We're looking for real-life experience on behalf of a client in integrating QRadar data into Splunk ES, or Splunk/Splunk ES into QRadar or both into a 3rd option for PA/SA. This client has one of the largest and most complex networks among the federal agencies, currently is using both products in differing areas, and is looking for the best way forward, enterprise-wide.
The vendors have been telling us that it can work either way, but we have yet to see a live case of this, and we've been looking for specifics on how to make this work, and work well. We don't have a dog in this fight, we just want the solution that makes the best sense, given the considerable sums already spent on both solutions, and the size and complexity of the networks involved.
If you're a taxpayer, here's a chance to help save a lot of time and money.
Appreciatively,
Barry
