What is your primary use case for Splunk Enterprise Platform?

My main use case for Splunk Enterprise Platform is to monitor the video on demand success rate for our video platform. A specific example of how I use Splunk Enterprise Platform for monitoring the video on demand success rate is that we monitor the success rate of video on demand plays on different markets where customers will order a video on demand program that will play on their set-top box. We collect a lot of log data for that and if a video on demand session fails, it logs an alarm code that will be monitored through our Splunk Enterprise Platform dashboards. It allows us to show the successful setup rate. It gives us information on the user, their MAC address, so we can see if all of the failed attempts are from the same user or different users. It also shows us different markets and allows us to narrow in on what device it might have failed in on based on what alarm ID it flags.

My main use case for Splunk Enterprise Platform is as a log consolidation tool. In my day-to-day work, we receive email logs, web logs, and any kind of user activity logs, and we investigate based on anomalies in user activity. We initiated user behavior analysis, so we're looking for variations from a known baseline.

Splunk Enterprise Platform is used primarily for our SOC and ingesting all metrics and data from all the virtual machines that we're running in our cloud environment. A specific example of how I use Splunk Enterprise Platform in my daily work is monitoring CPU usage for VMs, and if CPU credits run out on a burstable instance, we know to add more credits or reconsider how we're using that VM.

I use Splunk Enterprise Platform for log aggregation, data validation, sifting through network connections, building out dashboards, using the dashboards and putting them in Excel to then present to executive people who may not understand the granular details of network connectivity or log ingestion.In one example, I was investigating some traffic where we were getting hit on one of our servers and we were trying to see where it was coming from and if our managed rule set was working properly as we configured it. Navigating to Splunk Enterprise Platform, I was able to query for all the traffic coming from the nefarious IPs and also grab the locations of where they were going, where they were coming from, and if they were blocked or not. From that, I exported that data into an Excel sheet and used that to build bar charts or pie charts to present to executive leadership on what was going on. I think it is a great additive to being in the cloud. As I mentioned, we are an AWS shop. Having Splunk Enterprise Platform has made our lives easier because outside of being engineers, we are all still the analysts as well. We still do all of the investigative work and log analysis. Splunk Enterprise Platform makes it very easy for us to parse and grab data that we would need in a given investigation. I am really happy with the product.

My main use case for Splunk Enterprise Platform is gaining insights, visibility, and maintenance for on-premise infrastructure. For insights, visibility, or maintenance, we have a Splunk forwarder on all of our Windows servers, desktop endpoints, Linux servers, and we collect Cisco switch IOS data. For our CCRI, we are required to collect logs from all those devices. Thanks to Splunk Enterprise Platform and SPL, I was able to write queries that would prove that all of our devices were online, checking in, and reporting. I was also able to show us what is actively online at any given time.

My main use case for Splunk Enterprise Platform is security monitoring. Over the past 13 years, I have performed a variety of different roles relating to Splunk, covering ITSI, IT Ops, and Enterprise Security, but predominantly at the moment, my focus is on security monitoring use cases. I typically use Splunk Enterprise Platform for security monitoring to identify insider threats and unusual behaviors with internal actors as well as external customers who use our services. There is a variety of different use cases within that scope, but the main security focus is on identifying insider threats, using a variety of data sources such as AWS logs and Azure logs, correlating different things between logins, activity, and proximity.

Splunk Enterprise Platform is my main tool for security use cases. I use Splunk Enterprise Platform for monitoring and detecting threats. In addition to monitoring, I use it for threat detection and incident response within my security framework.

My main use case for Splunk Enterprise Platform is logging and alerting. A specific example of how I use Splunk Enterprise Platform for logging and alerting is monitoring server resource utilization as well as uptime and whether servers are offline. When a server goes offline or resource utilization spikes, an alert is generated and sent via text message to me so that I can respond quickly.

My main use case for Splunk Enterprise Platform is administering it for our Workday users and onboarding logs into Splunk. I administer Splunk by checking in alerts, looking at health metrics, and leveraging Splunk TAs to onboard logs into Splunk, performing these tasks on a day-to-day basis.

My main use case for Splunk Enterprise Platform focuses on log monitoring, audit governance, and other aspects related to application security, enterprise security, and monitoring. A specific example of how I use Splunk Enterprise Platform for application security or enterprise security monitoring includes user and audit monitoring. User and audit monitoring is my primary focus, but I also have other application logging where I try to understand the code that is being sent in and all of it.

My main use case for Splunk Enterprise Platform is to explain our monitoring practices. We use Splunk Enterprise Platform to monitor application transaction data for financial companies and create dashboards and reports and alerts based on that information. From day-to-day, Splunk Enterprise Platform helps our development team, our product support team, our quality assurance analysts, and at times our fraud detection teams the ability to do their jobs better and to see the data directly as it comes live. The reports and alerts help us in our production environment, be notified of any issues, such as a client having low or no volume. We want to know about that because that means we are not getting their information to us.

My main use case for Splunk Enterprise Platform is payments monitoring from a business monitoring perspective, where I use Splunk to monitor different payment journeys. A specific example of how I use Splunk for payments monitoring is monitoring whether each payment reaches its logical end state. For instance, I monitor whether a payment that is supposed to go through fraud check actually goes through fraud check, or if a payment that is supposed to go through sanction check actually does, and whether accounting for those payments has been completed. In addition to my main use case with Splunk Enterprise Platform, I also use it to trigger different automation. I have created applications including custom alert actions, which I use to trigger third-party automation through Splunk.

My main use case for Splunk Enterprise Platform is to search for data analysis. A specific example of how I use Splunk Enterprise Platform for data analysis is that I look at asset inventory for monitored use cases within our different operating companies. Splunk Enterprise Platform helps me with monitoring asset inventory across those different companies by onboarding hosts and having the data show up in Splunk Enterprise Platform. I check to see if we have coverage and if assets identified by operating companies are showing up in Splunk Enterprise Platform as monitored.

My main use case for Splunk Enterprise Platform is to demonstrate how it works as part of presales work with our partners and customers. I use prepared workshops from Splunk Show, such as Splunk for Rookies, Splunk for Rookies Observability, Splunk for Rookies Security, and Machine Data 101, as specific examples of how I use Splunk Enterprise Platform for my partners and customers. The most challenging aspect of my use case was adding new data from outside sources, but this was in my own lab at home, where I wanted to integrate smart devices' data into Splunk Enterprise Platform.

My main use case for Splunk Enterprise Platform is to demonstrate the opportunity to increase profit for companies. This is a demo for our partners who are selling this software to end users, so I am part of the transaction presentation.

My main use case for Splunk Enterprise Platform is security analytics. A specific example of how I use Splunk Enterprise Platform for security analytics is that when we are alerted about a threat through our IDS, I will often perform investigations through our data that we are pulling into Splunk Enterprise Platform to chase down the threat. I also occasionally use Splunk Enterprise Platform for threat hunting to see anomalies in the data set. I have more to add about how we use Splunk Enterprise Platform, as it was built in and is maintained by our infrastructure team for infrastructure analytics and troubleshooting.

Splunk Enterprise Platform is primarily used for SOAR in my daily work to ensure everything is making its way there and everything is making its way out. I verify and track that everything is working smoothly with Splunk Enterprise Platform through alerting.

My main use case for Splunk Enterprise Platform is log management. I use Splunk Enterprise Platform for log management by collecting all security logs, Microsoft logs, and more. I also manage syslogs in addition to my main use case.

My main use case for Splunk Enterprise Platform is using it as a SIEM for the SOC. I use Splunk Enterprise Platform as a central data collection platform, where the detections or use cases are then written, which are used by our analysts in the SOC.

My main use case for Splunk Enterprise Platform is for collecting application logs and creating dashboards and alerting on them. We have database logs that we collect into Splunk, we review them, and based on the use case of the customer, whoever is requesting, we create a dashboard for them, or a report, or sometimes an alert if they want. I would say that is the main use. We also use it to create dashboards on operating system logs and all that. We ingest operating system logs and create dashboards for them.

My main use case for Splunk Enterprise Platform is as an administrator preparing data for the SOC. My job is to validate that the SOC has the data they need. I validate that the SOC has the data they need using SPL queries in Splunk Web.

My main use case for Splunk Enterprise Platform is log aggregation and SOC operations. For log aggregation and SOC operations, any alerts that are generated by detection tools go into Splunk. Once those alerts are in Splunk, analysts review them manually.

I have been using Splunk Enterprise Platform for about a year. My main use case for Splunk Enterprise Platform is log aggregation. I use Splunk Enterprise Platform for log aggregation in my day-to-day work to ingest all our packet captures.

Splunk Enterprise Platform is primarily used to onboard data from a myriad of sources, including logs from various network devices such as computer workstations, switches, routers, and any network-connected device. This data is onboarded for a SIEM tool to use and for analysts to set up detections. One specific example involved onboarding data from Windows workstations on the network to track authentication activities and flag unusual activity dealing with administrator credentials. Our specific infrastructure uses Splunk on AWS, where we have Splunk instances, indexers, forwarders, and search heads operating as a whole cluster. This cluster is tied into S3 for data storage.

My main use case for Splunk Enterprise Platform is managing a lot of specific service data for a customer. We have multiple services, all with their own individual logs. We aggregate all that data as well as the Windows and Linux security logs and the F5 logs for when users try to access our services. This allows us to aggregate that information to gain a complete picture of when a user interacts with our services, whether they are authenticated or not. It lets us see where they route to, which different services within our platform they touch, and the actions they take at that point. A quick specific example of how I use Splunk in a day-to-day scenario is that we had a request to see all the activity of a specific user over the course of six months. With Splunk Enterprise Platform, we were able to aggregate all the logs for all the services specifically for that user and pull that information to show our investigator. This includes when this user logged in on these days, which services they touched, and the files they opened, downloaded, or uploaded. We can provide a complete picture of all the activity for that user, which would normally take weeks, if not months, to compile. We were able to do it within 20 to 30 minutes.

My main use case for Splunk Enterprise Platform is content development. I typically build dashboards and visualizations for Cisco, Qualys, Tenable, Microsoft, Windows, Linux, and other types of security analysis tools.

My main use case for Splunk Enterprise Platform is security logging. For security logging, we bring in Windows event logs and other logs from data sources and ingest them into Splunk Enterprise Platform.

Our main use case for Splunk Enterprise Platform is collecting syslog information from our servers and network equipment, and then generating alerts based on some security events. I recognize that we are underutilizing Splunk Enterprise Platform.

My main use case for Splunk Enterprise Platform is log aggregation, ensuring that we are meeting all our AU controls, and everything that is required to be kept for investigations, logging retentions and things of that nature specified by the federal directives. We are bringing in all of our Windows, Linux and networking logs that track daily users to ensure that everything is up and running properly and there is no insider threat, outsider threats. We are able to use that to research across the many different sites that we all work with at one time into a single enterprise location.

I do engineering for it to build out the platform, to do both compliance as well as to feed data to a SOC. One specific example of how I use Splunk Enterprise Platform for compliance or for feeding data to the SOC is that we have lots of data sources that are deployed all across our network and have to try to get everything aggregated so that we can build alerts and have visibility into activities happening on the network. So, I deployed a Corelight sensor and architected a data feed to get all of that data back to Splunk Enterprise Platform to be used. I interact with Splunk Enterprise Platform as a bit of a user as well as an administrator and an architect. I run the team that does everything with it.

I use Splunk Enterprise Platform to get logs from different devices in our organization, and after getting logs, it creates some alerts. I do further analysis on those alerts to determine if they are true positives or false positives.

I work with Splunk Enterprise, Enterprise Security, UBA, and SOAR. We are relatively small because of the amount of automation and AI that we have implemented. Probably 20 people use it, but we are a massive enterprise and we fulfill the purpose across the entire enterprise.

Splunk Enterprise Platform serves as our primary solution for centralized log collection, real-time security monitoring, threat detection, incident investigation, and alert management. The cloud deployment simplifies platform maintenance and scaling. Beyond threat detection, we use Splunk Enterprise Platform daily for alert triage, incident investigation, threat hunting, dashboard monitoring, and reporting. It provides us with centralized visibility and helps us respond to incidents more efficiently. For example, when Splunk generates a high-risk sign-in alert, I correlate authentication and endpoint logs, review the user's activity, source IP, device, and MFA events, and then determine whether it is a true positive or false positive.

Splunk Enterprise Platform serves as our SIEM tool where we receive alerts and we primarily depend on it. As a centralized logging and monitoring system, we use Splunk based upon different data types. We receive data from our EDR solutions, our email, and cloud sources, so Splunk acts as a centralized point where we receive alerts from multiple sources. Day-to-day operations include Windows event loggings, such as when we get brute force alerts and similar kinds of alerts. Another example is with respect to Office 365, which is our messaging logs where if there is a need and any email forwarding rules are detected, we set a set of alerts. We also receive alerts from the cloud, GuardDuty logs, and CloudTrail logs.

I was a partner with Splunk for around six years, and later I moved to customer projects. As part of Splunk, I worked as a professional services consultant, and later I began working with multiple customers through a different company as an independent consultant. Splunk Enterprise Platform is exceptional as a SIEM platform, with the breadth and depth built over the last 20 years. The main benefit is that it serves both core operations and security through Enterprise Security. My experience maintaining granular control over the trusted control plane within Splunk involves working with numerous log types that can be ingested, whether from custom application events, OS events, access and identity information, or security or EDR events. Regarding AI usage in RBAC, I have primarily used it for use case management and taking actions once a security notable event is generated. I have used Splunk Federated Search, which I implemented for one of my customers about a year ago. In my experience with Federated Search, I will provide some context on why it was introduced. Splunk was pushing more on Splunk Cloud platform, which is one of their SaaS-based offerings.

The team I work on is a workflow team for the bank. We get a lot of traffic because of onboarding and workflow processes, which results in around a million hits per day. Whenever we have a release scheduled, Splunk Enterprise Platform is a very useful tool for me to monitor the logs.

My main use case for Splunk Enterprise Platform is as a SIEM/SOAR. I use Splunk Enterprise Platform as a SIEM where we send all the relevant logs including firewall logs, EDR logs, authentication logs, application logs, and database logs towards Splunk, and then we write rules based on that. Day-to-day, it is mainly used as a SIEM solution to look at all the security events and write the rules.

I mainly work on log management and observability for our platforms. We use Splunk Enterprise Platform for the collection of logs and primarily for the observability of dashboards related to incident management and our application performance.

Splunk Enterprise Platform is used mainly for monitoring and troubleshooting activities, and we work with SPL to query and filter logs. We identify patterns, and then we investigate issues around different systems. Splunk Enterprise Platform is used mainly for creating dashboards, monitoring alerts, and understanding system behavior. We have a few use cases about the alerting mechanism. We ingest logs from multiple sources and multiple hosts like AWS, Kafka, and different systems, and we use Splunk Enterprise Platform as a SIEM tool. That is our main use case.

I work in the data and analytics space where I deal with large data sets and system-generated logs. I use Splunk Enterprise Platform for monitoring systems. I analyze logs and create dashboards that help our technical teams. Splunk Enterprise Platform is very efficient for us. We monitor logs and troubleshoot our issues, then create dashboards for tracking system performance. We bring in logs from different systems like Windows Event logs and AWS logs, so it is highly efficient for us. It is one of the best SIEM tools. We use the Machine Learning Toolkit.

I use Splunk Enterprise Platform and Splunk Cloud for our Splunk solutions. I work with Splunk Enterprise Platform for the Enterprise, not with Enterprise Security. I use Splunk Enterprise Platform for monitoring systems, analyzing logs, and building dashboards that support our operations, visibility, and business insights. I perform log analysis, create dashboards, and set up alerts using SPL. We query large volumes of logs, identify patterns, and troubleshoot issues. I definitely use Splunk Enterprise Platform's machine learning toolkit. It helps us with predictive analytics in our organization. I have set alerts for daily ingestion using the Machine Learning toolkit in Splunk Enterprise Platform directly. I use SPL commands such as fit, apply, and score for regression and classification analysis, including yes or no category alerts. I mainly use it for anomaly detection in our company. It is very efficient for us in assessing the effectiveness of Splunk Enterprise Platform in detecting anomalies and preventing system outages. I also set alerts for daily ingestion. Overall, it is a great tool for security analysis and log monitoring, and it is one of the best tools we have been using. I have a custom add-on for forwarder management. Instead of having different instances, I made a different app for forwarder management. Anything that happens to that forwarder, I can see using that particular app and add-on SPL. That is how it helps us. I have many different custom add-ons for Splunk Enterprise Platform, and I have directly published them in Splunkbase. Even if our new employees need to see and debug what is the problem in our forwarder, that is how Splunk Enterprise Platform custom add-ons work for us. I definitely leverage Splunk Enterprise Platform for advanced threat detection. It integrates with our existing security tools by aggregating logs from multiple sources such as servers, applications, and network devices. It makes it easier to correlate events and identify suspicious patterns that would not be visible in isolated systems. I use real-time alerts for suspicious activities. I have also set alerts in our organization for users; if multiple failed login attempts occur, then we get an alert. I monitor security events in real-time through dashboards.

In terms of using Splunk Enterprise Platform, we use it for our SOC environment where we have an ES setup separately. We collect logs from various sources like AWS, EDR logs, firewall logs, WinEvent logs, Linux logs, application logs, and specific service logs. We gather that and based on that, we are providing users dashboards, searches, and alerts.

The most valuable feature I have found so far is the correlation rule. That seems to be very valuable for us. I can create any alert using the correlation rule, which seems to be interesting for me. I use Splunk Enterprise Platform for advanced threat detection with the correlation rules, nothing else. We have only very few customers, just two customers. They are not interested in those higher versions of Splunk Enterprise Platform. We rely completely on the correlation rule. We highly rely on this correlation rule.

I am working with Splunk Enterprise Platform, and I have worked with Enterprise and ITSI, both. Sometimes I have worked with ES also, Enterprise Security. I use Splunk Enterprise Platform mostly for log monitoring. In our company and our projects, we are monitoring for log monitoring, we are using Splunk. After that, we have created some dashboards according to our requirement and alerts and reports. Sometimes for historical data, we have created summary indexing. We are managing our Splunk Enterprise Platform infrastructure like search head, indexers, deployment server, and license master. We have 1,000, you could say 10,000+ UF. Some of them we are using with apps like Splunk DB Connect. For Kafka, we are using different add-ons for sending our data to Splunk Enterprise Platform from different log paths and log sources. That is the main use for Splunk Enterprise Platform. Mostly we are using it for log monitoring.

We have been working with Splunk Enterprise Platform for two years. Currently, we have been running Splunk in our SOC for two years, but we have not used the Machine Learning Toolkit yet. I believe it is a powerful tool, but we have not explored it.

I have implemented the complete Splunk Enterprise Platform structure in my previous organization, implementing the platform, creating use cases, dashboard queries, creating dashboards, and onboarding different devices via Syslog and API.

The use cases for Splunk Enterprise Platform ( /products/splunk-enterprise-platform-reviews ) vary depending on the specific scenario. Splunk Enterprise Platform ( /products/splunk-enterprise-platform-reviews ) has different purposes, including data visualization and other applications.

I normally use Splunk Enterprise Platform ( /products/splunk-enterprise-platform-reviews ) for review purposes. It is very easy and convenient. Its GUI is easy for me to review and approve all those things.

I focus on threat detection against stock trading systems. I am in charge of five to seven stock trading companies' B2C systems for detecting threat attacks. Our customers include several stock trading companies, banks and and large mobile careers in Japan.

We are working with AppDynamics, Splunk Enterprise Platform, and other Splunk products. However, the main use case here is with Splunk Enterprise Platform.

Our use case for Splunk Enterprise Platform involved deploying the solution for a client requirement, focusing on their data monitoring and management needs.

I use the solution in my company to capture the events to deal with threat detection, incident response, and compliance reporting. For IT operation management, it gets complex to track the health and performance of IT infrastructure, including our network devices and applications, so Splunk Enterprise Platform can be used for centralized log management.

We use the solution to manage a large volume of data from our servers for the project I'm currently working on. Since we don't need all the data, we filter out and extract the specific information required for our applications. Depending on our needs, we use it to filter, investigate, and analyze log data for any errors or requirements.

We use the solution for patching.

We use the solution to monitor, alert, report, and analyze.

We use Splunk for onboarding updates, dashboards, application monitoring, and insights.

We use the Splunk Enterprise Platform for logging and monitoring purposes. If users log into different databases and do something, we onboard database logs and other AWS logs to Splunk. Then, we create a dashboard alert report, and based on those dashboard alerts, we monitor users' actions. If they perform suspicious activities, we also send alerts. We use the solution to create dashboard alerts, reports, and some query language.

I use the Enterprise platform mainly to monitor infrastructure, applications, and some security logs.

We used the product for cloud-based monitoring or systems monitoring.

We use the solution mainly for security operations. We receive logs from different log sources.

Splunk Enterprise Platform is useful as a tool for its SIEM and SOAR functionalities.

We monitor our airtight network traffic using the Splunk Enterprise Platform. We also use the solution for port monitoring, to monitor which ports are closed, which are open, and flapping if in any port. We use it to check our server performance to see if it gets choked because of high CPU or RAM utilization.

My company uses Splunk Enterprise Platform for monitoring and user base filtering.

We have around 38 virtual machines, including the desktop. We have filled our gap network. Splunk Enterprise monitors all network layer traffic, starting with Cisco traffic port violations. We are monitoring Windows logs, CPU, RAM, and disk utilization in Windows.

We use Splunk Enterprise for data visualization. We use Splunk administration rather than Splunk development. We provide support to users so they can access our Splunk application and use it however they want. For example, if they are not able to view some of the logs that are coming from their servers in our Splunk, then we usually check all the logs here that have been missed and forward the ones that were not forwarded. Also, sometimes they use their access to install some apps. We have Splunk apps and they want us to create an app for their usage. We also need to create these apps in the Splunk application. Sometimes they aren't able to download or upload files into Splunk or other websites. They aren't able to download these reports as PDF files. We usually work on this and try to resolve it as quickly as possible.