Splunk Cloud vs Splunk Enterprise

Need advice about which tool to choose?Ask the StackShare community!

Splunk Cloud

167
434
+ 1
15
Splunk Enterprise

118
114
+ 1
0
Add tool

Splunk Cloud vs Splunk Enterprise: What are the differences?

Introduction

In this Markdown code, we will discuss the key differences between Splunk Cloud and Splunk Enterprise. Splunk Cloud is a cloud-based version of Splunk, while Splunk Enterprise is an on-premises software. Let's explore the differences between the two in detail.

  1. Deployment Model: Splunk Cloud is a fully managed service provided by Splunk, where the entire infrastructure and management of the Splunk environment is handled by Splunk itself. On the other hand, Splunk Enterprise is deployed on-premises, requiring organizations to manage their own infrastructure, such as servers and network connectivity.

  2. Scalability and Capacity: Splunk Cloud offers elastic scalability, allowing users to easily scale up or down their resources based on their needs. With Splunk Cloud, users can leverage the power of the cloud to handle large amounts of data and concurrent searches. Splunk Enterprise, while scalable, requires organizations to provision and manage their own hardware resources, which may have limitations based on their infrastructure and capacity planning.

  3. Maintenance and Upgrades: With Splunk Cloud, Splunk takes care of all maintenance tasks and upgrades, ensuring that users have access to the latest features and bug fixes. Organizations using Splunk Enterprise, however, are responsible for their own maintenance tasks, such as applying patches and upgrading the software. This requires additional resources and effort to keep the environment running smoothly and up to date.

  4. Security and Compliance: Splunk Cloud provides a secure infrastructure and is compliant with various industry regulations (i.e., HIPAA, GDPR). Splunk takes care of security measures like data encryption, access controls, and network security. With Splunk Enterprise, organizations have the flexibility to implement their own security measures and comply with industry regulations, but the responsibility lies with the organization itself.

  5. Cost and Pricing: Splunk Cloud operates on a subscription-based pricing model, where users pay a recurring fee based on their usage and the number of data ingested. The costs are predictable and can scale with the organization's needs. Splunk Enterprise, on the other hand, requires an upfront investment in hardware and software licenses, along with ongoing maintenance costs. The total cost of ownership may vary based on the size of the deployment and the resources required.

  6. Customization and Control: Splunk Cloud provides a managed environment with limited customization options. Users have control over their own specific configurations and applications, but some capabilities may be limited due to the managed nature of the service. With Splunk Enterprise, organizations have full control and flexibility to customize and tailor the environment according to their specific needs, allowing for extensive customization and integration possibilities.

In summary, Splunk Cloud and Splunk Enterprise differ in their deployment model, scalability, maintenance and upgrades, security and compliance, cost and pricing, and customization and control. Splunk Cloud provides a fully managed, scalable, and secure cloud-based solution, while Splunk Enterprise offers more control and customization options but requires organizations to manage their own infrastructure and maintenance tasks.

Advice on Splunk Cloud and Splunk Enterprise
Jigar Shah
Security Software Engineer at Pinterest · | 8 upvotes · 141.5K views

We would like to detect unusual config changes that can potentially cause production outage.

Such as, SecurityGroup new allow/deny rule, AuthZ policy change, Secret key/certificate rotation, IP subnet add/drop. The problem is the source of all of these activities is different, i.e., AWS IAM, Amazon EC2, internal prod services, envoy sidecar, etc.

Which of the technology would be best suitable to detect only IMP events (not all activity) from various sources all workload running on AWS and also Splunk Cloud?

See more
Replies (5)
Nati Abebe
Recommends
on
AWS ConfigAWS Config

For continuous monitoring and detecting unusual configuration changes, I would suggest you look into AWS Config.

AWS Config enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. Here is a list of supported AWS resources types and resource relationships with AWS Config https://docs.aws.amazon.com/config/latest/developerguide/resource-config-reference.html

Also as of Nov, 2019 - AWS Config launches support for third-party resources. You can now publish the configuration of third-party resources, such as GitHub repositories, Microsoft Active Directory resources, or any on-premises server into AWS Config using the new API. Here is more detail: https://docs.aws.amazon.com/config/latest/developerguide/customresources.html

If you have multiple AWS Account in your organization and want to detect changes there: https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data.html

Lastly, if you already use Splunk Cloud in your enterprise and are looking for a consolidated view then, AWS Config is supported by Splunk Cloud as per their documentation too. https://aws.amazon.com/marketplace/pp/Splunk-Inc-Splunk-Cloud/B06XK299KV https://aws.amazon.com/marketplace/pp/Splunk-Inc-Splunk-Cloud/B06XK299KV

See more
Isaac Povey
Casual Software Engineer at Skedulo · | 6 upvotes · 68K views
Recommends
on
TerraformTerraform

While it won't detect events as they happen a good stop gap would be to define your infrastructure config using terraform. You can then periodically run the terraform config against your environment and alert if there are any changes.

See more
Matthew Rothstein
Recommends
on
Security MonkeySecurity Monkey

Consider using a combination of Netflix Security Monkey and AWS Guard Duty.

You can achieve automated detection and alerting, as well as automated recovery based on policies with these tools.

For instance, you could detect SecurityGroup rule changes that allow unrestricted egress from EC2 instances and then revert those changes automatically.

It's unclear from your post whether you want to detect events within the Splunk Cloud infrastructure or if you want to detect events indicated in data going to Splunk using the Splunk capabilities. If the latter, then Splunk has extremely rich capabilities in their query language and integrated alerting functions. With Splunk you can also run arbitrary Python scripts in response to certain events, so what you can't analyze and alert on with native functionality or plugins, you could write code to achieve.

See more
Vijayanand Narayanasharma
DevOps/TechOps Consultant at Qantas Loyalty · | 3 upvotes · 59.1K views
Recommends
on
AWS CloudTrailAWS CloudTrail

Well there are clear advantages of using either tools, it all boils down to what exactly are you trying to achieve with this i.e do you want to proactive monitoring or do you want debug an incident/issue. Splunk definitely is superior in terms of proactively monitoring your logs for unusal events, but getting the cloudtrail logs across to splunk would require some not so straight forward setup (Splunk has a blueprint for this setup which uses AWS kinesis/Firehose). Cloudtrail on the other had is available out of the box from AWS, the setup is quite simple and straight forward. But analysing the log could require you setup Glue crawlers and you might have to use AWS Athena to run SQL Like query.

Refer: https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html

In my personal experience the cost/effort involved in setting up splunk is not worth it for smaller workloads, whereas the AWS Cloudtrail/Glue/Athena would be less expensive setup(comparatively).

Alternatively you could look at something like sumologic, which has better integration with cloudtrail as opposed to splunk. Hope that helps.

See more
Recommends
on
AWS CloudTrailAWS CloudTrail

I'd recommend using CloudTrail, it helped me a lot. But depending on your situation I'd recommed building a custom solution(like aws amazon-ssm-agent) which on configuration change makes an API call and logs them in grafana or kibana.

See more
Get Advice from developers at your company using StackShare Enterprise. Sign up for StackShare Enterprise.
Learn More
Pros of Splunk Cloud
Pros of Splunk Enterprise
  • 7
    More powerful & Integrates with on-prem & off-prem
  • 3
    Free
  • 3
    Powerful log analytics
  • 1
    Pci compliance
  • 1
    Production debugger
    Be the first to leave a pro

    Sign up to add or upvote prosMake informed product decisions

    What is Splunk Cloud?

    If you're looking for all the benefits of Splunk® Enterprise with all the benefits of software-as-a-service, then look no further. Splunk Cloud is backed by a 100% uptime SLA, scales to over 10TB/day, and offers a highly secure environment.

    What is Splunk Enterprise?

    Splunk Enterprise delivers massive scale and speed to give you the real-time insights needed to boost productivity, security, profitability and competitiveness.

    Need advice about which tool to choose?Ask the StackShare community!

    What companies use Splunk Cloud?
    What companies use Splunk Enterprise?
    See which teams inside your own company are using Splunk Cloud or Splunk Enterprise.
    Sign up for StackShare EnterpriseLearn More

    Sign up to get full access to all the companiesMake informed product decisions

    What tools integrate with Splunk Cloud?
    What tools integrate with Splunk Enterprise?

    Sign up to get full access to all the tool integrationsMake informed product decisions

    Blog Posts

    GitHubPythonNode.js+26
    29
    15936
    What are some alternatives to Splunk Cloud and Splunk Enterprise?
    Sumo Logic
    Cloud-based machine data analytics platform that enables companies to proactively identify availability and performance issues in their infrastructure, improve their security posture and enhance application rollouts. Companies using Sumo Logic reduce their mean-time-to-resolution by 50% and can save hundreds of thousands of dollars, annually. Customers include Netflix, Medallia, Orange, and GoGo Inflight.
    Loggly
    It is a SaaS solution to manage your log data. There is nothing to install and updates are automatically applied to your Loggly subdomain.
    Elastic Cloud
    A growing family of Elastic SaaS offerings that make it easy to deploy, operate, and scale Elastic products and solutions in the cloud. From an easy-to-use hosted and managed Elasticsearch experience to powerful, out-of-the-box search solutions.
    New Relic
    The world’s best software and DevOps teams rely on New Relic to move faster, make better decisions and create best-in-class digital experiences. If you run software, you need to run New Relic. More than 50% of the Fortune 100 do too.
    Datadog
    Datadog is the leading service for cloud-scale monitoring. It is used by IT, operations, and development teams who build and operate applications that run on dynamic or hybrid cloud infrastructure. Start monitoring in minutes with Datadog!
    See all alternatives