What needs improvement with Splunk Enterprise Platform?

I do not have any suggestions on how Splunk Enterprise Platform can be improved because I am happy with it. If I had to think of one area where Splunk Enterprise Platform could be better or easier to use, helpful hints maybe could be added where you hover over something and it gives you some ideas of what you can do for that feature.

The ability to delete data is something I would suggest for improvement, as at the moment, you can delete data from search, but you can't delete data permanently, which is an issue sometimes.

Splunk Enterprise Platform can improve by taking more positive steps towards user-friendliness so that more people can access it without having to go through a bunch of training to learn how to use it.

Perhaps the interface could be improved. The console has been the same since I first started using it. The dashboard could be changed around and features could be upgraded, but as far as the functionality and the usability of Splunk Enterprise Platform in general, I do not have any negative things to say about it.

When we had a consultant come on site, they installed a bunch of apps, and some of those did not work. In order to go back and clean everything up, we have to go into the back end. It would be helpful if there were a way to look into the installed apps, which ones are being used, and which ones are not being used.

Certain parts of Splunk Enterprise Platform, such as the KV store, are quite monolithic and tightly coupled into Splunk Enterprise Platform. It would be beneficial to deploy Splunk Enterprise Platform while using different KV stores and technologies; for example, if we are running in the cloud, it would be beneficial to leverage cloud vendor turnkey services and abstract them away from Splunk Enterprise Platform. This would let us tie it into existing systems and benefit from the scaling involved.

I think having a dashboard of SPL queries would be really helpful to improve Splunk Enterprise Platform.

I think Splunk Enterprise Platform can be improved by introducing federated search to search different data and adding in more cloud capabilities that are available into Splunk Enterprise quickly enough, because we pay for the same features that you provide in cloud. I would appreciate having all features in cloud available in Enterprise as well.

I think Splunk Enterprise Platform could be improved by reducing the number of components into a single component, similar to what Cisco data fabric is bringing in, while seamless integration is already in place.

Splunk Enterprise Platform improvements could come with a bit more robustness in the SPL query syntax. There are certain things that we cannot do together, and there are certain queries that are limited in what they can do or there are certain combinations that will not work together. That would be the biggest improvement overall because that is the foundation of all of Splunk, which is just being able to build from that.

To improve Splunk Enterprise Platform, it needs more AI capabilities. Although I know Splunk is heavily investing in AI-related technologies, I would like to see more AI capabilities in the future. Regarding needed improvements for AI capabilities, governance should be on different guardrails, with monitoring of the AI models that Splunk is using, so informed decisions can be made. Regarding the accuracy and reliability of Splunk Enterprise Platform's AI output, I have not used it because I am still exploring that area, so I am unable to comment on it. My impression of Splunk Enterprise Platform's capability to manage data sovereignty at a petabyte scale within my environment is a solid ten. My use of Splunk's Federated Search for querying data in place has evolved. The main use case nowadays is that I have data in Cisco data fabric, and Splunk reaches out to that data using federated search, which is a game-changer. I would like to see improvements on the performance side where federated search is not slowing me down. Maintaining granular control over data using the trusted control plane within Splunk Enterprise Platform is generally handled by my admin team, as I am mostly on the Splunk COE team, Center of Excellence team. As my organization explores new use cases including agentic AI, Splunk Enterprise Platform's governance and role-based access controls play a role in managing access to operational data. I govern the role-based access control for knowledge objects, which should be similar for AI capabilities. My impression of Splunk Enterprise Platform's approach to managing governance within a private network environment has been really good.

Splunk Enterprise Platform can be improved with AI integration across the board to facilitate not just search but also to help us ingest different types of data, adapt to changing requirements in the data space, understand our data better, and visualize and catalog our data. The most specific pain point I encounter is handling complex data ingest. Regarding Splunk Enterprise Platform's AI capabilities, governance and security are strong, but it can be challenging when permissions are not structured correctly from the very beginning, particularly when wildcard permissions are applied. Regarding Splunk Enterprise Platform's AI capabilities generally, it is strong from a search assist capability, but beyond that, we have limited use of AI within Splunk Enterprise Platform. Other improvements needed for Splunk Enterprise Platform include automated management of UF agents and automatic upgrading, which would be very helpful.

I think Splunk Enterprise Platform could be improved with a slight change to the user interface. Minimizing the number of tabs, similar to what was done with Enterprise Security, would be helpful. Regarding needed improvements, integrations are a great idea as I cannot find easy guides on how to integrate some technology. It would be better if you had one area where I could find comprehensive information about integrations.

It is not a question for me how Splunk Enterprise Platform can be improved, as I am a salesman. From my point of view, it is perfect. I do not want to change the prices because this is a truly valuable product.

I think Splunk Enterprise Platform can be improved with easier dashboards since dashboard building is incredibly complex. I rate it a seven because there is a pretty steep learning curve, especially once you get into actually having to craft SPL queries.

Splunk Enterprise Platform can be improved by addressing bugs and upgrades, as every time there is an upgrade, there is a bug that needs fixing.

I suggest removing the KV store and replacing it with MongoDB to improve Splunk Enterprise Platform. I am uncertain about Splunk Enterprise Platform's governance and security, but we maintain strict policies on how to use AI, requiring limitations in certain ways.

I see room for improvement with Splunk Enterprise Platform, particularly concerning costs, as many customers are considering switching to other SIEM platforms because the costs for the data are sometimes too high. I would like to see improvements in user-friendliness, as depending on what needs to be done, Splunk Enterprise Platform requires relatively good knowledge of the product. For innovations and new features, I would like to see a more concrete best-practice architecture or an updated best-practice architecture, similar to the Splunk Validated Architectures, as this would be quite helpful to find my way through the jungle of new things.

I am very satisfied with Splunk Enterprise Platform because it is helping me get what my use cases are. I am able to find everything I need for right now, but there is always room for improvement. If I could change or add one thing to make Splunk Enterprise Platform even better for me, it would be the DB Connect app. There is a function of the DB Connect app that needs improving—if you are collecting logs and the logs do not have anything that you can use as a rising column to tell the system to continue from where you left off, you have to bring in your logs in a batch, which can lead to duplicates. I think if there is a way to help with that, it would be very helpful because it will be eating your licenses and that is not what you want.

Splunk Enterprise Platform can be improved by providing better tooling for transforming data easily between ingestion and storage. The ingest and edge processor features are nice to have, but they seem to be a case of Splunk leaning into their weaknesses instead of leaning into their strength of ingesting, storing, and querying data. I think perhaps Splunk should reset their data transformation technology considerably to make the end-to-end visibility better for customers and less convoluted using conf files in Splunkd and Otel in the edge and ingest processors.

I would prefer to have real-time reporting as opposed to just schedule-based jobs with Splunk Enterprise Platform. The user interface for search results is slower than it should be, and we would appreciate higher performance. These are the top two needed improvements for Splunk Enterprise Platform.

I do not have enough experience with Splunk Enterprise Platform to make improvements, as I am still learning. I have not found anything that has been challenging for me as a new user, as I am able to figure things out.

Resource consumption could be streamlined further. Although the integration with S3 makes it a little cheaper and more reasonable to store large volumes of data, it still does not address the issue of keeping data in warm and hot buckets. Keeping a significant amount of data in warm and hot buckets does not work well with S3, as data stored there is typically in cold buckets. Whenever that data needs to be retrieved, it must be thawed before it can be used. It would be improved if we were able to retain higher volumes of data in hot and warm buckets to be readily available to analysts, which would help tremendously. Storage cost is one of the huge issues for us. With the emergence of AI and its prevalence now, Splunk is moving in the right direction with integrating AI. However, currently, that is mostly tied into the cloud environment. If there could be more on-premises offerings and AI solutions geared to customers that are in isolated environments where they want their data and all their systems to be on-premises and not tied into the cloud, that is somewhere Splunk can make some improvements to serve those customers.

I don't have anything I would say needs improvement. I believe it will have the standard improvements that any technology will have as it grows and as global technology improves, but nothing specific that Splunk Enterprise Platform itself needs to improve on. If I had to think of one thing, it would be around the learning curve; I'm not very familiar with SPL2, and that might address this problem. However, having an easier way to translate from regular language to SPL could be an improvement, which may be facilitated by emerging AI technologies. If not, that's something that could be enhanced.

Dashboard could have feature parity with common XML dashboards.

It would be a lot more beneficial to have greater visibility into things that run, such as Splunk Universal Forwarder, because it is very hard to manage, and there are a lot of features that are missing that are available in some of the competitors. Being able to parse the data at the source rather than having to send it into Splunk Enterprise Platform would be nice, and being able to deep dive into different agents without having to wait for the logs to come in would be a great improvement.

I believe I am too new to provide feedback about how Splunk Enterprise Platform can be improved, but so far, what I see looks very good. We have had some frustrations with the amount of data we are sending to Splunk Enterprise Platform, as sometimes it contains information that is not needed, but that is more about my team needing to understand how to parse through that data before it gets sent to Splunk. What we need more is additional training.

The potential for improvement in Splunk Enterprise Platform could include the addition of AI. Our network is air-gapped, so the ability to implement AI in an air-gapped network would be very important to us. One of the initiatives that we are undertaking in the government is to win the AI race and in order to do that, we need AI to assist us in building out our infrastructure so we can fight AI with AI and be better. However, AI usually needs some type of active connection to the open internet, which in our case is not possible. A self-contained AI platform that we can update weekly, which would not be an issue, would be beneficial to us specifically.

One way Splunk Enterprise Platform can be improved is that cost is always going to be a problem. I think another thing is some of the apps that are made into premium apps requiring subscriptions could be made free just to be less cost-prohibitive. Regarding the needed improvements, I feel that the UI in some of the newer versions of Splunk Enterprise Platform is not well received. We do not like it very much; there have been changes made that are unwanted changes, making it harder to find things and slowing down the usability of the product.

Splunk Enterprise Platform can improve in defense capabilities by blocking suspicious and malicious activities or preventing attacks.

A lot has room for improvement; Dashboard Studio needs significant enhancement. Their SPL, when I am running Agentic workloads, is not well suited to Agentic AI at all, especially when I have Agentic AI agents that are writing their own SPL. The MCD server could really do with a lot of improvement. The bottom line is that going into the Agentic era, and this is across any data platform, no data platform at this moment in time is built to handle the Agentic AI era. With Splunk Enterprise Platform specifically, I hit a real hard wall at about 300,000 searches an hour, and I could not get above that. That is a real bottleneck. When I am running Agentic swarms doing investigations, incident response, and other things and querying in code, SPL at its very core is not designed for agents. It is a human language. The volume of searches, even when I am running tens of indexes, does not scale horizontally as I thought it would. Adding more compute does not solve this issue at the volume of searches I am running now. It is fine for humans.

I would like to see more flexible licensing, easier deployment and administration, enhanced AI-driven automation, and more built-in dashboards and detection content in Splunk Enterprise Platform. I chose nine out of ten for my rating because of the licensing cost and complexity of deployment and administration.

With respect to the use cases, we were able to create many use cases as well as fine-tune them, so thirty percent of the alerts were fine-tuned, and we have improved our detection logic and also the outcomes. In specific to the metrics, our detection rate was high. The mean time to detect was incredibly lower than when compared to the previous SIEM. With respect to Splunk Enterprise Platform, we can have a bunch of use cases though we already have a database where we get a list of use cases. Given the trend, we can improve them. Just with threat intelligence, if Splunk Enterprise Platform gets a new feature such as IOCs integration directly, that would be very helpful, just as the Falcon threat intelligence. It would be helpful if we get Splunk threat intelligence as well.

One area that has room for improvement is the log onboarding problem with all the AI aspects, which has not yet been solved.

Regarding the downsides of Splunk Enterprise Platform, as I mentioned, one is the Search Processing Language is somewhat complex when it comes to complex filtering and searching. You need to become familiar with it to make complex searches. That is one thing. There is not a no-code option for panels. You have to write an entire query for it. It would be better if they could introduce more drag-and-drop options so that people can add more features to their panels and pie charts and visualize the data they want.

One area where Splunk Enterprise Platform can be improved is that the underlying search architecture is not up to the mark compared to something Elastic. This could be improved. I wish Splunk Enterprise Platform could do more towards AI and use AI to help in SOC automation. Regarding Splunk Enterprise Platform's AI capabilities, I think its governance and security are pretty good, but not up to the mark. Regarding Splunk Enterprise Platform's AI capabilities, I feel that its accuracy and reliability of output are still in the nascent stages, although it is pretty good.

A major factor I dislike about Splunk Enterprise Platform is the cost. Since the cost is based on data ingestion or the volume of data, large logs or large volumes of logs sometimes increase the ROI and overall cost of the product for us. This direct relationship between cost and data ingestion volume is an area I dislike and where there is room for improvement. On a scale from one to ten, I would rate Splunk Enterprise Platform overall 8.5 out of 10. The area where it can be improved is mainly the cost. Otherwise, the features and quality of the platform are very good. Splunk Cloud and Splunk Enterprise help reduce MTTR, Mean Time to Resolution, since incident management is faster. Additionally, the visualization and observability of the entire organization infrastructure and application performance are consolidated in one place, as data is collected in a central location. Overall, the features and aspects of Splunk Enterprise Platform are commendable, but the cost aspect could be improved.

One thing I dislike is definitely the licensing cost, especially when our ingestion volume increases, so it is a bit costly. The second thing is that SPL query performance can slow down if searches are not optimized properly, so if searches are not optimized, then query performance is slower.

The cost is definitely an area for improvement. The cost increases significantly as data volume grows. We ingest terabytes of data, so I can say Splunk Enterprise Platform is somewhat costly. Poorly written queries can impact our performance, so there should be suggestions provided to write queries in SPL. As Splunk partners, as our data volume grows, our cost also increases significantly. From a pricing perspective, Splunk Enterprise Platform is somewhat costly for us.

The number one area for improvement is cost; it is not cost-efficient for small organizations. Better cost management should be the first priority. Performance optimization is also important. Large queries or poorly optimized searches can sometimes slow down our results. Better recommendations or automation for query tuning would help us. It would be better if this is added in the near future versions.

When concerning the cost of Splunk Enterprise Platform, the license cost can be a factor. The pricing is based on limited factors. There are two types of pricing where we have licensing based on the data or logs which we are indexing by size. It can also be based on if we are purchasing the cloud platform, then it can be based on multiple factors such as how much data we are searching daily or a limit on that. Usually for 10 GB of license and two years of retention, it costs around $20,000 to $30,000. Based on my thoughts about Splunk Enterprise Platform, I would rate it a seven or eight because the only thing I'm keeping in mind is the licensing cost. Otherwise, the overall product is good, its features, its customizability, and scalability are all excellent. The only factor is the licensing. If they were providing a license to small customers, if they target small customers, it would be really great. If they provide a small license to small customers, or if they bring some new licensing for small customers for the specific use case on top of Splunk Enterprise Platform, that would be beneficial.

I think the machine learning toolkit is fine, but when I talk about threat intelligence, it is not that effective. Since recently, I think Splunk Enterprise Platform has acquired Cisco, which has acquired VirusTotal if I am not wrong. I think VirusTotal. Initially, what used to happen was that the threat intelligence source I used for Splunk Enterprise Platform was not regularly updated. I faced challenges there, and then finally, when I went ahead and researched, I found that VirusTotal is readily available to be used in Splunk Enterprise Platform. So I integrated it, and as of now, I am making better use of it. The effectiveness of Splunk Enterprise Platform in detecting anomalies and preventing system outages completely depends upon the correlation rule, but when it comes to threat intelligence, I have not explored much of the source side. I am mostly on the SIEM side. Though I have some features that I have integrated, I am mainly working on the SIEM side rather than the source side. The application management feature, which I believe refers to the interface, is not that attractive, I would say. It is a simplified version, and I am using the cloud platform of Splunk Enterprise Platform instance. It is simple, but it is okay. It is manageable. I definitely find it problematic, and I think they could need to have more nuances and more features when it comes to the interface. It should be more extended. From my perspective, Splunk Enterprise Platform can be improved by first making the GUI, the interface, more attractive. The second improvement should try to include all the threat intelligence into that platform, integrating all threat intelligence. The behavior monitoring is a bit of a concern because I do not see much detection. Maybe that is because I am using only the correlation ID, but still, the behavior monitoring should automatically detect. Even if it is a SIEM solution, if I create some rule, that is what I have customized it for. I am not sure if SOAR has that capability, but in case SOAR does have that capability, if not, then they have to improve their machine learning and behavior analytics. I have been in touch with different technicians from different organizations, and they have mentioned these challenges. There are a few drawbacks when it comes to Splunk Enterprise Platform. I find the price a bit high, I would say. A bit high.

For a potential area of improvement in Splunk Enterprise Platform, I can say to try to make it easy for the user and user-friendly. Simplifying the UI would help, because not everybody has it in their knowledge. If you want to sell your product, you will go with the company CIO, Chief Information Technology Officer. I do not think he will be working on that project; he will be working on your tool. Their resources, their employees will be working on Splunk Enterprise Platform. If you will show them the UI where they can understand, even if they do not know about any coding, they can just play, drop, and drag. If you satisfy them, then anyone will work on their tool in their company. I just want to give you the business perspective, because if you talk to any CIO, they are looking first at the UI part. They will not look into the coding part; they will just check the UI. If the UI is user-friendly, it will attract every person. There is very much improvement needed from Splunk vendor support side because they need to check what people are raising in the requests. They do not understand the concerns people are raising. I do not think Splunk is working on their application support, I believe they hire third-party people who do not know as much about Splunk Enterprise Platform. Regarding deep knowledge of the product, I am talking about the technical aspects. If anyone says something is not working, it seems many cases I have raised where they do not reply to my request adequately. That is why I say there is a requirement for improvement.

From what I have noticed across all SIEM platforms, they are beginning to incorporate AI capabilities, which is an aspect that I think Splunk could enhance. Microsoft Sentinel, for example, features a Security Copilot, but it requires an additional license for use. Other platforms such as Google SecOps and Palo Alto's Cortex XSIAM integrate agentic AI capabilities that I believe will become standard features for all SIEM solutions in the future. For generative AI, it would be beneficial for Splunk to add features allowing users to define queries using prompts. For example, being able to ask for the top 10 malicious IPs could simplify tasks significantly. Additionally, Splunk could consider an AI response feature where triggered alerts can prompt recommendations for users on corrective actions. A noise cancellation AI might also help security analysts reduce alert clutter. There are many agentic AI improvements that can be made in Splunk Enterprise Platform.

The cost is the most significant area for improvement in Splunk Enterprise Platform, as it is quite expensive, causing many clients to differ due to this reason. Otherwise, I don't see that Splunk Enterprise Platform requires further improvement because it is the number one tool. The cost remains a significant point of concern.

For future updates of Splunk Enterprise Platform, I would like to see integration by GUI. The integration should be improved with the UI.

The only problem I have with Splunk Enterprise Platform is that sometimes when I update a review, it takes time to receive confirmation emails. This happens very rarely, maybe once or twice a month. I feel this can be improved in terms of performance.

Splunk could improve by enhancing its graphical view functionality. Compared to other BI tools, Splunk's graphic features are limited; part of customers desire detailed, rich visual effects, like world maps showing threat attacks as animations. Additionally, the deep learning capabilities need enhancing, especially on Splunk Cloud, where customers find it challenging to use deep learning tools without setting up backend computing resources.

While Splunk Enterprise Platform is a good product, it is expensive. Additionally, it is complex for inexperienced cybersecurity engineers and requires experienced personnel to handle it effectively.

Pricing is an area that needs improvement, as it is considered high. Additionally, the addition of AI capabilities would be beneficial for analyzing IP activity patterns and providing alerts. During the integration with Docker, we noticed that Splunk only shows container IDs and not their names, which is a drawback.

If I compare Splunk Enterprise Platform with the other tools, the dashboard and the user interface need to be built at a console level and in a user-friendly mode. Sometimes, the tool looks a bit complex, and we can't find out the exact area where we need to make the changes in the configuration and changes for the log events monitoring. The dashboard and the console-level areas need to be made friendly. The product's initial setup phase needs to be made easy since it looks like it is very complex compared to the other tools in the market.

Splunk Enterprise Platform could improve in the area of basic log readability. When performing basic searches without advanced filters, the logs often contain timestamps and various unknown codes or other elements that can be confusing. Removing or simplifying these parts would make it easier for users who are not developers or do not have a development background to understand and find relevant information easily. If I could add a feature to the Splunk Enterprise Platform to make my life easier, I'd like to add an internal automation tool. We can use third-party automation tools like Power Automate, but it would be better if Splunk Enterprise Platform had its built-in tool. This tool could automate reports and make sending emails with Excel attachments or other formats to specific people easier. We're currently using third-party tools for this, but having it as a first-party feature would be better.

The Splunk Enterprise Platform has room for improvement, particularly in automating the permissions process during app promotions. Currently, permissions are manually set when different teams request an application move to production, which is time-consuming. Automating this process would streamline operations by automatically assigning the appropriate permissions and roles to specific services or teams, reducing the need to review each request ticket manually.

The solution could enhance automation capabilities. Currently, the process involves daily manual checks for potential issues, maintenance tasks, and planning for automation. Rather than relying solely on daily activities, there's a need to implement automation solutions for streamlined operations. The main issue with the Splunk Enterprise Platform is its licensing cost, which can be high for small companies. Many businesses are migrating from Splunk to alternative tools. If Splunk were to lower its licensing fees or offer discounts, it would likely retain more customers.

Splunk Enterprise Platform needs some improvement. For instance, the dashboard sizing and customization options could be enhanced. There seems to be a limitation in adjusting the size of individual panels within a dashboard. This can be frustrating when comparing data across different panels, as users are forced to scroll continuously. Additionally, while Splunk offers some new features like student dashboards, modifying these dashboards requires a level of JavaScript expertise that not all users possess. Providing more user-friendly options for customization, such as adjusting colors and fonts directly from the user interface, could greatly improve the user experience. Moreover, for users transitioning from other monitoring tools like Dynatrace, the interface may feel less intuitive and more cumbersome. Offering more intuitive visualization options and simplifying the customization process could bridge this gap and make Splunk more accessible to a wider range of users.

In Splunk Enterprise Platform, while the dashboard feature is powerful, it does have limitations in terms of the number of parameters that can be included in one dashboard. However, it's important to note that these limitations can be addressed through effective dashboard design and optimization techniques. Despite these constraints, Splunk offers extensive capabilities for creating insightful dashboards that can visualize relevant data effectively. Splunk excels in providing accurate and valuable alerts and reports. These features are crucial in reducing manual efforts, minimizing human errors, and expediting incident resolution processes. With Splunk's alerting and reporting functionalities, users can fine-tune alerts, apply filters, and include necessary information for thorough investigation and analysis. These capabilities contribute significantly to enhancing operational efficiency and decision-making within organizations.

Sometimes, queries don't give proper results, and the indexes go down.

There is room for improvement in introducing more AI capabilities onto Splunk Enterprise Platform. While they might exist in other platforms like ITSI, enhancing the Enterprise Platform with AI features would benefit many users who predominantly use it.

The tool lacked in providing a shareable format. I had to use pivot tables and manually parse and edit the data to create a visualization-friendly format. It was helpful when we had an issue. What would make it stronger is if it were more proactive. For example, if it highlighted major incidents and their impact on users without digging through notifications, that would be better. Typically, the first question we get is, "Oh, we had an incident. How bad was it? How many customers were impacted?" So having that information pop up from the notification would be helpful.

The product doesn’t have prebuilt dashboards. It would be great if the product provided prebuilt dashboards. For example, we allowed some devices into our network through VPN, but there is no dashboard to combine two log sources and understand which user has logged in. So, we created our own dashboard with the available Splunk searches. It’d be good if the solution provided more prebuilt dashboards and released them on the app platform. Then, we can deploy the dashboards straight away. Also, if the tool provides additional dashboards, we can reduce the resources needed to develop them. Since Splunk has overall visibility all around the globe, it can give better suggestions on the dashboards that we must use and how to project the data to the management. We faced some issues in parsing when the load was too much. If we have a 100 MB log source, 80 MB will be parsed correctly, but we face issues with 20 MB. We raised a support ticket, and the support team suggested we increase the time interval between sending the logs to the Splunk forwarder to handle the processing correctly.

The solution has certain shortcomings when it comes to APIs, making it in an area where improvements are required. Integration is an area that can be considered as one of the challenges we face with the solution in our company. From an improvement perspective, the solution should make the integration of the product with other tools in the market possible.

There should be continuous customer engagement and training programs on the new features and capabilities introduced by the solution.

Splunk Enterprise Platform is already a refined product, so I don't have any recommendations related to areas that need improvement. The cost of Splunk Enterprise Platform is an area of concern where improvements can be made by bringing down the costs. Product-related, I don't have any feedback. The support offered by Splunk Enterprise Platform has certain shortcomings that need improvement.

We have an enterprise system that we can only use up to 70% capacity. We have no Internet access. To ensure our system runs optimally, we must configure specific rules, such as RAM, CPU, and space utilization alerts. Also, it is tough for us to reach out to Splunk. We have another software called Nessus, which can be used for vulnerability scans to improve and expand our vulnerability management capabilities. We can add a vulnerability management tool and back network traffic monitoring. This would allow us to add everything into a single platform since we currently use multiple applications for eight solutions.

Things have to be managed manually in Splunk Enterprise, which is not the case in Splunk Cloud, where the client could manage it on their own. It would be useful if Splunk Enterprise Platform could monitor the application URL, to check whether it's responsive or not.