Right that’s my point. Licenses for log ingestion with Splunk are $$$$. As opposed to rolling your own (and probably not passing an audit)

> and probably not passing an audit

What kind of audit one might not pass? People use all kind of log solution all the time without any problems.

Anything have to do with RMF

What's RMF?

NIST Risk Management Framework.