We use Splunk with lots of redundancy (ie. multiple forwarders, indexers and search heads per site). I'd probably use Graylog or some ELK stack variation thoug

We use Splunk with lots of redundancy (ie. multiple forwarders, indexers and search heads per site). I'd probably use Graylog or some ELK stack variation though if our client would let us, since Splunk is $$$.