Still the most capable, still the most expensive
3.2/5overall, average of the five axes
Deployment effort3
Support quality4
Features vs promises5
Pricing transparency1
Return on investment3
What happened
Nothing else we tested handles our data volume and query complexity the way Splunk does, and the app ecosystem means most sources are solved problems. The cost is the entire conversation every renewal. We moved some archival ingest elsewhere and kept Splunk for the searches that earn it, which is the compromise most teams I know have landed on.
Worked well
Query power and speed at volume. App ecosystem. Very mature.
Did not
Cost dominates every architectural decision. You will engineer around the licence. Requires skilled staff to get the value.
9 found this helpful