| Category | Function | Share | Rank | Negative rate | Labels | Quadrant |
|---|---|---|---|---|---|---|
| SIEM platforms | Security operations | 0% | 28 of 49 | 42% | 26 | criticized challenger |
| Model | First choice | Alternative | Mention | Negative | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 0 | 1 | 0 | 1 |
| GPT-5.4 mini | 0 | 3 | 0 | 0 | 3 |
| Gemini 3.5 Flash | 0 | 1 | 0 | 1 | 2 |
| Perplexity Sonar | 0 | 1 | 1 | 2 | 4 |
| Grok 4.1 Fast | 0 | 0 | 0 | 3 | 3 |
| Mistral Small | 1 | 0 | 1 | 0 | 2 |
| DeepSeek V4 Flash | 1 | 0 | 0 | 1 | 2 |
| Llama 4 Maverick | 0 | 0 | 0 | 1 | 1 |
| Qwen 3.7 Flash | 1 | 0 | 0 | 0 | 1 |
| Kimi K2 | 0 | 0 | 1 | 1 | 2 |
| GLM 4.7 FlashX | 0 | 1 | 1 | 1 | 3 |
| MiniMax M2.5 | 0 | 0 | 1 | 1 | 2 |
Verbatim evidence the judge attached to positive labels.
“Splunk is widely considered the gold standard for SIEMs due to its unmatched data processing capabilities.” Qwen 3.7 Flash · SIEM · comparative prompt · first choice
“Splunk is often considered the market leader for large enterprises with complex needs.” Mistral Small · SIEM · comparative prompt · first choice
“Choose Splunk if you need maximum analytical flexibility and have budget to burn.” DeepSeek V4 Flash · SIEM · comparative prompt · first choice
“Choose Splunk Enterprise Security if: - You have large, heterogeneous environments and need maximum flexibility.” GLM 4.7 FlashX · SIEM · comparative prompt · alternative
Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.
“Avoid Splunk Enterprise Security at this stage unless you have a large budget ... it's overkill and cost-prohibitive” DeepSeek V4 Flash · SIEM · paraphrase prompt · hard negative
“What I'd Avoid for Mid-Sized B2B ... overkill for most mid-sized budgets” Kimi K2 · SIEM · paraphrase prompt · hard negative
“Avoid Splunk Enterprise Security for a tight budget” Perplexity Sonar · SIEM · budget prompt · hard negative
“Avoid Splunk if you are a small-to-medium-sized business (SMB)... ingestion costs can rapidly spiral out of control.” Gemini 3.5 Flash · SIEM · negative prompt · soft negative
Citations exist only for the models that return a source list, four of the twelve in this edition, so these counts come from 74 of the 84 answers that named Splunk Enterprise Security and are not a share of its labels.
246 of the 267 domain citations in answers naming Splunk Enterprise Security came from somebody else's page.
Pages are listed as the models cited them.
Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when Splunk Enterprise Security's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as Splunk Enterprise Security, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.
It does not get any change to labels, shares or verdicts, any preview, or any say over which quotes appear. A verification link goes to your work email; an address at splunk.com is approved on the spot, any other address is reviewed by hand.
Your name and company appear on the claimed page, or the company alone if you ask below. A title and a LinkedIn address appear there too if you give them, and are left off if you do not. Your email address is never published.