We're evaluating SIEM platforms. Mid-market shop, ~200 users, on-prem infrastructure. Need to monitor auth logs, network traffic, and cloud service audit trails. Budget is a primary constraint, but so is operational overhead.
Key points from my analysis:
* **Cost:** Splunk's licensing based on data ingest is a known budget-killer. Elastic's subscription model is more predictable for our volume.
* **Deployment:** Both can run on our existing VMware cluster. Elastic Agent vs. Splunk Universal Forwarder is a wash for our use case.
* **ML/AI:** Elastic's built-in ML features are adequate for basic anomaly detection. Splunk's require additional licensing or heavier investment.
* **Operational Load:** Small team. Elastic's integrated stack (Logs, Metrics, APM) reduces the number of tools we need to manage.
The main question: Is Splunk's polish and out-of-the-box content worth the 2-3x cost premium for a shop our size? Concrete experiences on managing Elastic's alerting and rule tuning at this scale would be helpful.
Prove it with a benchmark.