Amazon CloudWatch vs. Splunk IT Service Intelligence (ITSI)

If you use any AWS services, CloudWatch is the natural choice to monitor & troubleshoot your workload. Thankfully, for most AWS services, CloudWatch is either built-in or very easy to set up. However, being proficient in browsing & tracking the log events would take some training & practice. Having some experienced people on the team would help immensely, especially in spreading the skill to the rest of the team.

Incentivized

[Splunk IT Service Intelligence (ITSI)] is well suited when you have a system that you want to visualize, and then layer in information from many different sources. This will allows ITSI to intelligently create alerts based on the system as a whole vs the individual components. In some cases, a simple splunk dashboard would really suffice over using ITSI. Teams deploying ITSI should really understand the use cases and consider using simple dashboards where they make sense, and use ITSI for topological views.

Incentivized

• It provides lot many out of the box dashboard to observe the health and usage of your cloud deployments. Few examples are CPU usage, Disk read/write, Network in/out etc.
• It is possible to stream CloudWatch log data to Amazon Elasticsearch to process them almost real time.
• If you have setup your code pipeline and wants to see the status, CloudWatch really helps. It can trigger lambda function when certain cloudWatch event happens and lambda can store the data to S3 or Athena which Quicksight can represent.

Incentivized

• Monitor hundreds of IT services by continuously tracking thousands of KPIs in a scalable way.
• Quickly identify problem areas by a combination of default visualizations and ability to create custom dashboards.
• Extremely configurable to effectively monitor nearly any KPI imaginable from Splunk.

Incentivized

• Memory metrics on EC2 are not available on CloudWatch. Depending on workloads if we need visibility on memory metrics we use Solarwinds Orion with the agent installed. For scalable workloads, this involves customization of images being used.
• Visualization out of the box. But this can easily be addressed with other solutions such as Grafana.
• By design, this is only used for AWS workloads so depending on your environment cannot be used as an all in one solution for your monitoring.

Incentivized

• The terminology takes some getting used to: Aggregation policies, notable events, correlation searches, glass tables. If you're not familiar with ITSI, these terms can be a bit overwhelming and steepens the learning curve.
• We have had some technical issues with the underlying support when used in a multisite cluster. We've had to build in several points of redundancy to make sure it works as expected.
• I'd like to see additional types of notable events, like informational events that come in for when an incident is created or when an alert is acknowledged so all of those action steps can be viewed on the episode timeline without affecting the count of events.

Incentivized

We have replaced our monitoring platform with Splunk & ITSI, and with the success, it's seen at our organization thus far we would be hard-pressed to pivot to another tool. Frankly, our business partners and application teams love Splunk & ITSI.

Although the tool itself is easy to integrate and is readily available for use, it has its limitations. The key limitations of cloudwatch are with respect to cost incurred on log retention and log querying. While for key use cases this is sufficient, for more advanced use cases, Amazon CloudWatch doesn't work out. Also, obviously it is tightly coupled with AWS, which makes you look away if you need a single tool for all monitoring

Incentivized

Splunk IT Service Intelligence (ITSI) is a platform with extended functionality and provides various functionalities which can be utilized to improve the efficiency and accuracy in analyzing the data and detecting the attacks.

Support is effective, and we were able to get any problems that we couldn't get solved through community discussion forums solved for us by the AWS support team. For example, we were assisted in one instance where we were not sure about the best metrics to use in order to optimize an auto-scaling group on EC2. The support team was able to look at our metrics and give a useful recommendation on which metrics to use.

Incentivized

During POC, pre-planning, and implementation, we have had interactions with numerous folks at Splunk. Everyone from sales & engineering to markets analysts to specific IT component SMEs, and a small professional services engagement to get started. They have all been exceptionally helpful and go above and beyond the call of duty. They actively reach out to ensure success is being realized and find ways to help proactively, instead of having to simply open support cases with the vendor.

We use Cloudwatch for simpler monitoring, but these metrics and logs often feed into bigger ecosystems across our organization. The metrics and logs in Cloudwatch allow our developers quick and easy access to the data they need whilst easily integrating the same data into more prominent platforms for wider analysis, including Service desk support, SecOps, and ITOps monitoring within the organization.

Incentivized

Splunk has raised itself as a platform not just as a tool unlike other products in the market. If I talk about Moogsoft it also has similar capabilities but Splunk ITSI has more visibility and its GUI is making a different impact on the users. ServiceNow and Splunk are equally capable products however Splunk seems to have more tech-savvy people tools than ServiceNow.

Incentivized

• Positive for alarms and alert notifications once configured/customized.
• Has upfront learning curve, and cost can increase as does the alarm activity and monitoring details you may require.
• Cost-effective for any size organization keeping with AWS and utilizing its native tools is a savings in long-term ROI.

Incentivized

• Splunk IT Service Intelligence (ITSI) has improved our efficiency and accuracy in detecting the attacks and mitigating them.
• It helped us in discovering various kinds of logins within our organization, such as failed logins, interactive logins, admin logins etc etc
• With the help of Splunk IT Service Intelligence (ITSI) we can now keep an eye on real time data as well.