My main use case is end-to-end monitoring for the application.
Avp at a financial services firm with 5,001-10,000 employees
Supports end-to-end monitoring and improves reliability through core metric insights
Pros and Cons
- "We utilize the APM and auto-detectors, as the core metrics and core alerts are available for us, which are the features of Splunk Observability Cloud that I appreciate the most."
- "The integrations need to be improved for Splunk Observability Cloud."
What is our primary use case?
What is most valuable?
We utilize the APM and auto-detectors, as the core metrics and core alerts are available for us, which are the features of Splunk Observability Cloud that I appreciate the most.
We lead the SRE, so our job is to ensure reliability, stability, and uptime, and without good observability monitoring, there is no way we can accomplish that. This is the main tool that we would use.
I would evaluate the effectiveness of Splunk Observability Cloud in improving digital resilience by saying that the idea is to minimize incidents. If any incident happens, the first thing I would do is go back to see why Splunk Observability Cloud did not detect that. I will take it back, do the reverse engineering to find out where it was missed out, and then work with the team to ensure these things are identified.
I have yet to experience the No-Sample Tracing feature in Splunk Observability Cloud, however, I am only in conversation with the teams where distributed tracing is required, and we want to provide the traces. My teams utilize the ability to enrich data with custom metrics in Splunk Observability Cloud, and I appreciate the feature supported within the Observability Cloud. Custom metrics could also be introduced from within the microservices, so I am yet to explore the OTEL library. I gave this feedback to the Splunk team that they should have their dedicated .NET library that customers can embed and start using; I do not think that is there today.
We are the first project within the company for a fully cloud-native application, so we will set the ground for the rest of the teams to get motivated. Therefore, I expect that I will have the best experience to become an example for others.
What needs improvement?
The integrations need to be improved for Splunk Observability Cloud. Currently, they do not have great support for Azure. We are on Azure, and I know they invested a lot of time in AWS yet not in Azure.
I had given feedback to the teams here, as the integration from Azure Cloud, how we supply the logs and the metrics, is not clearly documented yet, which was acknowledged by the team. For example, the OTEL collector has a thousand parameters, and we need a very specific use case with 10 parameters required for our integration. We can't go through the thousand parameters; we can, however, that is basically why I think some integrations need to get better for Azure.
There's a lot of talk about AI-powered analytics and guidance in Splunk Observability Cloud. I didn't get a great sense of how much of it is actually working; there are a lot of AI hallucinations. I think it probably needs much more improvement to contextualize it so that it is very clear and precise about what it randomly thinks, but it needs to match the context better.
Customer service and technical support need some improvement. We had issues with technical support, and the professional services were struggling as well.
For how long have I used the solution?
I've been using Splunk Observability Cloud for six months.
Buyer's Guide
Splunk Observability Cloud
January 2026
Learn what your peers think about Splunk Observability Cloud. Get advice and tips from experienced pros sharing their opinions. Updated: January 2026.
881,114 professionals have used our research since 2012.
What do I think about the stability of the solution?
I would assess the stability and reliability of Splunk Observability Cloud by saying no crashes or performance issues have been experienced.
How are customer service and support?
On a scale of one to ten, I would rate customer service as eight.
How would you rate customer service and support?
Positive
How was the initial setup?
My experience with deployment has been good. It's just the routing, the matrices, and the integration is where we were struggling a little bit. That said, having the cloud as observed to provision was never a problem.
What was our ROI?
I hope to see a return on investment with Splunk Observability Cloud. I have not applied this for production. That said, we already use Splunk Cloud for production, and we are good with that, so I see the value.
What's my experience with pricing, setup cost, and licensing?
The cost is fine, and we are good with what is given. It's a centralized tool for my organization, so at the org level, a lot of things were decided, but we are actually happy with the cost we received because I know I have to approve my budget, and it's within our range, so we are okay with it.
What other advice do I have?
My advice to Splunk is to mix Splunk Cloud and Splunk Observability Cloud into one. Don't make oObservability only needed in Splunk Cloud, too. You don't want to have two products competing with each other; you want to compete with someone outside your organization. Combine this, as there's a lot of confusion. Even in different classes and training sessions meant only for Splunk Cloud, they were not for Splunk Observability Cloud, and they are different today. The acquisition of SignalFx, which is not its own, adds to the confusion. So, to the customer, provide one interface, and combine them.
On a scale of one to ten, I rate Splunk Observability Cloud an eight overall.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Microsoft Azure
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Last updated: Sep 13, 2025
Flag as inappropriateSolutions Architect at a comms service provider with 51-200 employees
Deployment optimized and demos delivered faster for the retail sector thanks to customizable dashboards
Pros and Cons
- "The feature of Splunk Observability Cloud that I prefer most is the easy deployment on the cloud."
- "In terms of additional features I would want to see in future releases, since Cisco acquired Splunk, more Cisco integration could be beneficial."
What is our primary use case?
For the retail sector, we are building a solution for customer stores in order to know how the products are sold.
What is most valuable?
The feature of Splunk Observability Cloud that I prefer most is the easy deployment on the cloud. The benefit of that feature for my organization is to optimize the deploys and implementation and the response to our customers, to quickly make a demo. Splunk Observability Cloud has helped improve our operational performance, especially for our customers.
My experience with the out-of-the-box customizable dashboards provided by Splunk Observability Cloud is that they are effective in showcasing IT performance to business leaders. For the initial point of contact, it helps and works nicely as a star point. Then, you have the basics and use that as a framework to deploy others, so they are very helpful.
What needs improvement?
Splunk Observability Cloud can be improved. In terms of additional features I would want to see in future releases, since Cisco acquired Splunk, more Cisco integration could be beneficial.
For how long have I used the solution?
I have been using Splunk Observability Cloud for the last two years.
What do I think about the stability of the solution?
I have not experienced any downtime, crashes, or performance issues.
What do I think about the scalability of the solution?
Splunk Observability Cloud scales very well with the growing needs of my organization, as we just need to add a license or data ingestion.
How are customer service and support?
I would evaluate customer service and technical support for Splunk Observability Cloud as good. They respond effectively and in time.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
Prior to adopting Splunk Observability Cloud, we used other solutions to address similar needs, such as Dynatrace and ElasticSearch.
How was the initial setup?
It is easy to deploy on the cloud.
What was our ROI?
I have not seen a return on investment with Splunk Observability Cloud yet, as we are relatively new to it.
What's my experience with pricing, setup cost, and licensing?
My experience with pricing, setup cost, and licensing of Splunk Observability Cloud is that it is somewhat expensive, considering I am from Mexico and the market in Mexico is very different from the market in the USA. It is expensive, especially when there are other vendors that offer something similar for much cheaper.
Which other solutions did I evaluate?
The factors that led me to consider the change to Splunk Observability Cloud include performance and cost, and it depends on the customer. If the customer is a network user or partner with all Cisco solutions, Splunk Observability Cloud fits perfectly.
However, if we have a new customer that doesn't have any Cisco products, it might be better for them to use another solution that is easier to deploy and not as complete as Splunk Observability Cloud, especially if they only need one or two features.
What other advice do I have?
My advice to other organizations considering using Splunk Observability Cloud is that if you want a comprehensive, consistent tool or solution, it is one of the leaders in the market because it integrates with the network side of their organization, including Cisco solutions. Regarding customers who don't come from the Cisco world, it is a good choice, depending on their use. However, for small customers or those that are not large companies, Splunk Observability Cloud may not be the best fit, as it is a comprehensive tool. In Mexico, we observe that customers claim they only need APM or infrastructure monitoring, a very basic requirement, and don't require the entire Splunk portfolio.
On a scale of one to ten, I rate Splunk Observability Cloud a nine.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Disclosure: My company has a business relationship with this vendor other than being a customer. Partner
Last updated: Sep 13, 2025
Flag as inappropriateBuyer's Guide
Splunk Observability Cloud
January 2026
Learn what your peers think about Splunk Observability Cloud. Get advice and tips from experienced pros sharing their opinions. Updated: January 2026.
881,114 professionals have used our research since 2012.
Dashboards have provided a central place to visualize and manage large volumes of log data
Pros and Cons
- "The dashboards are the features of Splunk Observability Cloud that I appreciate the most, providing visual representation of all data and text, which has benefited my organization by speeding up people's jobs and allowing a place to monitor all logs, as there are usually thousands of entries coming in which can become very disorderly."
- "The main improvement I would suggest for Splunk Observability Cloud would be offering the ability to implement custom apps, specifically allowing Python scripts that Splunk Cloud could host."
What is our primary use case?
My main use cases for Splunk Observability Cloud are indexing, dashboards, alerts, and reports.
What is most valuable?
The dashboards are the features of Splunk Observability Cloud that I appreciate the most, providing visual representation of all data and text. These features have benefited my organization by speeding up people's jobs, allowing a place to monitor all logs, as there are usually thousands of entries coming in which can become very disorderly. Users can monitor everything and write queries to organize the data and build dashboards to visualize it. This creates one-stop shops to get answers on how products and applications are performing, as opposed to having to jump onto servers and look through numerous logs.
What needs improvement?
The main improvement I would suggest for Splunk Observability Cloud would be offering the ability to implement custom apps, specifically allowing Python scripts that Splunk Cloud could host. Currently, we cannot create custom apps through Splunk Cloud. Additionally, continuous performance improvements for faster searching and indexing would be beneficial.
For how long have I used the solution?
I have been using Splunk Observability Cloud for over the last year.
What do I think about the stability of the solution?
I would assess the stability and reliability of Splunk Observability Cloud as good. There have been some performance issues, though not necessarily crashes, occurring approximately 20% of the time or less.
What do I think about the scalability of the solution?
Splunk Observability Cloud scales smoothly with the growing needs of my organization. There have been some cases of performance loss due to rapid onboarding. We are handling multiple terabytes of data daily, so we expect some hiccups, but otherwise, it has scaled effectively for our fast-paced migration.
How are customer service and support?
My experience with customer service and technical support has been very present and super responsive. When we submit a case on Splunk support, they usually reach out within the same day or next day. They have consistently helped us resolve any issues we've encountered.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
I used Splunk Enterprise before adopting Splunk Observability Cloud. While other parts of the company were leveraging different logging tools, we primarily revolved around Splunk. When Splunk Cloud became available as the next option, we were ready to migrate.
How was the initial setup?
I haven't had personal experience with pricing, setup cost, and licensing as it's managed by our managerial side.
What was our ROI?
I have seen a return on investment with Splunk Observability Cloud through faster debugging and troubleshooting capabilities with enhanced observability. A significant return on investment comes from not having to host Splunk Enterprise ourselves. Having servers on Splunk's end allows us to focus more on development, monitoring, and our products, rather than maintaining our own local version of Splunk.
What other advice do I have?
I would rate Splunk Observability Cloud overall as a solution 9 out of 10.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Google
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Last updated: Sep 11, 2025
Flag as inappropriateAssistant Vice President & Software Engineer & Infraoperations- & Operations Developer at a financial services firm with 201-500 employees
RUM data has improved visibility into user paths and strengthened operational performance
Pros and Cons
- "Splunk Observability Cloud has helped improve our operational performance and company's resilience, which was their initial offering."
- "I've only experienced downtime, crashes, or performance issues when it isn't configured correctly."
What is our primary use case?
Our main use cases include synthetic monitoring, APM, RUM, alerting, detectors, dashboards, and all related functionality.
What is most valuable?
My favorite feature of Splunk Observability Cloud is the RUM because I like the RUM data. Splunk Observability Cloud has helped improve our operational performance and company's resilience, which was their initial offering. Without it, we wouldn't have any exposure and would be looking at raw data.
What needs improvement?
It can be improved through the integration of AI, which is either coming or already available.
For how long have I used the solution?
I've been using Splunk Observability Cloud for two and a half years.
What do I think about the stability of the solution?
I've only experienced downtime, crashes, or performance issues when it isn't configured correctly.
What do I think about the scalability of the solution?
Splunk Observability Cloud scales effectively with the growing needs of our organization; we simply need to pay more and ingest more data.
Which solution did I use previously and why did I switch?
Prior to this, I wasn't using another solution to address similar needs.
What was our ROI?
I've seen ROI with Splunk Observability Cloud, though I cannot specify the exact amount. We would be unable to track user access issues without it, which would result in significant losses.
What other advice do I have?
I use the cloud almost exclusively and am still learning some features. I handle synthetic monitoring, but don't manage all integrations or usage aspects. I need to explore the AI-powered analytics and guidance, as we haven't implemented it yet. The out-of-the-box customizable dashboards are effective because they contain all the necessary base components.
On a scale of one to 10, I would rate Splunk Observability Cloud as an eight. I appreciate the cloud because it provides more visibility into the user's path. It's quite good, though the observability aspect is somewhat complicated, primarily due to my limited experience with it.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Other
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Last updated: Sep 11, 2025
Flag as inappropriateJava Developer at a financial services firm with 10,001+ employees
Collaborates performance metrics with log data to pinpoint the exact cause of issues and offers error detection
Pros and Cons
- "It supports proactive management, enhances security, and improves operational efficiency."
- "There are always areas for potential improvement to enhance its functionality and user experience."
What is our primary use case?
We use Splunk in APM to monitor our applications. So, we integrated it into our systems to enhance our monitoring and observing capabilities, especially for our microservices.
So, we have used Splunk APM for this.
How has it helped my organization?
APM integrates well with Splunk’s other observability solutions. These logs with application performance monitoring can significantly impact our business in several positive ways, like troubleshooting and root cause analysis.
Using these logs with APM, we can collaborate performance metrics with log data. It allows us to pinpoint the exact cause of issues, such as identifying specific errors in the logs. Because of this, we have access to faster resolution and detailed logs alongside performance metrics, enabling quicker diagnosis and resolution of problems. It also helps us minimize downtime and improve system reliability.
Additionally, it improves our performance optimization with detailed insights and analyzing historical log data along with APM metrics. This allows us to understand long-term trends and make informed decisions about performance improvements and better user experience, like error reduction and proactive monitoring.
Splunk has reduced our mean time to resolution by 30%.
If there is any issue in Splunk; we’ll identify the issue first and look for the error messages, like alerting with the Splunk user interface or in the logs that might indicate what the issue is and then determine which part of Splunk is affected.
Then, we’ll refer to the Splunk official documentation and check the system's health. We’ll review the logs. By following these steps, I can resolve the issues with Splunk, ensuring that our monitoring and analytics capabilities remain effective.
What is most valuable?
Mainly, I like Splunk APM because it will show the errors compared to other tools. We use the dashboards to monitor our applications. It will tell us the errors, and we can solve them quickly.
I have used APM but haven’t used Trace Analyzer, though I have some knowledge of it. We are able to implement it. We have some Trace Log Points in Splunk APM to catch the errors. We have a special graph for it where we can see the red points.
We use OpenTelemetry. OpenTelemetry and Splunk APM are similar in terms of observability and monitoring. We use it for observability standardization, which allows us to collect traces and metrics, making it easier to work with different monitoring tools, including Splunk APM. It is more flexible because it allows us to instrument our applications without being locked into a specific monitoring vendor.
It supports collecting traces, metrics, and logs from our applications, providing a comprehensive view of our performance and health endpoints. This data can be fed into Splunk APM, giving us in-depth analysis and insights about our application.
What needs improvement?
Splunk APM is a robust tool with many capabilities. There are always areas for potential improvement to enhance its functionality and user experience.
For Splunk APM, there could be simplified navigation, like streamlining the user interface to make navigation more intuitive for our users, especially those new to APM, which can enhance usability. We can provide more customization options for dashboards and visualizations to help users tailor the platform to their specific needs.
There could be more integration capabilities with a wider range of third-party tools and platforms would also be beneficial. By focusing on these areas, Splunk APM can enhance its value proposition, improve user satisfaction, and better meet the evolving needs of organizations monitoring their application performance.
For how long have I used the solution?
I have been using it for a year.
What do I think about the stability of the solution?
I never had an issue with the stability. It worked fine.
Which solution did I use previously and why did I switch?
My team has used alternatives to Splunk APM, like Datadog and New Relic.
How was the initial setup?
The initial setup was easy. To fully deploy it, we had to add some signal effects into our applications and just deploy it. It took like 20 minutes. That’s it.
What about the implementation team?
We took some help from our teams and my senior manager and also from other teams across our company. We connected and did all this together.
For deployment, one person can do it, actually, but as we are junior developers, we took help from our senior manager, like three to four people.
Splunk is good like this now. I don’t think any updates would be required, but there are some regular updates and upgrades of Splunk APM, like software updates, version upgrades, and all.
These provide more powerful monitoring capabilities and help ensure the system remains reliable, secure, and aligned with organizational needs. Regular updates, performance tuning, and proactive management help in maximizing these benefits of the Splunk solution.
What was our ROI?
We’ll see the results after the deployment. It’s not that late, and that’s the reason we are using Splunk APM.
Splunk made our job easier in a way. It will give the points when we use any dashboards, and there are no delays in everything, like performance. It will give the error issues very clearly, and it will monitor 24/7. It will show the issues, and it is very effective. It will pinpoint the exact cause of the issues, and it will help us troubleshoot the issues very fast.
It benefits the IT staff in other teams, like operations, improves efficiency, and manages the IT environments more effectively. When it centralizes the logs and search analytics, the powerful capabilities allow IT teams to perform in-depth troubleshooting, identify root causes, and analyze complex issues with ease.
Splunk also provides real-time visibility into IT infrastructure, and we have connected with cross-functional teams around our team to work with Splunk APM. It supports proactive management, enhances security, and improves operational efficiency. It facilitates better collaboration across the team.
What's my experience with pricing, setup cost, and licensing?
The pricing is based on several factors, including the scale of deployment. The pricing model typically includes considerations like the number of hosts, features, and capabilities.
What other advice do I have?
Overall, I would rate the solution a nine out of ten.
Which deployment model are you using for this solution?
Public Cloud
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Principal software architect at a tech consulting company with 10,001+ employees
Useful to find statistical similarities between different traces
Pros and Cons
- "The product's deployment phase is good and very easy because it is done with OpenTelemetry for most of the parts."
- "Once you see the issues related to the scalability part, you need to understand that it is a warning triangle. After seeing the warning triangle, you need to realize that you cannot trust any of the numbers you see in the chart because it is not a complete, full data set."
What is our primary use case?
I use the solution in my company primarily for distributed tracing and metrics troubleshooting. I use the tool to troubleshoot incidents and find the root cause of errors when something goes wrong. I also personally use it to have a developer's understanding of what is going on in my application. Sometimes, there is a case where you might put your application in a library or a new library, and that library also makes calls somewhere. Splunk APM's monitoring can show you that there is a call you are making now that you never used to make in the prior version of the library. In these cases, which you may not know just by looking at the external view of the application code, the tracing part traces everything, including the lowest types of supports.
How has it helped my organization?
The main benefit of the tool I have noticed in the solution is reduced time for the resolution of incidents. The meantime to resolve can help pinpoint the root causes of the issues because you see the connections on the graph in Tag Spotlight. It is easier to pinpoint who is responsible for the incident, especially when you have a larger organization. You have teams that ride services where they need to talk to different services from different teams rather than having to hand off instant resolutions from one team to another. You can often find it much more quickly from the first instance of the problem occurring with the product in place. The tool specifically helps your sites move up more frequently, and then when it does go down, the solution finds the root cause and gets it back up as fast as possible.
What is most valuable?
The most valuable feature of the solution, and my favorite, is always Tag Spotlight, especially considering the way they slice and dice all of Splunk APM's traces by span attributes.
I like the tool because it looks at a whole set of traces in aggregate, which means that it can find statistical similarities between different traces. Often, the cases are such that you will find some traces that show an error and have some other common attribute, which is much more apparent when you look at the feature known as Tag Spotlight rather than just looking at an overall metric. I like Tag Spotlight as it is one of the most simple to use features.
The meantime to resolve, or MTTR, can help pinpoint the root causes of the issues because you see the connections on the graph in Tag Spotlight. I don't personally have metrics associated with MTTR. I am more of the implementer of making certain that all the data is going in and looking at the debugging part. I am not a part of the set of people who keep track of the tool's MTTR.
In our company's case, we have reasonably good metrics related to the meantime to detect. I can't get a rough number when it comes to the meantime to detect, so I don't know for sure. My guess is that we often detect problems reasonably well. Our company figures out that there is some problem, but we just don't know where it is, so I feel that if there is an improvement, then it is mostly in the area of meantime to resolve. When it comes to the meantime to detect, I think our existing metrics are probably sufficient, and adding Splunk APM makes it much easier to detect the resolution time.
The tool has improved our organization's business resilience. In terms of resilience, in the tool, it is possible not to have downtime and make certain things up and running. The faster you get to web pages working again, the more people can actually do things that they want to do, such as trade players on their NFL Fantasy teams. In general, it gives out a better business result.
What needs improvement?
In our company's case, we have some very high throughput services, so they might be getting 10,000 requests per second. Currently, Splunk APM and Splunk Observability want to do things in a way that wants you to send every single span for every single request that is a part of the 10,000 requests per second. The process may give you all the data in the back end, but a lot of data, including CPU memory and network costs, is involved in sending data to Splunk. My feeling is that it would be nice if there were an easier way to send only a sample of my traces, which means that I send 10 percent or 5 percent, and then Splunk would extrapolate on the back end. It is obvious that with 10 percent of traces, the real metrics are something like ten times with a plus or minus margin of error. I am okay with the plus or minus margin of error because I think when you have a high enough request rate, you will see such problems appear even in a lower sample population. The process is political polling. You don't call all 150,000,000 people in the US and ask them who they are going to vote for, and I feel it is better if you choose to take a sample of maybe 10,000 and then extrapolate your findings to the rest. I feel the same should be applicable to trace something in Splunk APM.
For how long have I used the solution?
I have been using Splunk APM for two years.
What do I think about the stability of the solution?
I really haven't noticed anything going wrong with the tool's stability, and I haven't seen any downtime. I don't know if my company is necessarily measuring the stability part by ourselves, but at least for me, it is a pretty growing and solid solution.
What do I think about the scalability of the solution?
There is one issue with the tool's scalability. In our company, we are fairly big in terms of the number of containers we have, especially since we can run very large clusters. When you look at some of the charts, it will say 30,000 time series, reached the limit, and cannot show anymore, or it states that a particular data may not be complete. For me, it is a problem that I would like to see fixed. I have spoken to Spunk's team about it, and they have told me that they do recognize the issue and that other people have also mentioned the same problem. Once you see the issues related to the scalability part, you need to understand that it is a warning triangle. After seeing the warning triangle, you need to realize that you cannot trust any of the numbers you see in the chart because it is not a complete, full data set. I want the tool to either tell me that it can't show me the numbers or that I need to find some way to show all the numbers in a more summarized view. The tool asks you to filter things down more, but it would be nice to offer specific suggestions as to what you could filter down to get it into a more specific or reasonable number. In some cases, my company just has to have a number, considering that we have 1,00,000 containers. If I want to know how many containers are running, currently, the way the backend works in a way where it requires to know how many different time series there are, and then it just says that the 30,000 limit has been reached, but when it happens, I don't know whether it is for 1,00,000 containers, 1,20,000 containers or 80,000 containers.
How are customer service and support?
The technical support team for the solution is good for our company. My company has a weekly meeting with Splunk's sales support team, and if there are any issues, we bring them up for discussion. I have seen that the technical support team is super responsive.
Which solution did I use previously and why did I switch?
My company has its own internal solution, which was built ten to fifteen years ago, and it has progressed over time, but it is only ever used to support metrics and events, not for tracing. In short, it is not used for Splunk APM-related stuff, which is a big change that makes a difference for us.
How was the initial setup?
The product's deployment phase is good and very easy because it is done with OpenTelemetry for most of the parts. The product's deployment is not some custom thing where you have to deploy a particular agent that belongs to a particular company and put it on every single host. It is very easy to follow OpenTelemetry's models for the most part. Splunk is a very big contributor to OpenTelemetry, and I value it. It consists of the reasons I recommend using Splunk as a backend provider. In my company, we are more open to being more of an OpenTelemetry-compliant organization instead of going for other vendors.
What was our ROI?
I can't speak about the tool's ROI since I get paid, but I don't have to spend money on the product.
What's my experience with pricing, setup cost, and licensing?
I don't have much insight into the costs and licensing area attached to the tool. I am the engineer and developer, not the person who writes the checks in the company. I know that my company has a Splunk Enterprise Security license which is used for logging and even for Splunk Observability.
What other advice do I have?
I think the tool has the best trace aggregation features compared to what I have seen in different products, and I feel Tag Spotlight is a good example of it. A lot of the other products support tracing, but when you look at them, you see that they show one trace at a time. I can deep dive into one trace at a time, but what I want to find is commonality across the traces. I think it will give the tool a high grade for all its features. I rate the tool highly since it offers a very good Kubernetes integration. With a lot of data, you can see which part the Kubernetes host is running on, switch between them, and see the application metrics and the actual infrastructure metrics. Seeing it all together can be very useful.
I rate the tool a nine out of ten.
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Vice President, Consultancy Services at a tech services company with 51-200 employees
Improves network visibility through real-time telemetry but pricing continues to be a challenge
Pros and Cons
- "The best feature of this product is the latency and processing of all the telemetry that is being received, which gives full visibility at the right time."
- "The pricing would be one area for improvement."
What is our primary use case?
The main use case with Splunk Observability Cloud is to capture the logs from the SD-WAN in order to check the health of the network and the flow of data from different sources to the central place.
What is most valuable?
The best feature of this product is the latency and processing of all the telemetry that is being received, which gives full visibility at the right time.
One cannot protect and operate what they don't know. When there is this observability, it helps to see exactly what is present, the problems that may exist, and hence, it increases digital resilience by having proactive actions ahead, which increases the availability of the service.
The teams have utilized the ability to enrich data with custom metrics, as this enrichment is one of the key aspects used to have a clear understanding of which assets are being attacked, enabling necessary actions to be taken. The data has been enriched by adding customized information from customers' databases from different sources.
What needs improvement?
The pricing would be one area for improvement.
For how long have I used the solution?
I have used the SIEM solution since 2019 and have had experience with Splunk Observability Cloud for the last year.
How are customer service and support?
I would rate their customer service and technical support an eight out of ten.
How would you rate customer service and support?
Positive
What about the implementation team?
I work for SI, and we deliver to different organizations based on their requirements. We are responsible for implementation, so we implement and they see the value out of it.
What was our ROI?
Splunk Observability Cloud has improved the operational performance of our clients.
What's my experience with pricing, setup cost, and licensing?
It is expensive.
What other advice do I have?
The AI component is one of their strengths; currently, most competitors are moving in the same direction. As SI professionals, we are seeing different improvements in the AI domain for different products, and they are at the leading edge with many vendors following them.
My overall rating for Splunk Observability Cloud would be a seven out of ten.
Disclosure: My company has a business relationship with this vendor other than being a customer. Partner
Last updated: Sep 24, 2025
Flag as inappropriateHead Security Operations at a analyst firm with 11-50 employees
Provides good optimization, performance, and visibility
Pros and Cons
- "Splunk's GUI and dashboard capacity are the most valuable features of Splunk Infrastructure Monitoring."
- "There's no standard use case available where you can see the utilization of the number of use cases I have."
What is our primary use case?
We use the solution to monitor and calculate the number of systems, applications, and DR sites we have. Then, if there is any problem, we can detect the information on which server belongs to which application. This really helps us.
How has it helped my organization?
We have seen 28% to 29% optimization and performance with Splunk Infrastructure Monitoring. You will know the moment you see any anomaly in the system, the server, or the infrastructure. The solution has given us more visibility not only from the infrastructure or server point of view but also from the network perspective.
What is most valuable?
Splunk's GUI and dashboard capacity are the most valuable features of Splunk Infrastructure Monitoring.
Compared to Microsoft Azure, Splunk Infrastructure Monitoring can ingest all the log sources. You can ingest all the data in one single source. Then, it accumulates the data, calculates internally, and gives you the right information you're looking for. Splunk Infrastructure Monitoring is the optimal solution, where you can see everything on one screen.
Our organization monitors multiple cloud environments, including GCP (Google Cloud Platform) and AWS (Amazon Web Services).
We're all completely dependent on Splunk's end-to-end visibility into our cloud-native environment to see everything, including any incident that comes.
Splunk Infrastructure Monitoring has helped drastically improve our meantime to resolve, detect, and investigate.
The solution has helped reduce our mean time to resolve by 28%, which is a huge number. We aim to reduce it by 30% to 37%, but that would definitely require some AI concept and new enterprise security. That's our plan for next year.
Splunk Infrastructure Monitoring has helped improve our organization's business resilience. The moment you receive an incident, you have full visibility. You can go deep into the investigation, do threat hunting, and find the root cause analysis. That's the visibility and performance we look for in enterprise security solutions like Splunk.
Splunk's unified platform helps consolidate networking, security, and IT observability tools. When you have multidimensional solutions and a multi-cloud environment, you have specific applications for finance and patient care. You can see everything consolidated in one solution.
DevOps and GRC compliance solutions come into one solution, and visibility extends. That gives you confidence, and we build trust with the business. Businesses are confident when they're going outside. Because we have full visibility, we provide that trust to the patient and my health care entities that we are safe.
What needs improvement?
The utilization of the use cases is not available. You need to write custom out-of-the-box use cases. There's no standard use case available where you can see the utilization of the number of use cases I have. For example, if you have 200 use cases, do you know if you are utilizing all 200 and if they are actually clicking at the right time?
If I can work 20 use cases out of 200, it is 20% utilization for the use cases. So, I'll focus more on 20% and try to optimize them based on my business requirements rather than focusing on 200.
For how long have I used the solution?
I have been using Splunk Infrastructure Monitoring for six years.
What do I think about the scalability of the solution?
The solution's scalability is marvelous because we can just add on. We are currently using two TB, and the solution gives us the flexibility to add an extra 500 GB next month.
How are customer service and support?
Sometimes, we face technical difficulties because of the limitations of the connectors. Integrating Splunk with post-relational databases like InterSystems is challenging because such applications or databases are not very much publicly exposed. The technical team faces a lot of challenges when integrating because they need to write some custom connectors to integrate the data.
We have some clinical applications specific to a particular specialty, and you have different applications and databases for that. For that, you need to write custom connectors. Sometimes, the technical team lingers on and passes the time because they're also exploring.
I rate the solution's technical support seven and a half out of ten.
How would you rate customer service and support?
Neutral
Which solution did I use previously and why did I switch?
We previously used a different solution called RSA. We switched to Splunk because RSA was not providing the latest changes and many of the upgrades we were expecting. Also, a lot of functionality we were expecting, like XDR, optimization processes, and connectors, was not available. We used RSA for four and a half years. RSA had performance issues, and a lot of use cases were not met because it was an old solution.
What about the implementation team?
We had a system integrator who initially helped us integrate and deploy the solution. They helped us to deploy the solution, and we take their help to develop any new use cases.
What was our ROI?
We have seen a return on investment with the solution. Our KPIs have become smooth. When we have more visibility, our KPIs definitely increase. We can easily measure meantime to detect and meantime to resolve. You will definitely be up to the mark when your incident response capability increases. Our performance has increased. Our IT environment and DevOps team have more visibility and are more transparent now.
What's my experience with pricing, setup cost, and licensing?
The solution's pricing is costly. We're now looking for a cloud version that would have a completely different pricing calculation.
What other advice do I have?
Splunk Infrastructure Monitoring has use case capability, visibility capability, and performance. It also has a vast dashboard capability that no other solution currently provides. There are many solutions in the market, but Splunk stands out separately. With Splunk Infrastructure Monitoring, you can correlate data and ingest any kind of data with your connectors. Flexibility is another important functionality of Splunk.
Overall, I rate the solution an eight out of ten.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer. Home & Health Partner
Buyer's Guide
Download our free Splunk Observability Cloud Report and get advice and tips from experienced pros
sharing their opinions.
Updated: January 2026
Product Categories
Application Performance Monitoring (APM) and Observability Network Monitoring Software IT Infrastructure Monitoring Cloud Monitoring Software Container Management Digital Experience Monitoring (DEM)Popular Comparisons
Microsoft Defender for Cloud
Splunk AppDynamics
Azure Monitor
SolarWinds NPM
PRTG Network Monitor
Elastic Observability
ThousandEyes
Buyer's Guide
Download our free Splunk Observability Cloud Report and get advice and tips from experienced pros
sharing their opinions.
Quick Links
Learn More: Questions:
- When evaluating Application Performance Management, what aspect do you think is the most important to look for?
- APM tools for a Managed Service Provider - Dynatrace vs. AppDynamics vs. Aternity vs. Ruxit
- What solution would you recommend for monitoring traffic utilization of leased lines?
- How Much Should I Budget for an APM Solution?
- Which is the best AANPM product? Should we be considering anything besides for Riverbed?
- Who Uses APM?
- What is your favorite tool for Application Performance Monitoring?
- How does synthetic monitoring differ from real user monitoring?
- Differences between SiteScope and dynaTrace?
- Splunk as an Enterprise Class monitoring solution -- thoughts?




















