Splunk: Log Management & SIEM Overview

By NetMon Hub Editorial · 30 May 2026

Official site · Latest version: 10.4.1

Splunk ingests machine data — logs, metrics, traces — indexes it, and lets you search it with SPL (Search Processing Language). It’s the dominant commercial SIEM and log analytics platform, available self-hosted (Splunk Enterprise), as SaaS (Splunk Cloud), or free for small volumes.

Ownership: Splunk is part of Cisco

Cisco completed its acquisition of Splunk on 18 March 2024 - $157 per share in cash, roughly $28 billion in equity value, and the largest acquisition in Cisco’s history. Splunk now sits inside Cisco’s security and full-stack observability portfolio.

What that does and does not change:

• SPL and the architecture are unaffected. The search language, the forwarder to indexer to search head pipeline, and the free tier all behave exactly as described on this page. Nothing in our SPL config examples is invalidated by the change of owner.
• Commercial terms are where ownership shows up first. Procurement, licensing vehicles and support routing now sit with Cisco, so confirm which entity your next renewal is written against rather than assuming continuity from a previous Splunk contract.
• Expect portfolio consolidation. Cisco already owned AppDynamics and ThousandEyes, so treat the observability line as converging rather than as three independent products.

The pipeline in one paragraph

Forwarders ship data to indexers, which parse it into events and store it in indexes. Search heads run SPL queries against those indexes. In small deployments one box does all three roles; at scale you separate them and cluster the indexers.

SPL: the part you live in

SPL is a piped language — each | passes results to the next command:

index=firewall action=blocked
| stats count by src_ip
| sort -count
| head 10

That’s “the ten source IPs with the most blocked connections.” Our SPL config examples cover stats, eventstats, transaction, lookups and more.

Licensing reality check

Splunk has historically been priced on daily ingest volume (GB/day), with newer workload/ingest-based options. Costs climb fast with noisy sources, so log filtering at the forwarder is a core operational skill — not an afterthought.

Configuration examples