We are looking to integrate Splunk SIEM with our microservice, we are looking to send events from service to Splunk and then configure alerts based on eventType.  As we understand there are 2 approaches Universal Log forwarder and HTTP Event collector. We are inclining more towards using HEC as it has the ability to send ack for events as well and challenge with Universal Log forwarder is that it needs to be managed by customer where Splunk will be running and volume of the events is also not that much. Can someone help us in understanding cost involved in both approaches and scaling of HEC is number of events increases due to a spike. Also should we go with building a Technology Add-on or app which can be used along with Splunk Enterprise Security. We want to implement this for Enterprise as well as Cloud. #SplunkAddOnbuilder ... View more