IT AI Index
Index Vendors › Splunk Enterprise Security · September 2026 Edition
Splunk · 1 category · Ranked

Splunk Enterprise Security

84Judge labels
13First choices
35Negative labels
12 of 12Models named it
1Category
September 2026 Edition. Every number here is derived from the raw labels under vendor table vv2026-09.2, every buyer segment counted.
Best standing
28% in SIEM for enterprise buyers
Rank 28 of 49 in the mid-market standingcriticized challenger
0 of 12 models made it the first choice on the direct prompt; 42% of its 26 labels there were negative.
By buyer segmentStrongest at enterprise.
In siem · each standing computed within its segment · bars are 0 to 100 · the accent bar is the product's own best reading

Standing by category

Every category where a model named Splunk Enterprise Security for a mid-market B2B company. Share is first choices across the direct, paraphrase, budget and scale prompts; rank is within every product named in that category.
CategoryFunctionShareRankNegative rateLabelsQuadrant
SIEM platformsSecurity operations0%28 of 4942%26criticized challenger

Movement

This is the first edition on this tier, so no move can be computed for Splunk Enterprise Security yet. From the next edition this section shows, per buyer segment, whether its share moved by more than the measured noise floor.

By model

How each model treated Splunk Enterprise Security across every prompt where it was named for a mid-market B2B company. Twelve models, six prompts per category.
ModelFirst choiceAlternativeMentionNegativeLabels
Claude Haiku 4.500101
GPT-5.4 mini03003
Gemini 3.5 Flash01012
Perplexity Sonar01124
Grok 4.1 Fast00033
Mistral Small10102
DeepSeek V4 Flash10012
Llama 4 Maverick00011
Qwen 3.7 Flash10001
Kimi K200112
GLM 4.7 FlashX01113
MiniMax M2.500112

By framing

Which of the six questions produced the naming. By model says how often; this says asked what. The first-choice count on the right carries the marks of the models that produced it.
FramingLabels by classFirst choices
Direct14 labels7
Paraphrase18 labels6
Comparative27 labels7not counted in share
Budget-constrained3 labelsNone
Scale-constrained5 labelsNone
Negative17 labelsNone
First choiceAlternativeMentionNegative84 labels in all, every segment counted; 13 of the 20 first choices count toward share, since the comparative and negative framings do not. The bar is one segment per label class, to scale within the framing.

What the models said for it

Verbatim evidence the judge attached to positive labels.

“Splunk is widely considered the gold standard for SIEMs due to its unmatched data processing capabilities.” Qwen 3.7 Flash · SIEM · comparative prompt · first choice
“Splunk is often considered the market leader for large enterprises with complex needs.” Mistral Small · SIEM · comparative prompt · first choice
“Choose Splunk if you need maximum analytical flexibility and have budget to burn.” DeepSeek V4 Flash · SIEM · comparative prompt · first choice
“Choose Splunk Enterprise Security if: - You have large, heterogeneous environments and need maximum flexibility.” GLM 4.7 FlashX · SIEM · comparative prompt · alternative

And against it

Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.

“Avoid Splunk Enterprise Security at this stage unless you have a large budget ... it's overkill and cost-prohibitive” DeepSeek V4 Flash · SIEM · paraphrase prompt · hard negative
“What I'd Avoid for Mid-Sized B2B ... overkill for most mid-sized budgets” Kimi K2 · SIEM · paraphrase prompt · hard negative
“Avoid Splunk Enterprise Security for a tight budget” Perplexity Sonar · SIEM · budget prompt · hard negative
“Avoid Splunk if you are a small-to-medium-sized business (SMB)... ingestion costs can rapidly spiral out of control.” Gemini 3.5 Flash · SIEM · negative prompt · soft negative

Named alongside

The products named in the same answers as Splunk Enterprise Security, over the 84 answers that named it. Took the first choice instead counts the answers where the other product was the first choice and Splunk Enterprise Security was named but was not.
ProductSame answerTook the first choice insteadHead to head
Microsoft Sentinel76 of 8424Not in the top three
IBM QRadar55 of 841Not in the top three
Elastic Security42 of 842Not in the top three
Palo Alto Networks Cortex XSIAM32 of 843Not in the top three
Exabeam32 of 840Not in the top three
LogRhythm30 of 841Not in the top three
Google Security Operations27 of 840Not in the top three
Rapid7 InsightIDR25 of 843Not in the top three
Securonix24 of 840Not in the top three
CrowdStrike Falcon Next-Gen SIEM16 of 840Not in the top three
A head-to-head page exists where both products are in a category's top three. The other rows are the same fact without a page behind them, so they link to the product instead.

What carried it into the answer

The sites and pages cited by the answers that named Splunk Enterprise Security. A fact about retrieval, not a lever on the model.

Citations exist only for the models that return a source list, four of the twelve in this edition, so these counts come from 74 of the 84 answers that named Splunk Enterprise Security and are not a share of its labels.

Domains cited

underdefense.com50
paloaltonetworks.com37
gartner.com34
expertinsights.com26
exabeam.com25
splunk.comYour site21
solutionsreview.com20
cipherssecurity.com18
manageengine.com18
reddit.com18

246 of the 267 domain citations in answers naming Splunk Enterprise Security came from somebody else's page.

Pages cited

Pages are listed as the models cited them.

Names read as Splunk Enterprise Security

What the judge wrote, as written, with how often. The vendor table decides that these count as Splunk Enterprise Security; a claim can dispute any of them.
Splunk ES 1Splunk Enterprise Security (now Cisco) 1Splunk Enterprise Security / Cisco 1
Is this your product?

Claim this page

Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when Splunk Enterprise Security's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as Splunk Enterprise Security, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.

It does not get any change to labels, shares or verdicts, any preview, or any say over which quotes appear. A verification link goes to your work email; an address at splunk.com is approved on the spot, any other address is reviewed by hand.

Your name and company appear on the claimed page, or the company alone if you ask below. A title and a LinkedIn address appear there too if you give them, and are left off if you do not. Your email address is never published.

Subscribe to the pack