Short answer: Splunk meters the raw bytes that reach its indexing pipeline, so you reduce Splunk ingest cost by stopping low-value data before that point. Fix noisy audit policies at the source, filter events by ID and pattern at the endpoint, remove fields you don’t search, collapse repeats, and route archive-only telemetry data to cheaper storage. Compression alone does not lower the meter. Splunk bills climb because every event arrives at full size, including the ones nobody searches.

Kubernetes DaemonSet log collection runs one log-collector pod on every node in your cluster. The collector reads all container logs from the node’s /var/log/containers directory through read-only hostPath mounts and forwards them to your SIEM, with no changes to your application pods. When the cluster adds a node, the DaemonSet adds a collector, so coverage scales automatically. This guide shows you how the pattern works, how Kubernetes writes container logs in 2026, and how to deploy NXLog Agent as a DaemonSet that ships container and audit logs to Microsoft Sentinel or Splunk.

The major Linux distributions write their logs to the systemd journal: a binary, indexed, local-first store. However, your SIEM and collectors still expect syslog, which has been the plain text, line-oriented, network-native standard for more than four decades. If you run SecOps, you have to bridge that gap on every Linux host you monitor, and the obvious-looking switch, ForwardToSyslog=yes, moves nothing off the host by itself. Quick answer: how to forward journald to syslog?

Key takeaways Container logs share the container’s lifecycle. The Kubernetes documentation states that when a pod is evicted from a node, it removes the containers along with their logs. Container lifespans keep shrinking. Sysdig’s 2025 Cloud-Native Security and Usage Report found that 60% of containers live for 60 seconds or less. Collection has to be continuous, not scheduled. A node-level agent (a DaemonSet on Kubernetes) covers every container on a node without changing your applications.

The market has already answered whether telemetry is infrastructure. Cisco paid $28 billion for Splunk. Twelve days apart in 2025, CrowdStrike bought Spain’s Onum and SentinelOne moved to acquire Observo AI, both to embed AI-driven data pipelines directly beneath their platforms, while AI-native pipeline startups keep raising eight-figure rounds on the same thesis. When the largest names in security spend that kind of capital on the layer that collects, filters, and routes data, they are conceding something they rarely say out loud: detection, response, and every AI capability stacked on top are only ever as good as the pipeline underneath.

Offline buffering is a log shipper’s ability to store events in memory or on disk while the destination is unreachable, then forward them automatically once the connection recovers. Without it, every SIEM outage, network partition, or agent restart becomes a permanent gap in your security telemetry. Every SIEM eventually goes down. So does the WAN link to your central collector, and eventually the host running the agent itself. None of these events should cost you log data, but whether they do depends on how your log shipper buffers when it can’t deliver data to the destination.