Opiniones de Splunk Enterprise

Opinión Splunk Enterprise

Comentarios: Splunk se ha alineado con nuestras expectativas. Recomendado.

Puntos a favor:

Splunk nos ha permitido fortalecer nuestras capacidades de visibilidad sobre una amplia variedad de eventos (de ciberseguridad y funcionales), dada su flexibilidad nativa para consumir, correlacionar y alertar a partir de distintas fuentes. Con ello, hemos podido detectar y reaccionar oportunamente ante aquellos eventos que representan posibles amenazas para nuestros objetivos.

Puntos en contra:

Algunas funcionalidades requieren componentes adicionales.

es buena herramienta

Puntos a favor:

es una herramienta de facin configuracion e implementacion, aparte de ser intuitiva.

Puntos en contra:

hay veces que se traba la interfas cuando se sastura el equipo.

Básica para el Big Data

Comentarios: Muy buena, lo recomendamos aunque es conveniente analizar bien el mercado y los productos parecidos que hay.

Puntos a favor:

Capas de procesar gran volumen de datos a partir de múltiples fuentes, rápido y eficaz en el análisis . Nos ha permitido mejorar y fortalecer todos nuestros procesos internos de la empresa y optimizar nuestros objetivos

Puntos en contra:

Es un software bastante caro y no para pequeñas empresas, a no ser que te dediques a ello. Puede requetir implementar algunos complementos adicionales.

Big data is no problem for Splunk Enterprise

Comentarios: Splunk is a powerful and useful monitoring tool. Splunk's efficiency is enhanced by the ability to integrate third-party apps developed in-house. It's also interesting that we can incorporate a customs alert and dashboard. In most situations, it resolves the need to normalize data, allowing for the use of any and all data in business forecasting. It is analyzed for data that can be utilized to optimize spending plans and asset tracking.

Puntos a favor:

Without worrying too much about data type or normalization, Splunk Enterprise can efficiently manage massive amounts of data from numerous sources. Data may be accessed in a flash, and there are a number of options for tailoring and integrating data analysis workflows to create bespoke dashboards or utilizing apps from our other product partners.

Puntos en contra:

There isn't much I dislike about splunk, however if we have to be picky, it would be that it's more difficult to maintain as an administrator when splunk is installed on outdated architecture.

Complete Security operations with Splunk

Comentarios: Splunk data visualization and its analytics handling chunks of data is exceptional.

Puntos a favor:

Data visualization, Analytics skills with AI-powered and can handle data in TB/per day without any interruptions in services. Live dashboards, developing use-cases and their capabilities (correlation).

Puntos en contra:

complex architecture and efficient skills are required, financial is also not feasible for small and medium customers. no inbuilt query builders for beginners to understand the platform.

Powerful tool to perform db queries

Comentarios: I used Splunk to surface and review platform logs

Puntos a favor:

Possibility to export query results in a variety of formats.

Puntos en contra:

User interface is not intuitive and it requires a steep learning curve

Splunk is a great solution for SIEM and also for monitoring your infrastructure

Comentarios: We needed a way to monitor our internal environment and start to be more proactive with issues, so we started sending all of our logs to Splunk and we we able to get insights we did not know we needed. It is a great solution and they are constantly innovating.

Puntos a favor:

Splunk makes it easy to search through various data including logs. In the past I have had to pour through logs in order to find the one lines among the 100 of thousands of lines. Splunk allows me to search through those logs in a matter of seconds vs the hours it used to take.

Puntos en contra:

Most of enterprise setup is done through the command line. It would be nice to have cluster configuration (index creation) as part of the UI.

Splunk Enterprise, not just a SIEM

Comentarios: We have been using Splunk Enterprise, ES, ITSI, and other Splunk parts for 6+ years in production. This has helped us reduce staff in some cases, increase response time in most cases, and allow non-IT teams to get data and metrics in a fast efficient way.

Puntos a favor:

The versatility is amazing. The same data in logs, such as IIS, can be used for Security, Application performance, and even error handling. This allows us to use one log to help multiple teams. This is just one example.

Puntos en contra:

Start up takes someone who has had some training. While searching and output is easy, its the onboarding of custom apps that takes the know how.

Great Choice for an SIEM

Puntos a favor:

Provides a single location for collecting and analyzing logs. Provides ease of use for non-technical users, but powerful features for security and IT. There is an add-on/app for anything you could imagine.

Puntos en contra:

Some documentation is vague, and when certain things don't work, it can be difficult to find out a solution to the problem.

A better business companion when integrated with RPA

Comentarios: Overall, the experience was positive; even with a free trial license, it was much easier, and on the course and certification side, Splunk has a very good collection of videos and materials that help even a novice quickly setup the integration and indexing.

Puntos a favor:

The most useful thing about Splunk is the ease of integration with application. With uipath on-premises it was very much helpful as the business users can monitor the actions of robots through spluink without entering into uipath orchestrator

Puntos en contra:

Expression creation for indexing was bit hard as it is not user-friendly to business users if they wanted to create any new fields, also the forwarder was not able to directly connect with uipath cloud so that the logs has to be shifted to intermediate file before uploading into splunk, but that seems not an issue with splunk but more related to uipath cloud

A tool which is one for all

Comentarios: Splunk has made me realize the ability to correlate different data from different realms altogether and generate valuable insights.

Puntos a favor:

The ability to use this software for security operations, data analysis, creating dashboards, generating tickets and everything else

Puntos en contra:

Splunk uses its own SPL, which is not very easy to learn. However, there are lots of documentation that Splunk provides to its customers. There is paid training available which is useful for beginners to learn.

Manipulate You Data

Comentarios: Splunk is widely used for manipulation of data and we encounter the use of this tool almostl twice a week. Even though it costs much more but still we have not found any alternative that is able to offer all these functionalities.

Puntos a favor:

Splunk is very easy to use due to high community support and many video tutorials available online for new users to learn. Functionalities are robust and simple to use. Data retrieval and visualisation is nice and easy if you know the right querying process. Machine Learning supports enhances performance for the cloud, especially. It collect wide variety of data and still it amaze you the way it retrievs it.

Puntos en contra:

There are many tools available in market which are potential competitors of this tool and that too at reasonable pricing. Splunk offers more functionalities but costs you too much if you look at the work it does. Complex queries may require large CPU usage and may even freeze or atleast slow down the system for a while. Need to be specific while querying the data.

One of the best monitoring solutions for different platform.

Puntos a favor:

Best tracking and data analysis tool which help to monitor and manage the server and system component in very effective way. Real time Visualization helps to take the quick decision so that desired action can be taken to avoid failure.Best data collection in the forms of log and which helps to define the best set of automation jobs to fix the issue.

Puntos en contra:

There are few components or observation like,1. most of the time observes the slowness in the performance.2. Sometime observe the delay in the issue or updated log reflection on the portal. 3. Need more storage to manage and maintain the lo g which impact organizational costing and budget.

A powerful log aggregation solution with immensely useful tools built-in for popular applications.

Puntos a favor:

- Free to use for small 500MB or less daily ingress, quite nice for small use cases and learning - No development work required to deploy and provide value. - Deployment flexibility: client agents are available to use, or clientless configurations for multiple OS platforms. It's also very easy to deploy, not just flexible. its a very simple affair. - Segmentation of logs: You can create separate instances of of logs to aggregate, based on organization needs. And those instances can have their own individual storage policies to optimize consumption of storage resources. - Configuration design: Thoughtful and mature documentation and design of the application regarding enterprise-class scaling on network storage. -POWERFUL tools: The user interface lends itself to learning more about your organization from the logs you collect, through metrics of trends of the logs being gathered. There are also specific modules/add-ons for popular applications to provide more value and event-based monitoring, all without having to develop in-house dashboards and intelligence of those logs. - Customization: You can create your own queries of logs, and event-based alerts. - Web-based GUI that clean is powerful - Sales/Technical Reps are top notch in fielding questions and evaluating environment for deployment. They were extremely helpful in helping our organization develop procedures and scaling our environment for expansion with our existing infrastructure.

Puntos en contra:

- Price: This product is not free for more than the minimal use. Pricing can be very expensive, relative to open source offerings. That is the trade-off you pay for not having in-house development of open source offerings. As this product is priced based on gigabytes of indexed logs, it is important to understand the scope of licensing necessary for your environment to determine if it is a good fit for your organization. - Watch your saved queries and hardware resources: Users have the ability to create and save queries. Like in database queries, some are more efficient than others. Large inefficient queries can be very resource-intensive. If you notice slowness in day-to-day queries, or navigation in the UI, or resource use in contention, keep an eye on saved queries and user practices.

Great, wholistic centralized monitoring solution

Comentarios: I've been using Splunk for over 8 years. I've seen it constantly improve and change a lot. I do enjoy it. Cloud is getting better and much better parity with on-prem

Puntos a favor:

We use this as our SIEM. The ability to have the data ingest, visualization, alerting and correlation all in one product is very important to me from a security standpoint. We're cloud-first so having that ability with large cloud providers is important to me (AWS, Okta, GCP, etc)

Puntos en contra:

The cost can be a little concerning and htere is a bit of a learning curve when you first get into Splunk. User groups, their forum and pro serv all help with that.

Splunk Enterprise is a powerful data analytics software

Comentarios: I believe getting important data analysis in real-time saves us from threats

Puntos a favor:

Splunk Enterprise offers real-time data analysis tools makes it possible for my institution to see and take immediate action against security risks, performance difficulties, and other operational concerns.

Puntos en contra:

Splunk Enterprise is really expensive and it is a huge part in our annual budget because we require add-ons.

Great platform for data analysis and visualization

Comentarios: Splunk Enterprise is a great data analysis and visualization platform to show real time status with live dashboards.

Puntos a favor:

Security Information and Event management, log analytics, custom dashboards and workspaces

Puntos en contra:

Auto upgrade management and notifications for Add-ons. Leaning more towards config file based implementation instead of UI based implementation

Splunk the best analytic tool

Comentarios: It gives best Return on Investment as analyzing the data and giving proper insights in form of Dashboards and notifying with help of Alerts if any kind of threat running in infrastructure and apart from that Deployment and use is very easy.

Puntos a favor:

There are lot of features which Splunk offers - 1) We can onboard data from any server, device or system using Universal Forwarder 2) Onboarded data are later stored in Indexers and searched further in Search Head for analyzing the internal logs 3) Using the data we can create customizable Dashboards and get proper insights of data and create Alerts to identify any kind of Threat or anomalies running in environment 4) Deployment is very easy on-prem servers 5) We can also use Hybrid Deployment on Cloud as well.

Puntos en contra:

1) As it give large amount of features but licensing is too high 2) There are lot of other Open Source software which can be used as alternative of Splunk as Analytic tool because Splunk is paid one.

Best SIEM

Comentarios: Great SIEM that beats the competition, we utilized it for various functions

Puntos a favor:

Splunk appsStrength and capabilitiesIntegration with most solutions

Puntos en contra:

Resource utilizationLimited local partner support

Best Tool for Monitoring Purposes.

Comentarios: As a user of Splunk, we generally used to monitor the log provided by the server clusters belonging to a tool called API Connect. As the logs are stored in Splunk, we tally the transaction count from API Connect tool and filter the log search in Splunk with a particular search query. We can download the logs of particular time and date of API Connect servers in case of transaction count issues. We create a dashboard for all the individual API's transaction count in terms of total transaction count of all API's. In this way, it makes our work easier to find out which API has the highest transaction count. We even use Splunk to know the state of the machine. Reports generated by the Splunk helps us to find out the API with the highest response time. In this way, Splunk makes our work a lot easier as it is very fast and highly secure.

Puntos a favor:

1) Accepts multiple data formats like CSV, JSON, XML 2) Does the hard work for us i.e converting machine data to a human-readable format. 3) Can create customized alerts to serve our business purpose. 4) Searching on the based on queries is pretty simple. 5) We can create dashboards to analyze and visualize our search results. 6) Can export the log content to our Personal computers. 7) Setting up plugins and integrating with any tool that needs monitoring is pretty easy. 8) Technical support for the Splunk is very quick as they have a dedicated staff for that.

Puntos en contra:

I did not find any flaws with this software.

Great for log analysis

Comentarios: Splunk has been key in sever major issue root causes by analyzing logs and from that being able to build reports and determine causes of issues. In addition being able to trend and look for the data in the many logs is very helpful.

Puntos a favor:

We use this tool primarily as a repository for syslog messages for infrastructure. It allows us to quickly analyze the logs and patterns to determine issues based on patterns. In addition it alerts very well from text based trigger alerts. These features are very easy to use and dependable.

Puntos en contra:

I do not have any cons for this software. Mainly as a user it does exactly what I need it to do with no overhead and confusing interfaces.

Great log analysis software

Puntos a favor:

Integrates with almost all the software seamlessly..where there is a software application that produces log, splunk can be easily integrated. Gives very powerful insights into the logs Alerts can be setup on the logs, and notifications sent out which is great again for managing the health of your application

Puntos en contra:

The query language, though powerful, has a learning curve. Particularly as one goes towards complex queries. If it could be made closer to natural language, it would be so much smoother to learn. Hope that will happen sometime in future.

A tool that every sys admin needs to have

Puntos a favor:

I'm not sure from where to start in this case. We use splunk for many things but mostly to analyze the traffic on the network / firewalls. It provides us with a nice overview of what's going on. It makes it very easy to spot spikes on the network and it will provide you also with deep analyzes. For us it's an indispensable tool, probably the best tool we have.

Puntos en contra:

To search for something is not always easy, however there are a lot of forums online, so finding help is not that difficult.

Splunk is a lifesaver!

Comentarios: It’s been wonderful. I was able to take most of my forwarded lambdas and charts them to watch duration and throughput. Notifications and alerts let me know if things are out of whack. Such a relief to know Splunk is watching my back!

Puntos a favor:

If you need real-time grokking into your infrastructure, look no further than Splunk. I love love love the dashboards. It’s easy to tell a story with your data, and the live search is so FAST!

Puntos en contra:

SPL is a little hard to get used to, but once you get the hang of it, it’s not so bad. I recommend downloading their community edition for some great examples of queries and dashboards.

This is the tool every devops should have expertise on!

Comentarios: Made life easier for all SRE/DevOps oncall.

Puntos a favor:

First of all you don't need to login to your servers. Just configure splunk forwarder on all of your server and have peace of mind. During outages you dont have to panic and just rely on Splunk and be sure that you will have your root cause visible in splunk.

Puntos en contra:

Kernel huge page issues, Search head clustering, Index clusetering. These features are as good as costly too. For SHC and IC it does need all same config hosts.