Splunk Cloud [Private Offer Only] Reviews

My main use case for Splunk Cloud [Private Offer Only] involves multiple tasks, not specific to one area. I onboard data from multiple sources using a couple of data brokers like Universal Forwarder, OpenTelemetry Collector, apps, and add-ons from Splunk, along with writing scripts to onboard that data into Splunk Cloud [Private Offer Only]. I also use Cribl for one of the data brokers via cloud-to-cloud integrations to avoid coming to the private network and then going to the public cloud, which is Splunk Cloud [Private Offer Only]. Additionally, I create dashboards, reports, and alerts for consumers based on their use cases, and I utilize ITSI for production. I have multiple actions that trigger external actions mainly on Splunk ITSI to ServiceNow, Jira, Slack, and Teams for tasks like stopping or starting Windows or Linux machines. It involves multiple activities that I manage there.

A specific example of how I use Splunk Cloud [Private Offer Only] is when I have a consumer using Orbit as a data source. From Orbit, I get logs into Splunk Cloud [Private Offer Only] via HEC token, where I create alerts targeting errors, missing sets of logs, or applications being down. I also have a dashboard created for the consumer to visualize data such as error counts, warnings, and the types of applications having issues. It helps me check for errors in transactions and integrates with ServiceNow to trigger incidents directly to their queue whenever it meets the consumer's requirements. For critical P1s and P2s, I use Splunk On-Call functionality, which triggers an on-call feature to notify end-users about created P1 or P2 incidents in ServiceNow, prompting them to act accordingly because P3 or P4 incidents are less urgent with SLA considerations.

The best features Splunk Cloud [Private Offer Only] offers include the Ingest Processor, which allows me to filter out or stop data ingestion from the data source to reduce ingestion and storage licensing costs. I am currently exploring this good feature.

Regarding my experience with the Ingest Processor, I have a consumer whose application forwards data into Splunk Cloud [Private Offer Only]. Unfortunately, when there is a restart, old duplicate data is also ingested alongside the current data. For example, the last 24 hours' data amounts to 15 to 20 GB, and when the application restarts, an additional 15 to 20 GB of duplicate data ingests. Consequently, instead of the expected 15 to 20 GB, I am looking at almost 30 to 40 GB of ingestion cost. By using the Ingest Processor, I can effectively stop the duplicate data ingestion into Splunk Cloud [Private Offer Only].

Splunk Cloud [Private Offer Only] has positively impacted my organization in many ways. For instance, if something goes wrong with an application I monitor, without Splunk Cloud [Private Offer Only], notifications are unavailable, and support staff would not be notified, which saves time. I also have proactive alerts and predictive analysis, saving costs by preventing the ingestion of duplicate data into Splunk Cloud [Private Offer Only]. From a security standpoint, I have audit-related features to address issues or malicious attacks. Utilizing predictions and AI functions aids me in multiple areas of operations.

To improve Splunk Cloud [Private Offer Only], the latest version 10.5 introduces a UI that feels somewhat difficult to navigate compared to earlier versions, making it uncomfortable. A smoother transition from the older versions, such as 10.3 to 10.5, would be beneficial, and they should avoid making significant changes to the entire visualization.

I have been using Splunk Cloud [Private Offer Only] for more than eight years.

Splunk Cloud [Private Offer Only] is stable.

Regarding the scalability of Splunk Cloud [Private Offer Only], I can scale up or down based on the agreements I have made.

Customer support for Splunk Cloud [Private Offer Only] is quite good, but there is room for improvement that they should address.

I would rate the customer support for Splunk Cloud [Private Offer Only] as a seven to eight, although the time taken for responses could be improved.

My experience with pricing, setup costs, and licensing is positive since I am part of the Splunk Community, along with being a Splunk MVP and a member of Splunk Trust, which enabled me to secure a good deal.

Before choosing Splunk Cloud [Private Offer Only], I did not evaluate other options, as I have been part of Splunk for a long time and decided to continue with it without exploring other functionalities.

My advice for others considering Splunk Cloud [Private Offer Only] is that it is a powerful tool for log data management, allowing faster analysis to identify issues compared to other tools I have encountered. I would rate this product a nine overall.

Hybrid Cloud

Microsoft Azure

My client's use case for Splunk Cloud [Private Offer Only] is collecting all the logs in a single place, which is the most important thing for the customer so far.

We then make use of those logs and try to generate alerts based on custom and inbuilt detection.

What really stands out to me about Splunk Cloud [Private Offer Only] is that I get a very good detection scenario. Using one particular product, I am able to pull data from anywhere, making that data very useful.

For Sentinel, we connect all the data connectors, and using those logs, we try to build queries around them and turn them into detection logs.

It takes almost any data, provides risk-based alerts, and allows us to ingest threat intelligence feeds very effectively. The operation and monitoring are quite good, as we have a very good dashboard where we can set up alert queries.

Regarding machine learning capabilities, the data science they have employed and the Machine Learning Toolkit, all combined, give very decent protection and detection around User Entity Behavior Analytics and risk-based alerting.

Anomaly detection stands out as an important feature when it comes to machine learning, and even generative AI, such as Copilot, is quite helpful.

I find integration with third-party applications straightforward, and I have not seen any issues with integration, as I can pull logs from anywhere.

When it comes to Splunk, I don't find any known cases around data encryption. However, when it comes to access control, native Splunk accounts, Active Directory accounts, SAML, MFA, token authentication, and integration with Okta are very well controlled using Splunk.

The built-in reporting, especially for SOC operations, is quite okay, and we have good visibility over security posture, incident reviews, executive summaries, auditing dashboards, and risk analysis dashboards.

We can capture key metrics such as mean time to detect, mean time to acknowledge, and mean time to respond, which makes reporting absolutely fine.

I still want to see a more colorful dashboard for Splunk, and the cost could have been lower, as there are many competitors providing the same capabilities.

It takes time to master Splunk, especially when working on correlation and tuning, and the administrative controls can be a bit complex.

The hardware and storage requirements are relatively high, as they need fast disks and high capacity.

Indexing can also be problematic; if you use a simple index query, it can give you a lot of data, and narrowing it down can take hours or even days.

I have worked with Splunk Cloud [Private Offer Only] for four years.

I don't see any issues with the stability of Splunk; I find it very stable.

It is absolutely scalable.

I find the technical support for Splunk could be better, as the turnaround time can be lengthy, and we often face delays before someone picks up the ticket. Once they do, the communication is good.

In terms of support, I would rate them 7.5 out of 10.

I wouldn't say the installation process for Splunk Cloud [Private Offer Only] is easy or challenging; it's okay to manage. Once it's installed or deployed, it operates well.

Regarding potential problems during installation, my coworkers have mentioned some challenges in a hybrid and cluster environment, but for me, it hasn't been complex.

However, onboarding data and tuning can become complicated.

The value I see in Splunk is that, unlike other products where log ingestion from new sources can be a problem, Splunk allows you to ingest anything from anywhere easily.

It's all stand-alone in the cloud; we don't have any partners supplying licenses for Splunk.

We purchase directly from Splunk through our sales team.

In comparison to other products such as CrowdStrike or Microsoft, I find that the log ingestion in Splunk Cloud [Private Offer Only] is a significant advantage.

CrowdStrike was initially designed for endpoint security and still has areas of improvement in cloud workload security, while Splunk allows you to ingest anything and create detection rules from that data.

To measure the effectiveness of Splunk Cloud [Private Offer Only] for real-time data processing, we use multiple frameworks such as SOC 2, ISO, PCI, HIPAA, and FedRAMP, aligning them with regulatory bodies.

If I had to rate my overall experience with Splunk Cloud [Private Offer Only], I would give it an 8.5. If I had to choose between an eight and a solid nine, I would give it an eight.

Public Cloud

The major purposes for which my clients are using Splunk Cloud [Private Offer Only] seem to go beyond five.

As a partner and integrator, I believe the biggest advantage of Splunk Cloud [Private Offer Only], especially in its cloud offering, lies in the diverse use cases for which my clients can use it.

To measure the effectiveness of Splunk Cloud [Private Offer Only] for real-time data processing, I look at the major purposes, keeping it broad without going into very specific ones.

The machine learning part of Splunk Cloud [Private Offer Only] does help to predict system anomalies, but I am more interested in whether you are dealing with this cloud solution.

The integration with third-party applications in Splunk Cloud [Private Offer Only] is indeed seamless.

I would assess the value of Splunk Cloud [Private Offer Only]'s data encryption and access control features for the company as important, especially since you have mentioned the security side with features including data encryption.

Regarding the reporting functionality in Splunk Cloud [Private Offer Only], I wonder if it is helpful overall and if it enhances security measures.

You have mentioned security features including data encryption and access controls, so how would you assess their value for the company apart from reporting?

I did not receive an answer to my question regarding how these integrations with third-party tools help you.

Can Splunk Cloud [Private Offer Only]'s reporting functionality be improved, especially in the sense of security measures?

Regarding providing a review for New Relic solutions, I would like to know if there are any negative sides with Splunk Cloud [Private Offer Only], and apart from reporting, whether I would like to see any further improvements.

I do not recall when I started dealing with Splunk Cloud [Private Offer Only], but that actually happened a few years back, and I am calling just to confirm because we update all the reviews here on the platform.

In terms of technical customer support from Splunk Cloud [Private Offer Only], there are benefits that I see, with advantages in features and integrations, making what is overall good in the product.

If I had to rate the support from Splunk Cloud [Private Offer Only], I would give a score based on how AIOps covers anomaly detection, event correlation, service intelligence, and all those aspects.

I would say the installation and deployment of Splunk Cloud [Private Offer Only] is straightforward, and basically, we collect feedback for vendors. I am a partner with Splunk Cloud [Private Offer Only], AppDynamics, and all the vendors I have mentioned before, and we get reviews for them. We publish these reviews here on the platform as feedback from professionals on tools they are using.

Despite its cost, I see value for money and a return on investment with Splunk Cloud [Private Offer Only].

If I had to rate Splunk Cloud [Private Offer Only] overall, from zero to ten, I would expect to elaborate a bit more on how these integrations with third-party tools help.

I believe that the data encryption and access control features in Splunk Cloud [Private Offer Only] are basically valuable.

I would rate this review fifteen out of ten.

Public Cloud

Amazon Web Services (AWS)