ScienceLogic SL1 vs. Splunk Enterprise

Appropriate if you are setting up a monitoring suite in new Infrastructure Environment. Definitely NOT suited for Migration Projects. ScienceLogic SL1 cannot cater to a lot of monitoring requirements which already would have been configured in old monitoring suite. Plus, limited support for customizations and having to go to "Feature Requests" route makes in extremely complicated.

Incentivized

Pros: Splunk is very well suited if you have multiple log sources of related data. All of them can be correlated and tasks can be automated based on the requirement. Other than alerts, Splunk can also run a specific script of your choice, based on some defined conditions. Cons: If you have a few logs but a large number of log sources, Splunk can be very expensive.

Incentivized

• Best overall coverage of montioring different technologies.
• Easy to use in any environment
• Customizable being able to generate your own reports, dashboards, DA's, RBA's, etc.
• Have very good out of the box integrations with other monitoring solutions such as ServiceNow
• Always improving and regularly releasing new versions and upgrades to the system/DA's.
• Interactive community

Incentivized

• Real-time + Scheduled alerts - i-e you can set up alerts which are actively monitoring your logs
• Pretty good response time for search results. With our key/value logging, Splunk makes it blazing fast to query the data.
• Dashboards provide insights into historical data
• Love how Splunk indexes all of the data and provides keys to search on

Incentivized

• Creating powerpacks from scratch for new devices may be straightforward but will rarely be easy. Rewarding when completed, but not easy.
• Developer documentation needs a rethink. While the information may be there (it isn't always) it is not easy to find. This is not helped by using different terms for the same things.
• A developer console/dashboard for monitoring data collection from powerpacks instances without having to switch webpages or have to monitor multiple webpages.

Incentivized

• Even though there is a search tool as a help function, you still have to read through many documentation to find the answers you're looking for and sometimes you don't find it. The help function in Splunk could be improved to be more intuitive or have a built-in help per report, panel or dashboard.
• Creating a Splunk dashboard is rather straightforward however, customization is not. Splunk could be improved to provide more tools or features for customization such as adding colors and font options for text and graphs or graphics.
• My dashboard has a lot of useful information and I want the important panels and reports at the top but there is no easy way to do this. Perhaps Splunk could be improved to allow features such as adding URL links to other dashboards or some other clever way to emphasize the important data in my dashboard without compromising space.

Incentivized

We migrated away from our 20-year-old homegrown solution and have no back-tracking capability. ScienceLogic is demonstrating new capabilities that we would not have been able to do on our own using our legacy system.
We understand the capabilities of competitors based on our bake-off selection where ScienceLogic won on capabilities and future near-term potential (expandability, platform growth). We know that those competitors are not really close to where we have been able to push ScienceLogic (as a partner).

Incentivized

We are using Splunk extensively in our projects and we have recently upgraded to Splunk version 6.0 which is quite efficient and giving expected results. We keep track of updates and new features Splunk introduces periodically and try to introduce those features in our day to day activities for improvement in our reporting system and other tasks.

We use ScienceLogic SL1 in our organization to serve effective monitoring solutions to our external customers. Our customers depend upon us for critical events/alerts related to their IT infrastructure gears and using SL1, we're able to provide them with a proactive monitoring solution that resolves an issue before an impact is noticed by the customer. There are very few monitoring solutions that can cater to a variety of Cloud platforms like Public Cloud (AWS, Azure) and private cloud simultaneously and SL1 addresses this business problem very well

Incentivized

Splunk Enterprise has plenty of storage space for security logs and can search and correlate suspicious activities up to 30+ days back. Splunk Enterprise can integrate with a ticketing system to track threats and correlate with IoC between security events. Splunk Enterprise can provide reports of account lockouts. Splunk Enterprise can consolidate multiple security alerts into one entry with a number showing how many events occurred.

Incentivized

Science Logic SL1 provides the option of Distributed deployment where multiple instances of each appliance can be deployed to manage the load and availability. SL1 provides a High Availability feature for Database Servers and Data Collection. If one of the Data Collectors in the collector group fails, it will automatically redistribute the devices from the failed Data Collector among the other Data Collectors in the Collector Group. The high availability feature for the Database server ensures that SL1 performs failover automatically to another server without causing the outage to the application.

Incentivized

When properly setup and configured, Splunk is extremely reliable.

Incentivized

The performance is entirely dependent on the complexity of the environment/network being used to host the platform. Outside of those factors, the platform runs very efficiently and quickly out of the box. We have integrations with other platforms and neither seem to take a hit from our moderate API usage. Any issues with performance would be experienced by choices made in infrastructure or complexity of things built by the customer to display in the GUI (overly complicated and cluttered dashboards for example)

Incentivized

So far, it's good as part of my overall experience, except for a couple of use cases. The support team is well knowledgeable, has technical sound, and is efficient. When support escalates to engineering, the issue gets stuck and takes months to resolve.

Incentivized

Splunk maintains a well resourced support system that has been consistent since we purchased the product. They help out in a timely manner and provide expert level information as needed. We typically open cases online and communicate when possible via e-mail and are able to resolve most issues with that method.

Incentivized

When I joined our company, I did not know about the in person training at firts. Logging onto the SL University, I realised that there were different sessions being held at different times throughout the year. The training itself was good, but being in a different time zone, made it difficult to attend, but the sessions that I attended was great!

Incentivized

There are a lot of educational materials and courses on the SL1 training site (Litmos university). However the recording quality is sometimes not very good - screen resolution is low. There is a lack of professional rather than user-oriented documents and there are mistakes in documentation and education is not well structured.

Incentivized

The online course was simple clear and described the main capabilities of the solution. There is also an initial module that can be done for free so anyone can familiarize themselves with the functionality of this solution. On the other hand, however, there could be more free online courses. Maybe even with a certificate, this would broaden the group of people who are familiar with the platform while increasing familiarity with the solution itself.

Along with the purchase of the solution, we purchased a statement of work with their Professional Services organization to meet our outcomes and fill our critical gaps. The PS team was outstanding, very professional and allowed us to screen share while they built our integrations. In many cases they would teach us how they did certain things within the platform.

Incentivized

Smooth without too many major issues.

Incentivized

We evaluated a couple of other competitive products in the IT infrastructure observability domain; however, we found that ScienceLogic has a slight edge over the others for us. We encountered a cost barrier, as managing too many customers with an MSP setup was a costly affair, and several solutions did not offer an MSP solution at that time.

Incentivized

A lot of products have natively inside their own dashboards and or their own logging repositories. And each one is difficult to learn or they're too complex or they're not verbose in the sense that they're not easy to mine the data that you're looking for. So that could be anything from the native logging that you find in other Cisco products. It's easier to use Splunk to draw the data that you're looking for as opposed to going to the individual's products themselves to get the logs that you're looking for.

Incentivized

Our deployment model is vastly different from product expectations. Our global / internal monitoring foot print is 8 production stacks in dual data centers with 50% collection capacity allocated to each data center with minimal numbers of collection groups. General Collection is our default collection group. Special Collection is for monitoring our ASA and other hardware that cannot be polled by a large number of IP addresses, so this collection group is usually 2 collectors). Because most of our stacks are in different physical data centers, we cannot use the provided HA solution. We have to use the DR solution (DRBD + CNAMEs). We routinely test power in our data centers (yearly). Because we have to use DR, we have a hand-touch to flip nodes and change the DNS CNAME half of the times when there is an outage (by design). When the outage is planned, we do this ahead of the outage so that we don't care that the Secondary has dropped away from the Primary. Hopefully, we'll be able to find a way to meet our constraints and improve our resiliency and reduce our hand-touch in future releases. For now, this works for us and our complexity. (I hear that the HA option is sweet. I just can't consume that.)

Incentivized

Splunk can scale in to the petabyte per day range which of course is awesome

• Identified Major Incidents at least 50% of times when it happens
• Prevented Major Incidents due to alerting for basic IT Infra level issues at least more than 60% scenarios
• Provides ability to monitor large variety of IT Infra level devices and services

• Splunk has allowed developers to diagnose production issues when access of control was taken away from them to be allowed to view items in production environments and I believe that is invaluable.
• At times some developers weren't super happy about using it, but it was more of the fact that they were used to having production access and not creating their splunk queries to get information.
• Going one place to view logs was very beneficial to have.

Incentivized