IBM QRadar vs. Splunk

IBM QRadar is ranked 3rd in Security Information and Event Management (SIEM) with 57 reviews vs Splunk which is ranked 1st in Security Information and Event Management (SIEM) with 63 reviews. The top reviewer of IBM QRadar writes "Correlates data across our global enterprise and integrates third-party solutions". The top reviewer of Splunk writes "Its AMIs make it easy to spin up a Splunk cluster or add a new node to it". IBM QRadar is most compared with Splunk, LogRhythm NextGen SIEM and ArcSight. Splunk is most compared with IBM QRadar, LogRhythm NextGen SIEM and Graylog. See our IBM QRadar vs. Splunk report.
Cancel
You must select at least 2 products to compare!
IBM QRadar Logo
50,183 views|26,104 comparisons
Splunk Logo
115,435 views|68,058 comparisons
Most Helpful Review
Find out what your peers are saying about IBM QRadar vs. Splunk and other solutions.
310,623 professionals have used our research since 2012.
Quotes From Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros
Providing real-time visibility for threat detection and prioritization - QRadar SIEM provides contextual and actionable surveillance across the entire IT infrastructure.It is very stable. We have not faced interruptions in the past four and a half years.It has improved comprehensive visibility for what is going on in the perimeters, and on the inside, as well.It is really helpful to us from the compliance point of view.The initial setup is not complex or difficult.QRadar has somewhat of a new structure recently from last gen. They have moved from the standard UI based infrastructure.It has improved my efficiency.A nice benefit is when we go to the process of selecting our youth cases, they go by building blocks. QRadar links it to building blocks.

Read more »

It is quite extensible. It is a platform that we can build our use instead of each case instead of each case being limited or restricted to each capability. This is probably the best feature.In the past we used the different application to collect logs. We used SurfWatch and VMware to do so. But, we found that the Splunk has more capacity to do more in less time. They provide a aster speed to index all the events , and this is a huge asset.The dashboards are the most valuable feature. We like the ability to drill in and see what queries are under the dashboard, build new visualizations, edit the querying, and see the reports.We were able to create a catalog of dashboards and have a holistic view at all levels. We could understand our business much better. Real-time errors, which were buried in emails before now, surfaced up on dashboards.The technical support has been very good. They are very responsive and have been helpful.You can run reports against multiple devices at the same time. You are able to troubleshoot a single application on a thousand servers. You can do this with a single query, since it is very easy to do.It has reduced the time to resolution, time to investigate, and time to troubleshoot for debugging issues.Out-of-the-box, it seems very powerful.

Read more »

Cons
AI is superb but need improvements.Technical support is good, but not great.The tech support is not that good.The Indian tech support is not helpful.It is not app based.The initial setup was complex, and it took six months.QRadar needs a lot of fine tuningThe quality of technical support depends on the IBM support person. Sometimes, it's hard to get the right person on the other side. A ticket coordinator could be the key to better quality delivery.

Read more »

I would like to see future development in terms of ML (Machine Learning).I think the tech support response time could be a bit better. Sometimes I need to wait more than 24 hours for a response to my tickets.Splunk is not very user-friendly. It has a complex architecture in comparison to other solutions on the market.We do have to educate developers on how to not blow it up. It is a little to easy to write an expensive query and overly stress the system. This could be improved.I would like additional features in different programming models with the support for writing queries in SQL or other languages, such as C#, Java, or some other type of query definitions.When you get into large amounts of data, Splunk can get pretty slow. This is the same on-premise or AWS, it doesn't matter. The way that they handle large data sets could be improved.I would like to see an updated dashboard. The dashboard is a little out-of-date. It could be made prettier.My company could benefit from doing more Splunk training with Splunk consultants teaching us how to use it.

Read more »

Pricing and Cost Advice
The cost of this product is expensive.It is very expensive.A good approach would be to begin with an On Cloud subscription, then later on do a more exact sizing.Pricing and licensing are competitive. Their new licensing options allow logs to bypass the correlation engine for a flat rate, which is also appealing for log data that is compliance-driven for a small amount of money.Pricing (based on EPS) will be more accurate.An X-Force feed is free with QRadar.It is expensive. It is not a product that I can provide for SMBs. It is a program that I can only provide for really large enterprises.The maintenance costs are high.

Read more »

I think the price could be improved.I am not personally involved with the pricing of the solution.Some of the insights that we have obtained as a part of using Splunk have greatly helped us in increasing our revenue in terms of selling our products.The pricing seems good relative to the other vendors that we have had here. However, they need to find ways to be more flexible with the licensing and be able to deal with situations where we start generating more logs. Maybe having some controls in the Splunk interface to turn it off, so we don't have to change anything in our application.We have had a reduction in the time it takes to resolve issues and correlate what has failed.It would be nice if the pricing were cheaper. However, we did purchase it.Splunk is not free.We have seen ROI and improvements as we have continued to use the product, but they are more reactive.

Read more »

report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
310,623 professionals have used our research since 2012.
Answers from the Community
Rhea Rapps
Darius RadfordUser

As all consultants say...it depends.
The elements I would factor in are:
1) How they are staffed?
2) What groups outside of security will use this tool?
3) Is this for SIEM or log management?
4) Size of environment

For" how are they staffed" question I think if you have developers and scripting expertise in house then this makes for a strong case for Splunk. If not then Q-Radar may be a better fit.

The next question..."what groups outside the security group with use this tool?". Splunk does a lot of items that are really nice to haves, but don't necessarily fall into the security space. So if folks outside of security team will use the tool and subsequently help fund the endeavor this makes a strong case for Splunk. If this is a pure play security need, then out of the box, I feel this is a strong case for Q-Radar

Is this for SIEM or log management? By default Splunk is not a SIEM, once you buy the SIEM/Security license then it becomes a SIEM. That being said, it does log management and analytics very well. Out of the box Q-Radar is a very effective SIEM with tons of pre-set rules. So obviously if this is a pure play log management move, then Splunk becomes a strong choice here.

Size of environment. Because the Splunk licensing model is based on the number of events being produced in your environment, then this is a factor that must be considered. Q-Radar on the other hand is one of most straight-forward SIEM installations, and shortest time to value out there. As such, they have often been associated with small to mid sized organizations.

There are other factors out there to consider...this is in no means an all encompassing list, however, I feel if you ask yourself these questions, at a minimum , then your answers becomes a lot clearer.

13 February 18
Loren BuhleUser

It depends on the intended purpose of the tool and the type of people implementing it. Q-Radar tends to focus its out-of-the-box reports on compliance reporting, as well as tracking behavior-based tracking that is arduous for the DIY script writer. Having used both, they are both great platforms that take quite a bit of training to fully understand and wring the most value. Once you are at a steady state of log analysis, Q-Radar tends to be more useful on exploring "what we don't know" while Splunk tends to focus on confirming what I suspected, but didn't have the evidence.

If you love scripting and going after known deviations, there are alot of Splunk consultants and expertise for hire. This makes Splunk slightly better for small organizations. If known deviations are "table stakes" and you focus is on exploring risks currently unknown to you...then Q-Radar is the better option, in my opinion. Q-Radar's learning curve used to be slightly steeper than Splunk...but I've heard there is more automation and better training on the Q-Radar in the past few years.

13 February 18
Eduardo PerezReal User

I had been looking at the Security Analytics Platforms from the top right quadrant in the Gartner and Forrester reports and found that [architectural] use-case really matters.

For my business I was looking to build a shared environment that would service multiple customers so multi-tenancy, data security, roles based access controls and self-service-ability were key requirements. For the purposes of providing the SOC a single-pane of glass I needed a single configurable dash, and in a single-tenant environment both (Splunk and QRadar) could do it but in a multi-tenanted scenario on one could do it, at least without having to adding unnecessary systems.

Also, I didn't want to spend too much time on integration, setup and configuration so having [SIEM] use cases and compliance reporting available out-of-the-box and integration with common devices and OS had to be part of the base offering allowing the team to install and start using it immediately.

For me QRadar ticked all the boxes. Additionally the vast range of free apps which include user behavioral analytics are available which let you leverage its analytics engine.

That said, Splunk is an effective analytics platform that has use cases outside of SecOps. You will need to have the depth of certified knowledge, expertise and deep pockets to make effective use.

14 February 18
it_user128883User

First of all, I'm a Splunker (by religion, not by employment :)), which makes my opinion a bit subjective.

It really depends on what are you expecting from the solution and how skilled and how ready for new approaches you are.

QRadar is great as a pure SIEM solution. Easy to use, super integrated with common devices, fantastic correlations and reports, everything expected from a top SIEM solution.

Splunk, on the other hand, offers much more. Splunk is more a general purpose big-data collecting platform, used to search and find anything very quickly and correlate any data, without prior knowledge of the data structure. SIEM is just one purpose to use Splunk, often better suited and equipped than competitive SIEM solutions, because it always uses ALL data, not just the normalized ones. However, a newbie to Splunk might find the search-oriented GUI and more advanced approach than competitors rather confusing. Believe me, once you get used to the philosophy of Splunk and get familiar with its usage, there is no way back to any other tool.

19 March 18
Leonardo CarmonaReal User

The biggest difference is that QRadar brings a lot of interesting embedded functionalities (UBA, Watson, DataFlow) that makes the difference from a cybersecurity perspective, whereas Splunk is more open than QRadar.

Both Splunk and IBM QRadar are amazing technologies for SIEM. I would recommend QRadar for pure information security purposes. If you really need to do more than SIEM and information security tasks, you should look at Splunk. I used Splunk for fraud control and monitoring and it is amazing. You can consume any kind of data and do so many things. Your imagination is the limit. I'm a big Splunk fan!

14 February 18
Ranking
Views
50,183
Comparisons
26,104
Reviews
54
Followers
1,969
Avg. Rating
8.4
Views
115,435
Comparisons
68,058
Reviews
59
Followers
2,553
Avg. Rating
8.7
Top Comparisons
Compared 42% of the time.
Compared 11% of the time.
Compared 8% of the time.
Compared 16% of the time.
Compared 9% of the time.
Compared 7% of the time.
Also Known As
QRadar SIEM, QRadar UBA, QRadar on Cloud, QRadar
Learn
IBM
Splunk
Overview

The IBM QRadar security and analytics platform is a lead offering in IBM Security's portfolio. This family of products provides consolidated flexible architecture for security teams to quickly adopt log management, SIEM, user behavior analytics, incident forensics, and threat intelligence and more. As an integrated analytics platform, QRadar streamlines critical capabilities into a common workflow, with tools such as the IBM Security App Exchange ecosystem and Watson for Cyber Security cognitive capability.

With QRadar, you can decrease your overall cost of ownership with an improved detection of threats and enjoy the flexibility of on-premise or cloud deployment, and optional managed security monitoring services.

Splunk software has been around since 2006 and the company has since grown to become an industry leader. Splunk's vision is to make machine data accessible, usable and valuable to everybody. The company offers a wide range of products to turn machine data into valuable information by monitoring and analyzing all activities. This is known as Operational Intelligence and is the unique value proposition of Splunk.

Splunk is well-known for its Log Management capabilities and also for its Security Information and Event Management (SIEM) solutions.

Offer
Learn more about IBM QRadar
Learn more about Splunk
Sample Customers
Clients across multiple industries, such as energy, financial, retail, healthcare, government, communications, and education use QRadar.Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.
Top Industries
REVIEWERS
Financial Services Firm25%
Transportation Company18%
Comms Service Provider7%
Health, Wellness And Fitness Company7%
VISITORS READING REVIEWS
Financial Services Firm16%
Philanthropy12%
Comms Service Provider12%
University7%
REVIEWERS
Financial Services Firm20%
Energy/Utilities Company14%
Retailer14%
Insurance Company9%
VISITORS READING REVIEWS
Financial Services Firm17%
Comms Service Provider11%
Energy/Utilities Company7%
Manufacturing Company6%
Company Size
REVIEWERS
Small Business30%
Midsize Enterprise13%
Large Enterprise58%
VISITORS READING REVIEWS
Small Business40%
Midsize Enterprise12%
Large Enterprise48%
REVIEWERS
Small Business20%
Midsize Enterprise13%
Large Enterprise67%
VISITORS READING REVIEWS
Small Business14%
Midsize Enterprise19%
Large Enterprise67%
Find out what your peers are saying about IBM QRadar vs. Splunk and other solutions.
310,623 professionals have used our research since 2012.
We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.

Sign Up with Email