Splunk Enterprise Security Reviews & Product Details

Splunk Enterprise Security (ES) is a data-centric, modern security information and event management (SIEM) solution that delivers data-driven insights for full breadth visibility into your security posture so you can protect your business and mitigate risk at scale. With unparalleled search and reporting, advanced analytics, integrated intelligence, and prepackaged security content, Splunk ES accelerates threat detection and investigation, letting you determine the scope of high-priority threats to your environment so you can quickly take action. Built on an open and scalable data platform, you can stay agile in the face of evolving threats and business needs. Our extensive ecosystem of Splunk, partner, and community-built integrations as well as flexible deployment options ensure your technology investments are working in tandem with Splunk ES whilst meeting you wherever you are on your cloud, multi-cloud, or hybrid journey.

Seller

Cisco

Discussions

Splunk Enterprise Security Community

Languages Supported

German, English, French, Italian, Japanese, Korean, Chinese (Simplified), Chinese (Traditional)

Solution Type

All-in-One

Overview by

Mike Tomita

Value at a Glance

Averages based on real user reviews.

Time to Implement

3 months

Return on Investment

18 months

View More Pricing Information

Top-Rated Alternatives

View All Alternatives

User Insights

Average based on 248 real user reviews.

Implementation Time

3 months

Perceived Cost

$$$$$

Typical contract price

$0k - $0k

Per Year

Splunk Enterprise Security Integrations

(15)

Integration information sourced from real user reviews.

AWS CloudTrail

AWS Transfer Family

Azure Active Directory...

Cisco Duo

CrowdStrike Falcon Endpoint...

CyberArk Privileged Access...

FortiGate SD-WAN

Microsoft Defender XDR

Palo Alto Networks...

Show More Integrations

G2 reviews are authentic and verified.

Here's how.

Ashok V.

Senior Manager, Business Applications

Enterprise (> 1000 emp.)

7/31/2019

"Great logging and event monitoring tool that makes our debugging life easy"

4/5

What do you like best about Splunk Enterprise Security?

Splunk is a very great tool for logging our SFDC events and it's 6 months and one year option for having logs of our log headers and log details is a killer feature Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

The UI can be more interactive and they can also be little competitive with pricing as the one year option will cost you a fortune as an organization and small startup also need to afford this tool Review collected by and hosted on G2.com.

Verified User in Aviation & Aerospace

Small-Business (50 or fewer emp.)

3/18/2020

"Splunk security"

4/5

What do you like best about Splunk Enterprise Security?

I like the possibility to perform specific research about cybersecurity Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

Nothing in particular, maybe Splunk does not identify the threat in real time Review collected by and hosted on G2.com.

Verified User in Information Technology and Services

Enterprise (> 1000 emp.)

10/23/2019

"Best for security and network teams"

5/5

What do you like best about Splunk Enterprise Security?

Splunk gives you huge access to each end-point and everything on your environment. Especially, it allows you to make your own apps inside the Splunk which makes it more fruitful. Because it can be customized according to your needs. As a cyber security team member, I was happy to use Splunk which made my event management like shelling peas. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

I can say nothing. Maybe the price is a bit much for developing countries. However, Splunk still deserves it. Review collected by and hosted on G2.com.

Recommendations to others considering Splunk Enterprise Security:

Buy it, do not think too much. It is the best. Review collected by and hosted on G2.com.

What problems is Splunk Enterprise Security solving and how is that benefiting you?

We integrated our whole environment from software to devices. Log analysis for the company became easier via Splunk. Especially, user-defined alarms and reports are so useful. Review collected by and hosted on G2.com.

Riya S.

Full Stack Engineer Intern

Enterprise (> 1000 emp.)

7/26/2019

"Nice platform to see the error reports and logs"

5/5

What do you like best about Splunk Enterprise Security?

The best thing is you can set it up as your company wants. Moreover, it's a great software as a service for security. To sell all the error logs in our development server, we use Splunk in our company. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

The search is very slow, sometimes to search a particular log message it takes about 5 minutes. Moreover, the error message doesn't come completely. Review collected by and hosted on G2.com.

Verified User in Security and Investigations

Mid-Market (51-1000 emp.)

7/23/2019

"Adaptive Response Feature"

5/5

What do you like best about Splunk Enterprise Security?

Enterprise Security Adaptive Response feature is very good where you can directly take action from the one console. Previously, Splunk is used for monitoring only and now it is used as a post mechanism also. For example, If some malicious event comes from the endpoint and you want to isolate that endpoint. You can create a new action and use that to isolate endpoint. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

Splunk Enterprise is an add-on on Splunk so it is not isolated from other addon. We might face some security issue if other addons are conflicting with ES. It should come as a product incorporated on top of Splunk. I disliked the slowness of the App when it is installed on the lower configuration VM and it is very heavily built addon with so many javascript and python scripts. Review collected by and hosted on G2.com.

Recommendations to others considering Splunk Enterprise Security:

If you are looking for a security tool I would recommend to go with Splunk Enterprise Security. Review collected by and hosted on G2.com.

What problems is Splunk Enterprise Security solving and how is that benefiting you?

We are monitoring endpoint details of our customer and using adaptive response, will block the endpoint if any malicious activity happens on endpoint. This will help us to boost endpoint security. We are also using the correlation search feature to populate incident review page with the malicious events. Review collected by and hosted on G2.com.

Rmn C.

Ram chhura

Enterprise (> 1000 emp.)

4/16/2019

"Amazing tool to analyze huge logs accurately"

4.5/5

What do you like best about Splunk Enterprise Security?

The UI is so simple and interactive that you provide a simple search string and this powerful tool looks at your terabytes sized logs and show you result in an index form and that too in seconds. It also helps our OPS team to perform a log forensics. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

This tool becomes very expensive if you have huge logs and if the logs keep on increasing so will the price to use this tool. The support from SPLUNK team is not that great. Review collected by and hosted on G2.com.

Recommendations to others considering Splunk Enterprise Security:

Better response from the SPLUNK support team. May be change the price model a bit so that you can have more customers. I believe most the companies don't use this tool because it is so expensive. Review collected by and hosted on G2.com.

What problems is Splunk Enterprise Security solving and how is that benefiting you?

It helps us identify problems in our production environment. The alerts help us identify malicious activity since we have alerts set for certain events. Review collected by and hosted on G2.com.

Verified User in Telecommunications

Small-Business (50 or fewer emp.)

3/28/2019

"A powerful log aggregation solution with immensely useful tools built-in for popular applications."

3/5

What do you like best about Splunk Enterprise Security?

Configuration design: Thoughtful and mature documentation and design of the application regarding enterprise-class scaling on network storage.<br>-POWERFUL tools: The user interface lends itself to learning more about your organization from the logs you collect, through metrics of trends of the logs being gathered. There are also specific modules/add-ons for popular applications to provide more value and event-based monitoring, all without having to develop in-house dashboards and intelligence of those logs.<br>- Customization: You can create your own queries of logs, and event-based alerts. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

Price: This product is not free for more than the minimal use. Pricing can be very expensive, relative to open source offerings. That is the trade-off you pay for not having in-house development of open source offerings. As this product is priced based on gigabytes of indexed logs, it is important to understand the scope of licensing necessary for your environment to determine if it is a good fit for your organization. Review collected by and hosted on G2.com.

Andrew Y.

Software Engineer

Computer Software

Mid-Market (51-1000 emp.)

2/26/2019

"Powerful and overwhelming SIEM"

5/5

What do you like best about Splunk Enterprise Security?

Its abilities to list tremendous amounts of information into events within seconds, the various applications and add-ons, and its visualizations. It encourages continuous analysis and can index any kind of data, also the hardware requirements of Splunk are minimal. Splunk does not require any database to store its recorded events. A great deal of support and help is available in the community. It's extremely easy to set up and can take data input from various sources like remote hosts, logs, scripts, files, network, etc. Moreover, there is a free version that allows indexing 500 MB of data per day. In conclusion, its UI is very user-friendly. The fact that we can aggregate and correlate any events we want is a powerful tool in identifying and stopping malicious activity on or against our network. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

I truly hated the fact that we need to restart Splunk whenever configuration files are changed, but I understand the reason behind it; still, the restart takes quite a bit of time. Also, learning the search processing language takes some time, as it has a lot of commands. The Splunk learning curve is steep and can take over a month to learn thoroughly. Normalizing data is challenging in Splunk. Moreover, many add-ons are Common Information Model (CIM) compatible in Splunk. Review collected by and hosted on G2.com.

Recommendations to others considering Splunk Enterprise Security:

Get Splunk Enterprise for free to experiment with your use case; usually, your proof of concept could easily be used as the final analysis application you need at your Enterprise. The documentation is comprehensive for each topic from installation, administration, search, development, etc. Therefore, you can give it a try. But still, remember this is a relatively new service, and they are working on adding features while maintaining Cloud security. If you are a serious Splunk administrator, perhaps consider a Self-Service Cloud option so you can get things done faster. Review collected by and hosted on G2.com.

What problems is Splunk Enterprise Security solving and how is that benefiting you?

We are using Splunk to log all our web and application logs. Using this log, we have great transparency when it comes to post-mortem analysis of an issue to investigate the pattern and analyze accordingly. Our Splunk environment is used to help troubleshoot issues, monitor for security incidents, and has even helped our police department locate individuals in distress quickly enough to provide intervention. Review collected by and hosted on G2.com.

paul R.

Software Engineer

Computer Software

Mid-Market (51-1000 emp.)

2/26/2019

"An incredible device which fills some needs."

5/5

What do you like best about Splunk Enterprise Security?

It has an exceptionally educational dashboard which enables us to see information about servers in our condition. It gives visuals to the client when we select graphical representation, enabling us to change signs into visual outlines for example pie charts, diagrams, tables, and so on. It is easy to scale with large data sets. It supports different types of data with real-time analyzing. Splunk is extremely easy to install and they provide packages for both Linux and Windows-based operating systems. Installation is easy, just unzip the package and set the path and you are ready to use. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

It can be CPU intensive if not careful. Early releases were quite buggy, but remediations were quick and prompt. The load on our searches, some queries take forever. Sometimes we have great difficulty with getting different products to parse logs correctly into Splunk. Pretty expensive. Review collected by and hosted on G2.com.

Recommendations to others considering Splunk Enterprise Security:

Get Splunk Enterprise for free to experiment with your use case, often your proof of concept could easily be used as the final analysis application that you need at your Enterprise. The documentation is thorough for each topic from installation, administration, search, development, etc. So, you can give it a try. It is worth the effort and investment to ensure your systems and data footprint. There are various tools available in the market that won't break your bank, however, you get what you pay for. This tool gives you a complete 360-degree view of the data footprint. However, there will be a learning curve to get and you will likely find that you are quickly overwhelmed by the amount of things you can do. Especially when you start getting information from different sources and wish to connect that information into dashboards and applications. Review collected by and hosted on G2.com.

What problems is Splunk Enterprise Security solving and how is that benefiting you?

Aggregating and performing pattern matching of events that can inform us if any malicious activity is occurring. It gives us a complete view into our overall security posture with appropriate drill downs into specific data to see what's happening in the organization. Collecting and analyzing data with Splunk is easy. However, there are other products out there - Graylog, the ELK stack - which are free and do the same thing - just with more work. However, once you build your dashboard, you are good to go - throw as much data at it as you want. Review collected by and hosted on G2.com.

Usman S.

Senior Analyst, Technical

Enterprise (> 1000 emp.)

3/22/2019

"A powerful log aggregation solution"

3/5

What do you like best about Splunk Enterprise Security?

- Free to use for small 500MB or less daily ingress, quite nice for small use cases and learning

- No development work required to deploy and provide value.

- Deployment flexibility: client agents are available to use, or clientless configurations for multiple OS platforms. It's also very easy to deploy, not just flexible. its a very simple affair. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

PRICE. The software is so powerful, and they seem to leverage this in the pricing of the licenses. Review collected by and hosted on G2.com.