Right that’s my point. Licenses for log ingestion with Splunk are $$$$. As opposed to rolling your own (and probably not passing an audit)

> and probably not passing an audit

What kind of audit one might not pass? People use all kind of log solution all the time without any problems.