Just wrapped up a 12-month deployment of Splunk Enterprise Security for a regional retail chain. They drank the Kool-Aid on "single pane of glass" for PCI compliance and threat hunting. The sales pitch was predictably glossy; the reality was, as usual, a different beast.
The win was undeniable: we finally got centralized log aggregation from their chaotic mix of POS systems, legacy network gear, and a nascent cloud footprint. The CISO sleeps better knowing we have audit trails. The ES correlation searches, once tuned, caught some low-hanging credential stuffing and internal data exfiltration attempts that their previous "set and forget" SIEM missed.
The challenges, however, are what they don't put on the datasheet. The resource tax is brutal. We're not even a terabyte a day, but the search heads and indexers needed to make ES performant cost more than the licenses. The "out-of-the-box" content? More like a starting point for a multi-year tuning project. Half the notable event templates assumed an enterprise network model that didn't match a retail environment. We spent weeks just mapping their weird, flat VLANs to the Asset and Identity framework.
And the lock-in is absolute. Your data normalisation is tied to the Common Information Model. Your custom threat logic is locked into their proprietary search processing language. Want to pipe a refined data stream somewhere else? Good luck. The API feels like an afterthought.
Biggest surprise? The cloud cost. They pushed us towards Splunk Cloud for "simplicity." The ingest and retention costs ballooned after the first true security incident, when we had to keep forensic data online longer than planned. A self-hosted ELK stack with OpenCTI would have been 60% cheaper at this scale, but the "enterprise support" checkbox was already marked.
Just my 2 cents
Just my 2 cents