Opiniones de Splunk Enterprise

Opinión Splunk Enterprise

Comentarios: Splunk se ha alineado con nuestras expectativas. Recomendado.

Puntos a favor:

Splunk nos ha permitido fortalecer nuestras capacidades de visibilidad sobre una amplia variedad de eventos (de ciberseguridad y funcionales), dada su flexibilidad nativa para consumir, correlacionar y alertar a partir de distintas fuentes. Con ello, hemos podido detectar y reaccionar oportunamente ante aquellos eventos que representan posibles amenazas para nuestros objetivos.

Contras:

Algunas funcionalidades requieren componentes adicionales.

es buena herramienta

Puntos a favor:

es una herramienta de facin configuracion e implementacion, aparte de ser intuitiva.

Contras:

hay veces que se traba la interfas cuando se sastura el equipo.

Básica para el Big Data

Comentarios: Muy buena, lo recomendamos aunque es conveniente analizar bien el mercado y los productos parecidos que hay.

Puntos a favor:

Capas de procesar gran volumen de datos a partir de múltiples fuentes, rápido y eficaz en el análisis . Nos ha permitido mejorar y fortalecer todos nuestros procesos internos de la empresa y optimizar nuestros objetivos

Contras:

Es un software bastante caro y no para pequeñas empresas, a no ser que te dediques a ello. Puede requetir implementar algunos complementos adicionales.

Best SIEM in the market

Comentarios: My overall experience has been awsome so far. I would rate it 8.5/10.Splunk has been as effective soluntion when it comes to triaging and monitoring of day to alerts.

Puntos a favor:

- Easy to triage and monitor alert (Very fast and gives effective results as compared to other produts)Arcsight,Devo etc- Customer Support is excellent- Threat Hunting can be done effectively with the help of Splunk(IOC based,Corellation based etc)- Log parising is very effective & intelligent.

Contras:

- The only think i liked least about splunk is the cost involved/pricing model in case of high data volumes.

Big data is no problem for Splunk Enterprise

Comentarios: Splunk is a powerful and useful monitoring tool. Splunk's efficiency is enhanced by the ability to integrate third-party apps developed in-house. It's also interesting that we can incorporate a customs alert and dashboard. In most situations, it resolves the need to normalize data, allowing for the use of any and all data in business forecasting. It is analyzed for data that can be utilized to optimize spending plans and asset tracking.

Puntos a favor:

Without worrying too much about data type or normalization, Splunk Enterprise can efficiently manage massive amounts of data from numerous sources. Data may be accessed in a flash, and there are a number of options for tailoring and integrating data analysis workflows to create bespoke dashboards or utilizing apps from our other product partners.

Contras:

There isn't much I dislike about splunk, however if we have to be picky, it would be that it's more difficult to maintain as an administrator when splunk is installed on outdated architecture.

The only tool you need to manage production data

Comentarios: I'm very pleased with the data management capabilities Splunk Enterprise has given us. Before we implemented it, we were really struggling to make sense of some of the big data we get from our machines, but now, we can get very detailed insights into hw the machines are performing at any time. It's helped us monitor performance, issues, and opportunities much easier.

Puntos a favor:

I love how detailed you can have the dasboards and charts go. It supports tons of chart types, and custom reporting elements. But above all, with the automaetd monitoring, you can have access to continuous insights from large data you wouldn't have been able to make sense of otherwise.

Contras:

It's quite difficult to set up in the beginning. It took us a lot longer than expected to map our production data onto the system. But once you have it up and running, it works like clockwork

Spunk Review

Puntos a favor:

It allows me to bring a lot of information into one friendly view. It's a great security audit tool.

Contras:

It has limited functionality. It is a very memory intensive system. It does not integrate with Lennox.

The most expensive tool, requiring highly-skilled employees, capable of limitless value

Comentarios: Splunk's SPL is a flexible, straight forward query-language with aspects of SQL, R, Python, and Bash. The fact that an analyst can learn to be an engineer through using the platform provides ease of growth. It is unmatched in its automation to make data actionable, while providing reporting and visualization capabilities.

Puntos a favor:

Splunk is provides a single tool for log aggregation, log analysis, and visualizations. Threat hunting, applying threat intelligence, and incident response are easily repeatable; pushing organizations to proactive security processes.

Contras:

Splunk is expensive, especially when an organizations is exploring and building new security or data use cases. It also requires a lot of engineering maintenance, making the quality of the data highly-dependent on the skill(s) of those supporting it. Many organizations do not maximize its benefit because it is poorly managed or supported by low-skilled employees.

Best log monitoring tool

Puntos a favor:

Powerful search language Advanced visualisation Flexibility to accept logs from any source High availability Ease of administration

Contras:

The cost is too high compared to other log monitoring tools.

A better business companion when integrated with RPA

Comentarios: Overall, the experience was positive; even with a free trial license, it was much easier, and on the course and certification side, Splunk has a very good collection of videos and materials that help even a novice quickly setup the integration and indexing.

Puntos a favor:

The most useful thing about Splunk is the ease of integration with application. With uipath on-premises it was very much helpful as the business users can monitor the actions of robots through spluink without entering into uipath orchestrator

Contras:

Expression creation for indexing was bit hard as it is not user-friendly to business users if they wanted to create any new fields, also the forwarder was not able to directly connect with uipath cloud so that the logs has to be shifted to intermediate file before uploading into splunk, but that seems not an issue with splunk but more related to uipath cloud

really true nice monitoring tool if its nice implemented

Comentarios: For me it is a very good experience. It is necessary to develop a good implementation of IT INC Management

Puntos a favor:

It helped me enormously in my job as IT INC Management including detailed reports and alerting any necessary information.

Contras:

It has a somewhat complex paring curve and there are no simple tutorials or parallel design of tutorials for new managers

Splunk for Enterprise

Comentarios: A very helpful product that can improve your way to do business intelligence and forecasting.

Puntos a favor:

Data visualization is very clear and easy to use.

Contras:

The possible to share with many people data and dashboards.

Flexible reporting and dashboard constructing using Splunk

Comentarios: Overall Splunk is a good reporting tool you can use to show your data for decision-makers to determine the business performance. Easy to integrate with data sources and providers. Requires a little knowledge of how to construct queries. But plenty of developer documentation is available.

Puntos a favor:

Splunk offers a lot of ways to connect with multiple data providers and sources to populate the reports and dashboards you need to show your business performance or data.

Contras:

Customer support was a little slow. Requires a little knowledge of how to construct queries.

A powerful log aggregation solution with immensely useful tools built-in for popular applications.

Puntos a favor:

- Free to use for small 500MB or less daily ingress, quite nice for small use cases and learning - No development work required to deploy and provide value. - Deployment flexibility: client agents are available to use, or clientless configurations for multiple OS platforms. It's also very easy to deploy, not just flexible. its a very simple affair. - Segmentation of logs: You can create separate instances of of logs to aggregate, based on organization needs. And those instances can have their own individual storage policies to optimize consumption of storage resources. - Configuration design: Thoughtful and mature documentation and design of the application regarding enterprise-class scaling on network storage. -POWERFUL tools: The user interface lends itself to learning more about your organization from the logs you collect, through metrics of trends of the logs being gathered. There are also specific modules/add-ons for popular applications to provide more value and event-based monitoring, all without having to develop in-house dashboards and intelligence of those logs. - Customization: You can create your own queries of logs, and event-based alerts. - Web-based GUI that clean is powerful - Sales/Technical Reps are top notch in fielding questions and evaluating environment for deployment. They were extremely helpful in helping our organization develop procedures and scaling our environment for expansion with our existing infrastructure.

Contras:

- Price: This product is not free for more than the minimal use. Pricing can be very expensive, relative to open source offerings. That is the trade-off you pay for not having in-house development of open source offerings. As this product is priced based on gigabytes of indexed logs, it is important to understand the scope of licensing necessary for your environment to determine if it is a good fit for your organization. - Watch your saved queries and hardware resources: Users have the ability to create and save queries. Like in database queries, some are more efficient than others. Large inefficient queries can be very resource-intensive. If you notice slowness in day-to-day queries, or navigation in the UI, or resource use in contention, keep an eye on saved queries and user practices.

Great, wholistic centralized monitoring solution

Comentarios: I've been using Splunk for over 8 years. I've seen it constantly improve and change a lot. I do enjoy it. Cloud is getting better and much better parity with on-prem

Puntos a favor:

We use this as our SIEM. The ability to have the data ingest, visualization, alerting and correlation all in one product is very important to me from a security standpoint. We're cloud-first so having that ability with large cloud providers is important to me (AWS, Okta, GCP, etc)

Contras:

The cost can be a little concerning and htere is a bit of a learning curve when you first get into Splunk. User groups, their forum and pro serv all help with that.

Splunk: A Monitoring Tool for all your needs

Comentarios: If i have put a word it would say "Fantastic". The functionalities Splunk provides eases team to manage/monitor their IT infrastructure and internal application you will be well aware about the performance of your applications. Setup alerting and take necessary actions in stipulated time to overcome all the issues which may affect your application performance.

Puntos a favor:

Splunk offers various features whether you need to setup monitoring on your server, application logs based on logs ingestion set alerts so that teams got notified on real time and take actions accordingly. In this way, it helps to monitor application which are mission critical. You can make dashboards in Splunk where you can configure various components such indexes, data inputs and schedule reports as well. To achieve additional functionalities we can install third party apps as well such as AWS Add on for cloud watch log ingestion.

Contras:

From Admin perspective, I found user access management a little difficult. The roles of access management becomes complicated because some time the config files for that didn't came very handy. Other then that I think all in all Splunk provides fulfill all of the requirements.

Splunk the best analytic tool

Comentarios: It gives best Return on Investment as analyzing the data and giving proper insights in form of Dashboards and notifying with help of Alerts if any kind of threat running in infrastructure and apart from that Deployment and use is very easy.

Puntos a favor:

There are lot of features which Splunk offers - 1) We can onboard data from any server, device or system using Universal Forwarder 2) Onboarded data are later stored in Indexers and searched further in Search Head for analyzing the internal logs 3) Using the data we can create customizable Dashboards and get proper insights of data and create Alerts to identify any kind of Threat or anomalies running in environment 4) Deployment is very easy on-prem servers 5) We can also use Hybrid Deployment on Cloud as well.

Contras:

1) As it give large amount of features but licensing is too high 2) There are lot of other Open Source software which can be used as alternative of Splunk as Analytic tool because Splunk is paid one.

Best SIEM

Comentarios: Great SIEM that beats the competition, we utilized it for various functions

Puntos a favor:

Splunk appsStrength and capabilitiesIntegration with most solutions

Contras:

Resource utilizationLimited local partner support

Excellent product

Puntos a favor:

It is an easy to use solution, the implementation is a bit more difficult.

Contras:

So far, this is a good solution that I use every day.

Great for log analysis

Comentarios: Splunk has been key in sever major issue root causes by analyzing logs and from that being able to build reports and determine causes of issues. In addition being able to trend and look for the data in the many logs is very helpful.

Puntos a favor:

We use this tool primarily as a repository for syslog messages for infrastructure. It allows us to quickly analyze the logs and patterns to determine issues based on patterns. In addition it alerts very well from text based trigger alerts. These features are very easy to use and dependable.

Contras:

I do not have any cons for this software. Mainly as a user it does exactly what I need it to do with no overhead and confusing interfaces.

One of the best monitoring solutions for different platform.

Puntos a favor:

Best tracking and data analysis tool which help to monitor and manage the server and system component in very effective way. Real time Visualization helps to take the quick decision so that desired action can be taken to avoid failure.Best data collection in the forms of log and which helps to define the best set of automation jobs to fix the issue.

Contras:

There are few components or observation like,1. most of the time observes the slowness in the performance.2. Sometime observe the delay in the issue or updated log reflection on the portal. 3. Need more storage to manage and maintain the lo g which impact organizational costing and budget.

A tool that every sys admin needs to have

Puntos a favor:

I'm not sure from where to start in this case. We use splunk for many things but mostly to analyze the traffic on the network / firewalls. It provides us with a nice overview of what's going on. It makes it very easy to spot spikes on the network and it will provide you also with deep analyzes. For us it's an indispensable tool, probably the best tool we have.

Contras:

To search for something is not always easy, however there are a lot of forums online, so finding help is not that difficult.

Excellent logging and troubleshooting tool

Comentarios: As a software quality assurance engineer, I love that I can setup a single dashboard where I can then view the same data from any lane I select from a dropdown. If I see a problem in the Test lane, I can quickly check all of the other lanes for the same issue by simply changing the dropdown value.

Puntos a favor:

Splunk can give you extreme insights into how your systems and software are functioning. Not only is the search very flexible and powerful, the customizable dashboards give a status report at a glance into trends, problems and performance. You can also set up email alerts when errors occur limiting the need to have Splunk opened on your machine all the time.

Contras:

Splunk has a learning curve. They have extensive documentation but it isn't intuitive and some features are buried pretty deep. We have an onsite expert who holds bimonthly meetings to answer questions in a group forum.

This is the tool every devops should have expertise on!

Comentarios: Made life easier for all SRE/DevOps oncall.

Puntos a favor:

First of all you don't need to login to your servers. Just configure splunk forwarder on all of your server and have peace of mind. During outages you dont have to panic and just rely on Splunk and be sure that you will have your root cause visible in splunk.

Contras:

Kernel huge page issues, Search head clustering, Index clusetering. These features are as good as costly too. For SHC and IC it does need all same config hosts.

Splunk Enterprise Reivew

Comentarios: My overall experience with splunk is too good. It helps our organization to set a real time monitoring system which keeps checking our server health and alert us if anything goes wrong. So, team can quickly resolve the issue and minimize the business impact.

Puntos a favor:

Real Time monitoring is the best feature which we like most about this software. It helps to send the notification or alerts if they are something wrong is going on in the server. So, team member can quickly resolve the issue.

Contras:

As of now, i don't have anything which i don't like about this software.