Hey everyone! I've been lurking here for a while, but this is my first real post. I'm on the project management side at a ~300-person tech company, and we've been using Splunk Enterprise Security (ES) for about a year and a half now. I'm not a security analyst, but my team works closely with our SOC and I was heavily involved in the selection and rollout. I wanted to share our experience from that "adjacent" user perspective.
The power is undeniable. When it works, it’s incredible for visibility. Our security team can correlate things across endpoints, network, and cloud in ways they couldn't before. The dashboards are super impressive for reporting to leadership, especially after an incident.
But wow, the learning curve is steep 😅. For us non-security folks who just need to interact with it occasionally (like reviewing access logs for our projects), it feels like a different universe compared to tools like Asana or Notion. The complexity also meant a huge resource commitment. We needed a dedicated Splunk admin almost full-time, and training our SOC analysts took months, not weeks.
I’m curious for others in similar sized companies: how do you balance the power with the operational overhead? Did anyone find good ways to create simpler, more guided workflows for non-security teams who need to use it occasionally? Also, the cost... it's a big topic. Ours grew in ways we didn't fully anticipate as we ingested more data sources.
Thx!