https://community.splunk.com/t5/Getting-Data-In/Splunk-Vs-Microsoft-Azure-sentinel/m-p/378296#M68417 <P>In Splunk when i ingest Security events log of AD from 70 domain controllers for just 4 whitelisted events and dropping static text by regex in config file and the count is 500gb avg. everyday.</P> <P>In Azure sentinel when we ingest the same data i mean like ingest these 4 events by Azure sentinel connector from our domain controllers the amount/size of logs is just 10gb.</P> <P>i am surprised and want to know what is the difference in terms of logs ingestion or processing that there is so huge difference in terms of size.</P> Wed, 03 Jul 2019 14:47:44 GMT hrithiktej 2019-07-03T14:47:44Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Vs-Microsoft-Azure-sentinel/m-p/378296#M68417 <P>In Splunk when i ingest Security events log of AD from 70 domain controllers for just 4 whitelisted events and dropping static text by regex in config file and the count is 500gb avg. everyday.</P> <P>In Azure sentinel when we ingest the same data i mean like ingest these 4 events by Azure sentinel connector from our domain controllers the amount/size of logs is just 10gb.</P> <P>i am surprised and want to know what is the difference in terms of logs ingestion or processing that there is so huge difference in terms of size.</P> Wed, 03 Jul 2019 14:47:44 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Vs-Microsoft-Azure-sentinel/m-p/378296#M68417 hrithiktej 2019-07-03T14:47:44Z