We rolled SASE out this year and our Splunk ingest went through the roof. All the flow logs, url and dns, the lot, straight into the indexers. Ingest went from about 250 to 480 gig a day and the renewal quote reflected it. And guess what, finance is definitely not happy.
Source: r/Splunk · by /u/Friendly-Rooster-819