What can Splunk Observability do that Splunk Platform (Cloud/Enterprise) can't?

[northerngrowth]

Having a hard time understanding what Splunk Observability does that you can't do with Splunk Platform (Cloud or Enterprise)? Aren't you able to take in logs, metrics, and traces and do real-time reporting, monitoring and visualizations with Splunk Platform? And isn't Splunk Platform used to detect and solve issues? Isn't that the same as what Observability does?

Thanks a lot for your help in advance!

[richgalloway]

There are similarities between Splunk Enterprise (SE) and Splunk Observability (SO).  The main distinguishing factor of SO is support for the OpenTelemetry protocol, which SE does not support.

[northerngrowth]

Got it - so to confirm, does that mean that I can set up observability on Splunk Enterprise on my own without having to add on Splunk Observability? Thanks a lot!

[richgalloway]

You can set up something similar, but it won't do everything SO can do.  For instance, native Splunk Enterprise can't handle data coming in using the OpenTelemetry protocol.  I suppose you could write an OTel collector that converts telemetry into Splunk metrics, but that could be a lot of work.

I'm not familiar enough with SO to know what analytics and visualizations it can do so I can't say if SE can replicate them or not.