Below is the list of blog posts with the “Splunk” tag.

Log fan-out, also called dual-shipping, sends one copy of each event to two or more SIEMs from a single collection point. Teams do it during SIEM migrations, when an MSSP and an internal SOC both need raw events, for compliance archives, and for regional SIEMs with different regulatory scope. Do the split at the agent or at a relay. A second forwarder on every host doubles your configuration work and gives you two event counts that do not match.

Short answer: Splunk meters the raw bytes that reach its indexing pipeline, so you reduce Splunk ingest cost by stopping low-value data before that point. Fix noisy audit policies at the source, filter events by ID and pattern at the endpoint, remove fields you don’t search, collapse repeats, and route archive-only telemetry data to cheaper storage. Compression alone does not lower the meter. Splunk bills climb because every event arrives at full size, including the ones nobody searches.

NXLog Agent supports filtering, enriching, and forwarding logs directly to Splunk Enterprise for further analysis. If you landed on this blog post, you are likely looking for a new log collection solution or seeking to improve an existing Splunk deployment. If so, we hope this article provides you with the information you need to take the next step toward a better log collection strategy. NXLog Agent and Splunk Universal Forwarder feature comparison Several log collection agents are available on the market, and Splunk Universal Forwarder is one of them.

NXLog supports direct collection of Event Tracing for Windows (ETW) data. DNS Analytical logs, for example, can be forwarded to Splunk or another SIEM for monitoring and analysis. Collecting ETW Logs Event Tracing for Windows (ETW) is a kernel-level tracing facility that provides high-performance logging of kernel and application events. ETW events can be written to a log file or collected directly from the system in realtime via the Consumers API.