Labs, Audi, Spacex, Debian, Snapdeal, McGill, RIPE Network Coordination Centre
Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.
Find out what your peers are saying about Zabbix, Auvik, SolarWinds and others in Network Monitoring Software. Updated: July 2025.
861,490 professionals have used our research since 2012.