IT observability

Millwright vs Splunk

Splunk lets a determined person ask an enormous pile of logs a question and get an answer. Enterprise Security and ITSI are why most buyers own it. Millwright does not hunt intrusions. It is not a SIEM.

Keep Splunk when: The job is search, detection, or a SOC, and the buyer is security.
Pick Millwright when: The job is running the plant, and the buyer runs the equipment.

Millwright Docket, work on an asset. — Millwright

Splunk Enterprise Security, a MITRE ATT&CK detection-coverage heatmap. — Splunk

The difference

The question

Millwright: What happened to this asset, and what do we do.
Splunk: What does this log say, across everything we ingest.

Process history

Millwright: Left in the historian. Millwright reads it there.
Splunk: Ingested, if you send it. The bill follows the volume.

Security

Millwright: Not a SIEM. Detection stays with the security team.
Splunk: Enterprise Security, if you bring the logs. This is the job to keep.

The workspace

Millwright: Assets, work, procedures, and conclusions with the evidence attached.
Splunk: A platform you can build that workspace on. You then staff it.

Where it runs

Millwright: Hosted, in your cloud, or on the plant floor next to the historian.
Splunk: Splunk Enterprise beside you, or Splunk Cloud.

The buyer

Millwright: The person who runs the plant.
Splunk: The person who runs security and IT operations.

Feature comparison between Millwright and Splunk
Feature	Millwright	Splunk
The question	What happened to this asset, and what do we do.	What does this log say, across everything we ingest.
Process history	Left in the historian. Millwright reads it there.	Ingested, if you send it. The bill follows the volume.
Security	Not a SIEM. Detection stays with the security team.	Enterprise Security, if you bring the logs. This is the job to keep.
The workspace	Assets, work, procedures, and conclusions with the evidence attached.	A platform you can build that workspace on. You then staff it.
Where it runs	Hosted, in your cloud, or on the plant floor next to the historian.	Splunk Enterprise beside you, or Splunk Cloud.
The buyer	The person who runs the plant.	The person who runs security and IT operations.

Splunk as described on their public pages in October 2026. Corrections.

Where Splunk wins

The job is search, detection, or a SOC.
OT security monitoring over logs is the requirement.
The buyer is security or IT operations.

Where Millwright wins

The job is running the plant, not detecting an intrusion.
Re-ingesting the historian is a cost you do not want.
The procedure and the work order have to arrive with the event.

How they fit together

An OT security program that needs detection should not be talked out of Splunk by an operations product. The accident is re-ingesting the plant: the historian already holds high-frequency history, compressed for exactly that. Paying to land it in a search index so someone can query what the historian already graphs costs more and shows less.

Questions

Is Millwright a SIEM?

No. It does not replace Enterprise Security, a SOC, or the practice of detection. If that is the gap, Splunk is the category.

Should we send the historian to Splunk for one pane of glass?

A forward of the events the SOC actually needs may be right. A full re-ingest of process history is an expensive way to get a worse trend. The two panes can be two products.

Can Splunk be the system of record for maintenance?

Only by building it: lookups, dashboards, and an app someone has to own. The CMMS you already have is the system of record. Millwright connects to it.

Other comparisons

See it running on your own plant.

We are onboarding a small number of operations teams. Three questions, and we will be in touch.