Need advice about which tool to choose?Ask the StackShare community!

Splunk

596
992
+ 1
20
Splunk Cloud

165
434
+ 1
15
Add tool

Splunk vs Splunk Cloud: What are the differences?

Differences between Splunk and Splunk Cloud

Splunk is a powerful software platform that provides real-time operational intelligence and log management solutions. On the other hand, Splunk Cloud is a cloud-based version of Splunk, providing the same functionality as Splunk but with the added benefit of being hosted on the cloud.

  1. Installation and Infrastructure: Splunk requires a dedicated server infrastructure for installation and maintenance, whereas with Splunk Cloud, the infrastructure and maintenance are taken care of by Splunk as it is hosted on the cloud. This relieves the users from the burden of managing the server infrastructure themselves.

  2. Scalability and Elasticity: Splunk's scalability depends on the server infrastructure it is installed on, and scaling up or down can be a complex process. On the other hand, Splunk Cloud offers easier scalability and elasticity, as it is hosted on the cloud. Users can quickly increase or decrease resources as needed to accommodate changes in data volume or workload.

  3. Upgrades and Maintenance: Splunk users are responsible for managing upgrades and maintaining their installations, which requires planning and effort to ensure minimal downtime. In contrast, with Splunk Cloud, upgrades and maintenance are handled by Splunk, providing users with a hassle-free experience as updates and patches are automatically applied without disrupting service.

  4. Data Security and Compliance: Splunk offers various security features, but the responsibility for securing the infrastructure and data rests with the users themselves. On the other hand, Splunk Cloud incorporates additional security measures to protect data stored in the cloud, relieving users of some security responsibilities. Splunk Cloud also provides options for compliance with industry-specific regulations.

  5. Cost and Pricing Model: Splunk has a perpetual license model, where users pay for the software and infrastructure upfront. In contrast, Splunk Cloud follows a subscription-based pricing model, with users paying on a monthly or annual basis. Splunk Cloud provides flexibility in terms of scalability and cost, allowing users to adjust resources and costs based on their needs.

  6. Deployment and Time-to-Value: Splunk's deployment can be time-consuming, involving infrastructure setup, configuration, and optimization. Splunk Cloud offers a faster time-to-value as it eliminates the need for infrastructure setup and allows users to start analyzing data and gaining insights almost immediately after signing up.

In summary, the key differences between Splunk and Splunk Cloud lie in the aspects of installation and infrastructure, scalability and elasticity, upgrades and maintenance, data security and compliance, cost and pricing model, and deployment time-to-value. Splunk Cloud, being a cloud-based solution, provides easier scalability, automatic upgrades, enhanced data security, flexible pricing, and faster deployment, making it a convenient option for organizations seeking a hassle-free way to harness the power of Splunk.

Advice on Splunk and Splunk Cloud
Jigar Shah
Security Software Engineer at Pinterest · | 8 upvotes · 141.4K views

We would like to detect unusual config changes that can potentially cause production outage.

Such as, SecurityGroup new allow/deny rule, AuthZ policy change, Secret key/certificate rotation, IP subnet add/drop. The problem is the source of all of these activities is different, i.e., AWS IAM, Amazon EC2, internal prod services, envoy sidecar, etc.

Which of the technology would be best suitable to detect only IMP events (not all activity) from various sources all workload running on AWS and also Splunk Cloud?

See more
Replies (5)
Nati Abebe
Recommends
on
AWS ConfigAWS Config

For continuous monitoring and detecting unusual configuration changes, I would suggest you look into AWS Config.

AWS Config enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. Here is a list of supported AWS resources types and resource relationships with AWS Config https://docs.aws.amazon.com/config/latest/developerguide/resource-config-reference.html

Also as of Nov, 2019 - AWS Config launches support for third-party resources. You can now publish the configuration of third-party resources, such as GitHub repositories, Microsoft Active Directory resources, or any on-premises server into AWS Config using the new API. Here is more detail: https://docs.aws.amazon.com/config/latest/developerguide/customresources.html

If you have multiple AWS Account in your organization and want to detect changes there: https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data.html

Lastly, if you already use Splunk Cloud in your enterprise and are looking for a consolidated view then, AWS Config is supported by Splunk Cloud as per their documentation too. https://aws.amazon.com/marketplace/pp/Splunk-Inc-Splunk-Cloud/B06XK299KV https://aws.amazon.com/marketplace/pp/Splunk-Inc-Splunk-Cloud/B06XK299KV

See more
Isaac Povey
Casual Software Engineer at Skedulo · | 6 upvotes · 68K views
Recommends
on
TerraformTerraform

While it won't detect events as they happen a good stop gap would be to define your infrastructure config using terraform. You can then periodically run the terraform config against your environment and alert if there are any changes.

See more
Matthew Rothstein
Recommends
on
Security MonkeySecurity Monkey

Consider using a combination of Netflix Security Monkey and AWS Guard Duty.

You can achieve automated detection and alerting, as well as automated recovery based on policies with these tools.

For instance, you could detect SecurityGroup rule changes that allow unrestricted egress from EC2 instances and then revert those changes automatically.

It's unclear from your post whether you want to detect events within the Splunk Cloud infrastructure or if you want to detect events indicated in data going to Splunk using the Splunk capabilities. If the latter, then Splunk has extremely rich capabilities in their query language and integrated alerting functions. With Splunk you can also run arbitrary Python scripts in response to certain events, so what you can't analyze and alert on with native functionality or plugins, you could write code to achieve.

See more
Vijayanand Narayanasharma
DevOps/TechOps Consultant at Qantas Loyalty · | 3 upvotes · 59.1K views
Recommends
on
AWS CloudTrailAWS CloudTrail

Well there are clear advantages of using either tools, it all boils down to what exactly are you trying to achieve with this i.e do you want to proactive monitoring or do you want debug an incident/issue. Splunk definitely is superior in terms of proactively monitoring your logs for unusal events, but getting the cloudtrail logs across to splunk would require some not so straight forward setup (Splunk has a blueprint for this setup which uses AWS kinesis/Firehose). Cloudtrail on the other had is available out of the box from AWS, the setup is quite simple and straight forward. But analysing the log could require you setup Glue crawlers and you might have to use AWS Athena to run SQL Like query.

Refer: https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html

In my personal experience the cost/effort involved in setting up splunk is not worth it for smaller workloads, whereas the AWS Cloudtrail/Glue/Athena would be less expensive setup(comparatively).

Alternatively you could look at something like sumologic, which has better integration with cloudtrail as opposed to splunk. Hope that helps.

See more
Recommends
on
AWS CloudTrailAWS CloudTrail

I'd recommend using CloudTrail, it helped me a lot. But depending on your situation I'd recommed building a custom solution(like aws amazon-ssm-agent) which on configuration change makes an API call and logs them in grafana or kibana.

See more
Get Advice from developers at your company using StackShare Enterprise. Sign up for StackShare Enterprise.
Learn More
Pros of Splunk
Pros of Splunk Cloud
  • 3
    API for searching logs, running reports
  • 3
    Alert system based on custom query results
  • 2
    Dashboarding on any log contents
  • 2
    Custom log parsing as well as automatic parsing
  • 2
    Ability to style search results into reports
  • 2
    Query engine supports joining, aggregation, stats, etc
  • 2
    Splunk language supports string, date manip, math, etc
  • 2
    Rich GUI for searching live logs
  • 1
    Query any log as key-value pairs
  • 1
    Granular scheduling and time window support
  • 7
    More powerful & Integrates with on-prem & off-prem
  • 3
    Free
  • 3
    Powerful log analytics
  • 1
    Pci compliance
  • 1
    Production debugger

Sign up to add or upvote prosMake informed product decisions

Cons of Splunk
Cons of Splunk Cloud
  • 1
    Splunk query language rich so lots to learn
    Be the first to leave a con

    Sign up to add or upvote consMake informed product decisions

    What is Splunk?

    It provides the leading platform for Operational Intelligence. Customers use it to search, monitor, analyze and visualize machine data.

    What is Splunk Cloud?

    If you're looking for all the benefits of Splunk® Enterprise with all the benefits of software-as-a-service, then look no further. Splunk Cloud is backed by a 100% uptime SLA, scales to over 10TB/day, and offers a highly secure environment.

    Need advice about which tool to choose?Ask the StackShare community!

    What companies use Splunk?
    What companies use Splunk Cloud?
    See which teams inside your own company are using Splunk or Splunk Cloud.
    Sign up for StackShare EnterpriseLearn More

    Sign up to get full access to all the companiesMake informed product decisions

    What tools integrate with Splunk?
    What tools integrate with Splunk Cloud?

    Sign up to get full access to all the tool integrationsMake informed product decisions

    Blog Posts

    Jul 9 2019 at 7:22PM

    Blue Medora

    DockerPostgreSQLNew Relic+8
    11
    2332
    Jun 26 2018 at 3:26AM

    Twilio SendGrid

    GitHubDockerKafka+10
    11
    9938
    GitHubPythonNode.js+26
    29
    15940
    What are some alternatives to Splunk and Splunk Cloud?
    Datadog
    Datadog is the leading service for cloud-scale monitoring. It is used by IT, operations, and development teams who build and operate applications that run on dynamic or hybrid cloud infrastructure. Start monitoring in minutes with Datadog!
    Graylog
    Centralize and aggregate all your log files for 100% visibility. Use our powerful query language to search through terabytes of log data to discover and analyze important information.
    Elasticsearch
    Elasticsearch is a distributed, RESTful search and analytics engine capable of storing data and searching it in near real time. Elasticsearch, Kibana, Beats and Logstash are the Elastic Stack (sometimes called the ELK Stack).
    Sumo Logic
    Cloud-based machine data analytics platform that enables companies to proactively identify availability and performance issues in their infrastructure, improve their security posture and enhance application rollouts. Companies using Sumo Logic reduce their mean-time-to-resolution by 50% and can save hundreds of thousands of dollars, annually. Customers include Netflix, Medallia, Orange, and GoGo Inflight.
    Kibana
    Kibana is an open source (Apache Licensed), browser based analytics and search dashboard for Elasticsearch. Kibana is a snap to setup and start using. Kibana strives to be easy to get started with, while also being flexible and powerful, just like Elasticsearch.
    See all alternatives