Splunk Observability Suite

Service scope

Software add-on or extension: Yes, but can also be used as a standalone service
What software services is the service an extension to: - Splunk Observability Cloud is the base service.
- Splunk Infrastructure Monitoring is included as standard.
- Application Performance Monitoring augments Splunk Observability.
- Real User Monitoring augments Splunk Observability.
- Splunk Synthetic Monitoring augments Splunk Observability.
- IT Service Intelligence is an add-on service to Splunk.
Cloud deployment model: Public cloud

Private cloud

Hybrid cloud
Service constraints: None
System requirements: Hardware non Windows> 2 x 6 core 2+GHZ, 12GB RAM

Windows> 2 x 6 core 2+GHZ, 12GB RAM

Windows Server 2016 or 2019

Linux, 3.x, 4.x or 5.4.x and higher

Mac OS 10.15

User support

Email or online ticketing support: Email or online ticketing
Support response times: Up to 30 Mins at Premium Level Support offering. Standard; up to 2 Hours. Base; up to 4 hours.
User can manage status and priority of support tickets: No
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: No
Onsite support: Yes, at extra cost
Support levels: N/a
Support available to third parties: Yes

Onboarding and offboarding

Getting started: Splunk Education and Professional Services can be purchased to help users start using Splunk, and increase their time to value.
Service documentation: Yes
Documentation formats: HTML

PDF
End-of-contract data extraction: The Splunk tool provides analysis and visualisation of data from various sources. The data rests at its original location and does not solely reside in Splunk. Therefore there is no need for data extraction at end of contract
End-of-contract process: Splunk ceases to provide access to the service.

Using the service

Web browser interface: Yes
Supported browsers: Microsoft Edge

Firefox

Chrome

Safari
Application to install: No
Designed for use on mobile devices: No
Service interface: No
User support accessibility: WCAG 2.1 AA or EN 301 549
API: Yes
What users can and can't do using the API: The Splunk Enterprise REST API provides methods for accessing every feature in our product. Your program talks to Splunk Enterprise using HTTP or HTTPS, the same protocols that your web browser uses to interact with web pages, and follows the principles of Representational State Transfer (REST).
API documentation: Yes
API documentation formats: HTML

ODF

PDF
API sandbox or test environment: Yes
Customisation available: Yes
Description of customisation: The user is able to configure dashboards, alerts, reports and underlying target data sources. Configuration can be through Splunk Web, Splunk's Command Line Interface (CLI), Splunk's REST API or directly within configuration.

Scaling

Independence of resources: "The Splunk Observability Cloud services will be available 99.9% of the time, as measured by Splunk over each calendar month of the Subscription Term, and subject to the exclusions set forth below (the “Service Level Commitment”).

A Splunk Observability Cloud service is considered available if Customers are able to login to the service interface and access monitoring data. (https://www.splunk.com/en_us/legal/observability-service-level-schedule.html)"

Analytics

Service usage metrics: Yes
Metrics types: "Numerous metrics about consumption and performance are available from the Monitoring Console from the Customer's Splunk environment.
"
Reporting types: Real-time dashboards

Resellers

Supplier type: Reseller (no extras)
Organisation whose services are being resold: Splunk

Staff security

Staff security clearance: Conforms to BS7858:2019
Government security clearance: Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)

Other locations
User control over data storage and processing locations: Yes
Datacentre security standards: Managed by a third party
Penetration testing frequency: At least once a year
Penetration testing approach: In-house
Protecting data at rest: Other
Other data at rest protection approach: Splunk's own cloud service uses logical data separation, authenticated user accounts, and industry standard hardening. Data in transit is encrypted with industry standard SSL and data at rest is encrypted with AES 256-bit encryption. This service is acccredited to ISO270001.
Data sanitisation process: Yes
Data sanitisation type: Explicit overwriting of storage before reallocation

Deleted data can’t be directly accessed
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach: There are many ways that a user can export data. Splunk provides a REST API to export data. Data can be exported by the Splunk Web facility. Users can use the Command Line Interface, SDK's and data forwarding tools.
Data export formats: CSV

Other
Other data export formats: XML

JSON

Raw Data
Data import formats: CSV

Other
Other data import formats: XML

JSON

Raw Data

Data-in-transit protection

Data protection between buyer and supplier networks: TLS (version 1.2 or above)
Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability: "Splunk Cloud is considered available if you are able to log into your Splunk Cloud Service account and initiate a search using Splunk Software. Splunk continuously monitors the status of each Splunk Cloud environment to ensure the SLA of 100% uptime. In addition, Splunk Cloud monitors several additional health and performance variables.

Alternatively Splunk sits within the Buyers network or the infrastructure of their chosen cloud provider. Availability is controlled by the Buyer or their cloud provider."
Approach to resilience: Splunk handles resilience by replication of data across a cluster of Splunk Indexers across data centres. Splunk Cloud maintains a seven-day backup of data and configuration files and backups run continuously.
Outage reporting: "Splunk provides a cloud monitoring console to monitor the health of your Splunk Cloud environment. Email alerts are also available.

Alternatively Splunk sits within the Buyers network or the infrastructure of their chosen cloud provider. Outage reporting is the responsibility of the Buyer or their cloud provider."

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Username or password
Access restrictions in management interfaces and support channels: The Splunk user authentication system allows the assignment of roles which provide custom permissions. The Buyer can define all roles using a list of capabilities and data access restrictions.
Access restriction testing frequency: At least once a year
Management access authentication: Other
Description of management access authentication: "Splunk access to a Customer service is controlled by robust and automated, approval-driven separate request to approve limited time access which is automatically withdrawn at the end of the allowed period.
When an engineer or a PS consultant has approved access, their access requires VPN connection controlled by MFA, from an authorised, managed machine, and then combinations of public-key and federated access using controlled clients to access any servers. UI access is provided using unique username and temporary password access with restricted rights within the environment, and is automatically deprovisioned when the allowed period is complete."

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: User-defined
Access to supplier activity audit information: No audit information available
How long system logs are stored for: User-defined

Standards and certifications

ISO/IEC 27001 certification: No
ISO 28000:2007 certification: No
CSA STAR certification: No
PCI certification: No
Cyber essentials: Yes
Cyber essentials plus: Yes
Other security certifications: Yes
Any other security certifications: SOC2 Type 2

HIPAA

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001
Information security policies and processes: Our Cloud based service uses trusted third-party validation. Auditing of our processes and policies efforts to safeguard customer data to industry standards worldwide. Working with our audit partners, SOC 2 Type 2 attestation is completed for all Splunk Cloud customer environments and ISO 27001 certification is completed for Splunk Cloud customer environments provisioned for data ingestion of over 20GB/day

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: "For Splunk initiated changes, maintenance is performed at most once per month and Customers will receive notice of Routine Maintenance by email at least 48 hours in advance. For Customer initiated changes, the maintenance can be performed regularly. You can request an alternate time within the Routine Maintenance window if required. Customers will receive email notice when such maintenance is starting and when complete.

Alternatively Splunk sits in the network of the Buyer or the infrastructure of their chosen cloud provider, Configuration and change management is the responsibility of the Buyer or their supplier."
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: We have a robust process for threats to the Splunk platform. We maintain a policy of evaluating all potential security vulnerabilities that are discovered internally or externally within two business days of discovery. We use the industry standard CVSSv2 to rate vulnerabilities. In the case of critical risk, high impact vulnerabilities, Splunk will make all reasonable effort to supply patches, assuming that patches are a viable stop-gap for customers who cannot otherwise upgrade Splunk.
Protective monitoring type: Supplier-defined controls
Protective monitoring approach: "Splunk monitors application and platform components of the service for potential issues. Cloud Operations staff monitor alerts and logs for issues, and log a ticket for issues that require remediation. In the event of application or data compromise affecting customer data, the customer is notified immediately and remains in contact with the remediation team until resolution.

The security measures of Splunk and AWS are further described in the Technical Briefing paper at https://www.splunk.com/pdfs/technical-briefs/safeguarding-customer-data-in-splunk-cloud.pdf"
Incident management type: Supplier-defined controls
Incident management approach: Splunk maintains an incident response policy and program, with defined processes, roles and responsibilities. Customers may submit security issues through the normal support channels or any additional channels as provided in the EULA.

Secure development

Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks: No

Social Value

Fighting climate change

We take our environmental management and the impact we have on the environment very seriously. We have environmental policies in place and hold the ISO14001 accreditation. Our environmental assessments are conducted annually by an external Lead ESOS Assessor; they are signed-off by the board and compliance reported to the regulator (the Environment Agency). Our environmental policy is published on our website at https://www.bytes.co.uk/company/sustainability/environmental.
Bytes achieved carbon net zero in March 2022 through approved carbon offsetting schemes. We are always seeking to reduce our impact on the environment. We aim to minimise waste, reduce pollutants and use renewable materials. Our offices have recycling facilities for cans, plastic and paper. We aim to reduce our office printing to zero within the next few years.
An Environmental Steering Committee has been established to coordinate environmental activities and drive change.
To drastically reduce our emissions, we have switched to renewable energy. Our Head Office has reached our first milestone of using a specialist 100% renewable electricity provider. We are also exploring options to install solar panels on our Headquarters building.
Other environmental initiatives include installing electric vehicle charging points and encouraging staff to commute to work without the car (setting up a car share network and installing secure cycle parking).
We produce a SECR (Streamlined Energy and Carbon Reporting) report that details the companies energy consumption and carbon emissions. This report is produced annually by an independent assessor.
This report provides details of our emissions in Scope 1, 2 and 3 categories. It details the activities previously taken to reduce emissions and also recommendations for further improvements.
For scope 1,2 and 3 emissions we aim to reduce these by 50% by 2025-2026 from our 2021 baseline.
We aim to be Net Zero by 2040, covering our own operational emissions.

Pricing

Price: £300 a user a month
Discount for educational organisations: Yes
Free trial available: Yes
Description of free trial: Try the only full-stack, analytics-driven, enterprise-grade observability solution. Explore all the benefits of Splunk Infrastructure Monitoring, Splunk APM, Splunk RUM, Splunk Incident Intelligence and Splunk Log Observer Connect free for 14 days, no credit card required (one user seat).
Link to free trial: https://www.splunk.com/en_us/download/o11y-cloud-free-trial.html

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Splunk Observability Suite

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents