Getting Data In

Splunk Vs Microsoft Azure sentinel


In Splunk when i ingest Security events log of AD from 70 domain controllers for just 4 whitelisted events and dropping static text by regex in config file and the count is 500gb avg. everyday.

In Azure sentinel when we ingest the same data i mean like ingest these 4 events by Azure sentinel connector from our domain controllers the amount/size of logs is just 10gb.

i am surprised and want to know what is the difference in terms of logs ingestion or processing that there is so huge difference in terms of size.

Tags (2)
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

  Alongside the announcement of the GA of Edge Processor, we are also excited to announce the General ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...