Mohammed Aquib A.

SIEM Specialist

Enterprise (> 1000 emp.)

6/22/2019

"Best in SIEM Solution"

4.5/5

What do you like best about Splunk Enterprise Security?

Splunk is the best SIEM solution that a company can have for security of an enterprise. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

There is nothing I feel personally any disadvantage in Splunk SIEM solution. Review collected by and hosted on G2.com.

Splunk Enterprise Security Reviews & Product Details

Splunk Enterprise Security (ES) is a data-centric, modern security information and event management (SIEM) solution that delivers data-driven insights for full breadth visibility into your security posture so you can protect your business and mitigate risk at scale. With unparalleled search and reporting, advanced analytics, integrated intelligence, and prepackaged security content, Splunk ES accelerates threat detection and investigation, letting you determine the scope of high-priority threats to your environment so you can quickly take action. Built on an open and scalable data platform, you can stay agile in the face of evolving threats and business needs. Our extensive ecosystem of Splunk, partner, and community-built integrations as well as flexible deployment options ensure your technology investments are working in tandem with Splunk ES whilst meeting you wherever you are on your cloud, multi-cloud, or hybrid journey.

Seller

Cisco

Discussions

Splunk Enterprise Security Community

Overview by

Mike Tomita

Value at a Glance

Averages based on real user reviews.

Time to Implement

3 months

Return on Investment

19 months

View More Pricing Information

Top-Rated Alternatives

LevelBlue USM Anywhere

4.4/5

(102)

View All Alternatives

Splunk Enterprise Security Integrations

(15)

Integration information sourced from real user reviews.

Splunk Enterprise Security Reviews (224)

View 2 Video Reviews

G2 reviews are authentic and verified.

Here's how.

Muhammad R.

Technical Consultant Manager

Enterprise (> 1000 emp.)

12/7/2025

"Unmatched Visibility and Customization for Security Operations"

5/5

What do you like best about Splunk Enterprise Security?

What I like most about Splunk Enterprise Security is its ability to give clear and comprehensive visibility across the entire environment. The correlation searches, use cases, and dashboards make it easier to identify patterns and prioritize threats. As someone who works in SOC operations and consulting, the flexibility to customize detections and build my own dashboards is a huge advantage and everything feels scalable, structured, and analyst-friendly. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

What I dislike about Splunk Enterprise Security is that some of its features can be quite resource intensive. The platform is powerful, but it sometimes requires significant tuning and infrastructure capacity to keep everything running smoothly. Additionally, certain configurations or customizations can take more time than expected. It’s not a major drawback, but it does require proper planning and optimization. Review collected by and hosted on G2.com.

What problems is Splunk Enterprise Security solving and how is that benefiting you?

Splunk Enterprise Security helps solve the challenge of getting clear, real-time visibility across a wide range of security logs and events. It centralizes everything from correlation searches to threat intel also I can quickly identify what really matters.

For me, the biggest benefit is efficiency. Instead of manually piecing together data from different sources, Splunk ES provides structured dashboards, risk-based alerting, and prioritized insights. This allows me to respond faster, reduce noise, and focus more on meaningful analysis rather than repetitive tasks. Review collected by and hosted on G2.com.

Verified User in Financial Services

Mid-Market (51-1000 emp.)

6/2/2025

"Robust SIEM Solution with Strong Ecosystem Support"

4.5/5

What do you like best about Splunk Enterprise Security?

✅ Powerful Search and Correlation Capabilities

Splunk Enterprise Security excels at log aggregation, correlation, and threat detection. The Search Processing Language (SPL) allows advanced querying that lets our team pinpoint suspicious activity across multiple systems.

✅ Strong Integration with Multiple Systems

One of the key strengths is its ability to integrate with a wide range of third-party systems - firewalls, endpoint detection tools, identity providers, and cloud environments like AWS, Azure, and GCP. It pulls everything into a central platform, which is critical for visibility.

✅ Splunkbase Ecosystem

The Splunkbase app ecosystem is extensive. We’ve used certified add-ons and community-built integrations for tools like Palo Alto Networks, CrowdStrike, Okta, and Microsoft 365. This dramatically reduces the time required to normalize and enrich logs.

✅ Flexible Dashboards and Alerts

Splunk ES provides customizable dashboards and correlation rules, making it easier to tailor detection mechanisms to our organization's needs. The MITRE ATT&CK integration is also a big plus for mapping threats and to evaluate how our detection coverage maps against possible threats.

✅ Scalability

We’ve scaled Splunk ES from ingesting a few hundred GBs a day to multiple TBs without much performance degradation, though it requires careful planning and tuning. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

❌ Learning Curve

The flexibility of SPL is a double-edged sword. New analysts often struggle with query writing and alert customization unless they have a strong background in Splunk or scripting. However, there is now an AI solution which will convert natural language to complex SPL syntax.

❌ Expensive at Scale

Pricing is based on ingest volume, which might be expensive as data grows. Without smart data hygiene practices and archiving, costs can grow easily.

❌ Heavy Resource Requirements

On-premise deployments require significant compute and storage resources. High availability and disaster recovery setups can become complex and costly. However, Splunk Cloud takes care of much of this work if purchased.

❌ Limited Out-of-the-Box Content for Certain Use Cases

Although it comes with prebuilt dashboards and correlation rules, some use cases (like insider threat or advanced cloud threat detection) require additional tuning, enterprise specific knowledge or external tools to be truly effective. Review collected by and hosted on G2.com.

What problems is Splunk Enterprise Security solving and how is that benefiting you?

Splunk Enterprise Security (ES) is helping us solve several core challenges in our security operations, especially around visibility, threat detection, and incident response. Prior to adopting Splunk ES, we had fragmented logging from various sources - firewalls, endpoint tools, cloud services, identity providers - which made correlation and investigation extremely difficult.

With Splunk ES, we’ve centralized all of our log and event data into one platform, allowing our SOC team to correlate activity across the entire environment in near real time. This has significantly improved our ability to detect lateral movement, credential misuse, and advanced persistent threats.

Splunk’s ability to ingest from virtually any source - thanks to its wide compatibility and support via Splunkbase - means we’ve been able to quickly integrate with vendors like Palo Alto, Okta, CrowdStrike, and AWS without building everything from scratch. That’s cut down our integration time by weeks.

Additionally, Splunk ES has enabled us to automate alerting and prioritize threats more effectively using risk scores and MITRE ATT&CK mappings. This has reduced alert fatigue and allowed our analysts to focus on the most relevant threats first.

From a compliance standpoint, we’re now able to generate reports and demonstrate continuous monitoring for frameworks like PCI-DSS, ISO 27001, and NIST with far less manual effort.

The biggest benefit has been improved incident response times - we’ve reduced our mean time to detect (MTTD) and mean time to respond (MTTR) substantially because analysts have a unified view and powerful tools at their fingertips. Review collected by and hosted on G2.com.

Jordan M.

security engineer

Enterprise (> 1000 emp.)

8/4/2025

"Splunk in a security environment"

4/5

What do you like best about Splunk Enterprise Security?

Splunk is easy to use/configure and to find what i need. plus, the splunk employees with whom we work are very talented and skilled Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

they got bought by cisco and we are waiting for integrations to get better Review collected by and hosted on G2.com.

Anugrah Pratap S.

Technical Lead

Enterprise (> 1000 emp.)

11/12/2024

"Unmatched data mining, analysis, and Security monitoring by Splunk ES"

4.5/5

What do you like best about Splunk Enterprise Security?

Splunk ES is very helpful in seamless integration and automation, Data analytics, Investigation, Log source onboarding, dashboard, SPL, ease of search, use-case modification/fine-tuning, you name it. Every task and job in Splunk ES is perfect. Its vendor support is very responsive. Splunk ES has ease of implementation and integration. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

Apart from cost, no one dislikes Splunk ES. Due to its costly services, most organizations use other cloud-native security solutions. Recently, one of our clients also proposed another security solution over Splunk ES. so that's cost is the main disadvantage of Splunk ES in my opinion. Review collected by and hosted on G2.com.

What problems is Splunk Enterprise Security solving and how is that benefiting you?

Splunk ES has provided a very good services to us. Our SOC team was enjoying working on Splunk ES due to its sailient features. We didn't required extra human efforts to help our engineers to do investigate or analyze any security alerts. Due to its Splunk processing language and everything come-up in one go that helps most of the time. That's why our engineers doing their job without breaching the SLA. Review collected by and hosted on G2.com.

Ernesto M.

IT Security Engineer

Mid-Market (51-1000 emp.)

12/17/2024

"Easy to integrate, understand the workflows and to manage."

5/5

What do you like best about Splunk Enterprise Security?

Splunk ES is easy to manage and understard even if you are new with SIEMs. The workflows are easy to follow and the language the splunk uses is easy to learn. Also, it has integration with anything so you can ingest logs from pretty much everything you can think of. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

Might be very expensinve depend of how much data you are ingesting. Review collected by and hosted on G2.com.

Luis S.

Presales

Small-Business (50 or fewer emp.)

5/30/2024

"el mejor SIEM"

4.5/5

What do you like best about Splunk Enterprise Security?

Easy-to-use platform that integrates with different devices Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

The licensing model based on event consumption and the new owner Review collected by and hosted on G2.com.

Manish D.

Staff Security Engineer - SecOps

Enterprise (> 1000 emp.)

4/12/2024

"One of the leading & innovative SIEM solution"

4.5/5

What do you like best about Splunk Enterprise Security?

The simplified UX is what makes Splunk/Splunk Enterprise Security (ES) seperate from all other competitors. The vast range of data connectors in Splunkbase, simplified architecture, granular level of customization options, out of the box data models and complete coverage of MITRE Att&ck are some of the prime features and services offered by Splunk ES. The data model acceleration, notable events, dashboards and wide range of apps & addons makes searching and data transformation tasks really easy. The customer support is great for any type of issues you might be facing. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

The licensing model and cost is bit difficult to understand and manage. Review collected by and hosted on G2.com.

What problems is Splunk Enterprise Security solving and how is that benefiting you?

Collecting audit logs from wide range of data sources within your hybrid infrastructure is a daunting task. Splunk helps you a lot in managing and enhancing your audit log coverage for your infra. The wide range of apps/addons helps you to ingest audit events from any type of log source and you rarely need to bother about parsing. The out of the box content management and visualization dashboards/data models helps you get quick insights into your infra data. Basically having an efficient SIEM solution is a must for any SecOps team to effectively manage the security posture and reduce the cyber dwell time. Review collected by and hosted on G2.com.

Verified User in Information Technology and Services

Enterprise (> 1000 emp.)

7/21/2024

"My experience with splunk enterprise security"

5/5

What do you like best about Splunk Enterprise Security?

The ease of integration, visualisation and alert creation. Data handling and customisation. Minimalistic maintenance Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

There are nothing much to dislike here. But I can say search speed will be a bit of issue for me when it is overloaded unless we are using optimal queries Review collected by and hosted on G2.com.

Alexandra V.

Senior Software Engineer

Mid-Market (51-1000 emp.)

7/16/2024

"Splunk Enterprise Security is the master log data collection and threat detection"

4.5/5

What do you like best about Splunk Enterprise Security?

It is easy to use and quick to collect multiple event and data log with best intrusion dection capability. Easy to integrate and quick to customize dashboard and the initial implementation process is also very easy. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

Advanced security settings not easy especially when new with the system. The support team deseves merit for being helpful and always available when in need. Review collected by and hosted on G2.com.

Santosh V.

Senior Engineer

Construction

Mid-Market (51-1000 emp.)

2/4/2024

"A Game-Changing Security Platform Revolutionizing Cybersecurity."

5/5

What do you like best about Splunk Enterprise Security?

One thing I really love about Splunk ES is a very robust and intuitive security platform that has been a game-changer platform when it comes to revolutionizing Cybersecurity. I like it offers advanced threat detection with ability to detect sophisticated threats by correlating data from multiple sources.

Real-time monitoring and alerting which alerts us during critical security events such as suspicious network traffic or any issues occurring without us knowing.

It also offers real-time threat response which helps us to swiftly detecting and responding to security threats on time before they affect our business processes or systems or apps.

Monitoring log activity for potential security incidents.

Amazing and proactive customer support team.

Intuitive UI for investigation which is pretty easy to use. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

I have experienced that sometimes the events tab doesn't show logs.

Slow interface incase of high data volume. Review collected by and hosted on G2.com.

What problems is Splunk Enterprise Security solving and how is that benefiting you?

We use Splunk ES to monitor security-relavant events, which improves our organisation security and security hygiene. Also use it creating real-time alerts to monitor Log issues by customers. It helps us a lot when it comes to security prospective and to chase threats and vulnerability detection, critical traffic detection firewall device based risks and more.

Overall this is a great SIEM tool for data monitoring, threat detection and remediation. Review collected by and hosted on G2.com.