Opiniones de Splunk Enterprise

Splunk nos ha permitido fortalecer nuestras capacidades de visibilidad sobre una amplia variedad de eventos (de ciberseguridad y funcionales), dada su flexibilidad nativa para consumir, correlacionar y alertar a partir de distintas fuentes. Con ello, hemos podido detectar y reaccionar oportunamente ante aquellos eventos que representan posibles amenazas para nuestros objetivos.

Algunas funcionalidades requieren componentes adicionales.

es una herramienta de facin configuracion e implementacion, aparte de ser intuitiva.

hay veces que se traba la interfas cuando se sastura el equipo.

Capas de procesar gran volumen de datos a partir de múltiples fuentes, rápido y eficaz en el análisis . Nos ha permitido mejorar y fortalecer todos nuestros procesos internos de la empresa y optimizar nuestros objetivos

Es un software bastante caro y no para pequeñas empresas, a no ser que te dediques a ello. Puede requetir implementar algunos complementos adicionales.

It allows me to bring a lot of information into one friendly view. It's a great security audit tool.

It has limited functionality. It is a very memory intensive system. It does not integrate with Lennox.

Easy to install agents on servers, it can parse any form of data easily, Splunk can detect anomalies quite easily and the UBEA feature is amazing.

The cost of this solution is high, and customer service is bad. Apart from that Splunk SPL language is difficult to learn.

Real time use. The ingestion of data and more.

Nothing yet.. maybe performance at times.

Splunk is easy to use, also non technical persons can also use and create their dashboards. Easy to implement and very easy to use the query language, the documentation is also sufficient

We cannot setup the alerts for realtime. we only us it for logging and not for metrics. the maintenance of the dashboards are very time offering.

1. Excellent ML background
2. Dashboard looks classy
3. Multiple external entries possible unlike a lot other tools

1. Very limited variations in reporting
2. Real-time model is not great
3. Not mobile friendly

The saying "you only get out what you put in" is rather apt when utilising Splunk as a SIEM tool - i.e. the more logs / data you can feed into the solution the better the results. Ingesting multiple log files from numerous systems / applications is essential when reviewing security incidents and ensures everything is in one place.

For all that is good with Splunk, the costs are rather high and could force Customers to other solutions unless they make themselves more competitive in the pricing market

The system is highly intuitive to use. It is faster than other solutions I've used on the market and has a huge library of 3rd party plugins to get more from the system. It is easy to create scheduled searches, dashboards, reports etc. but there are a number of additional plugins (at an extra cost) to help with security, single pane of glass and metric collection.

It offers challenges for a decentralized working model. Where Splunk is centrally managed, it is easy to ensure that best practices are maintained. Where the system is opened up for an entire department to utilize and on-board their logs, it becomes more difficult. However, with some creative thinking and good process, this issue can be overcome.

Several of our applications are distributed across multiple systems. It is the same software running on each server but doing the same job for different users. Each server would generate its own log files. When things went wrong, we used Splunk to be able to see what was going on on each server. Click a few buttons and you get two logs from two different servers listed together coordinated by time. But that leads you to discover that the issue came from a separate upstream or downstream server, then bring in those logs too . . . all coordinated by time. Don't get me wrong, the IT guys love these tools for their own enterprise reasons, but as a server stack developer, this was a resource I used OFTEN.

I never fully grokked their SQL like language. I could do basic things daily without issue. However, I often had to hit the documentation to do anything more than a simple "find this" query.

It is an easy to use solution, the implementation is a bit more difficult.

So far, this is a good solution that I use every day.

I think Splunk is first and best software in the field, easy to use, does what it had promised,

pricing could be better, they could be more flexible, support is a bit slow

The product has a ton of Features. Everything what you Need when working with logs is already implemented

Due to the rich set of capabilities regarding, searching, transforming and vizualzing data it‘s sometimes quite tricky to find all necessary query commands

The easy of setup and integration makes this one of my favorites As well as the real time dashboard

Not much i don't like yet, but maybe the interface can do with an update

Splunk Enterprise's versatility is highly valued by its users, as it is capable of analyzing and managing data from a variety of sources, including machine data, logs, and structured and unstructured data formats. This makes it a valuable tool for organizations with diverse data management needs. In addition, users appreciate the software's efficiency in processing and analyzing large volumes of data quickly, allowing them to make faster and more informed decisions. This is particularly important for organizations that need to respond to data in real-time, as Splunk Enterprise's speed and efficiency can help them stay ahead of the curve.

Splunk Enterprise to be complex and difficult to use, particularly for those who are not familiar with data analysis and management tools. The software has a range of features and capabilities, which can be overwhelming.