{"id":20243,"date":"2024-09-26T11:14:12","date_gmt":"2024-09-26T09:14:12","guid":{"rendered":"https:\/\/weare.fi\/?p=20243"},"modified":"2026-09-23T12:35:04","modified_gmt":"2026-09-23T10:35:04","slug":"log-management-101-tools-best-practices-and-splunk","status":"publish","type":"post","link":"https:\/\/weare.fi\/en\/log-management-101-tools-best-practices-and-splunk\/","title":{"rendered":"Log Management 101: Tools, Best Practices and Splunk"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"20243\" class=\"elementor elementor-20243\" data-elementor-settings=\"{&quot;ha_cmc_init_switcher&quot;:&quot;no&quot;}\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-30a7f79f elementor-section-content-middle elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"30a7f79f\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;,&quot;motion_fx_opacity_range&quot;:{&quot;unit&quot;:&quot;%&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:{&quot;start&quot;:20,&quot;end&quot;:30}},&quot;sticky&quot;:&quot;top&quot;,&quot;motion_fx_motion_fx_scrolling&quot;:&quot;yes&quot;,&quot;motion_fx_opacity_effect&quot;:&quot;yes&quot;,&quot;_ha_eqh_enable&quot;:false,&quot;motion_fx_opacity_direction&quot;:&quot;out-in&quot;,&quot;motion_fx_opacity_level&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:10,&quot;sizes&quot;:[]},&quot;motion_fx_devices&quot;:[&quot;desktop&quot;,&quot;tablet_extra&quot;,&quot;tablet&quot;,&quot;mobile_extra&quot;,&quot;mobile&quot;],&quot;sticky_on&quot;:[&quot;desktop&quot;,&quot;tablet_extra&quot;,&quot;tablet&quot;,&quot;mobile_extra&quot;,&quot;mobile&quot;],&quot;sticky_offset&quot;:0,&quot;sticky_effects_offset&quot;:0,&quot;sticky_anchor_link_offset&quot;:0}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-25 elementor-top-column elementor-element elementor-element-338c91c9\" data-id=\"338c91c9\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-395c126a elementor-widget elementor-widget-theme-site-logo elementor-widget-image\" data-id=\"395c126a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"theme-site-logo.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/weare.fi\/en\">\n\t\t\t<img decoding=\"async\" width=\"429\" height=\"89\" src=\"https:\/\/weare.fi\/wp-content\/uploads\/2021\/10\/pieni_logo_horiso@2x-78x16.png\" class=\"attachment-full size-full wp-image-2197\" alt=\"\" srcset=\"https:\/\/weare.fi\/wp-content\/uploads\/2021\/10\/pieni_logo_horiso@2x.png 429w, https:\/\/weare.fi\/wp-content\/uploads\/2021\/10\/pieni_logo_horiso@2x-300x62.png 300w, https:\/\/weare.fi\/wp-content\/uploads\/2021\/10\/pieni_logo_horiso@2x-18x4.png 18w, https:\/\/weare.fi\/wp-content\/uploads\/2021\/10\/pieni_logo_horiso@2x-78x16.png 78w\" sizes=\"(max-width: 429px) 100vw, 429px\" \/>\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-25 elementor-top-column elementor-element elementor-element-7427e1f7\" data-id=\"7427e1f7\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-3d3265b8 elementor-nav-menu__align-end header elementor-nav-menu--dropdown-tablet_extra elementor-hidden-tablet_extra elementor-hidden-tablet elementor-hidden-mobile_extra elementor-hidden-mobile elementor-nav-menu__text-align-aside elementor-nav-menu--toggle elementor-nav-menu--burger elementor-widget elementor-widget-nav-menu\" data-id=\"3d3265b8\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;submenu_icon&quot;:{&quot;value&quot;:&quot;&lt;i class=\\&quot;fas fa-chevron-down\\&quot; aria-hidden=\\&quot;true\\&quot;&gt;&lt;\\\/i&gt;&quot;,&quot;library&quot;:&quot;fa-solid&quot;},&quot;layout&quot;:&quot;horizontal&quot;,&quot;toggle&quot;:&quot;burger&quot;}\" data-widget_type=\"nav-menu.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t<nav aria-label=\"Menu\" class=\"elementor-nav-menu--main elementor-nav-menu__container elementor-nav-menu--layout-horizontal e--pointer-none\">\n\t\t\t\t<ul id=\"menu-1-3d3265b8\" class=\"elementor-nav-menu\"><li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-16592\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/splunk-konsultointipalvelut\/\" class=\"elementor-item menu-link\">Splunk<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-25551\"><a href=\"https:\/\/weare.fi\/en\/splunk-enterprise-pricing\/\" class=\"elementor-sub-item menu-link\">Splunk Enterprice Pricing<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-24023\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/splunk-konsultointipalvelut\/observability\/\" class=\"elementor-item menu-link\">Observability<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-19823\"><a href=\"https:\/\/weare.fi\/en\/splunk-konsultointipalvelut\/observability-as-a-service\/\" class=\"elementor-sub-item menu-link\">Observointi palveluna<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-21974\"><a href=\"https:\/\/weare.fi\/en\/palvelut\/weare-observability-hub\/\" class=\"elementor-sub-item menu-link\">Observability Hub<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-24069\"><a href=\"https:\/\/weare.fi\/en\/free-observability-maturity-assessment\/\" class=\"elementor-sub-item menu-link\">Free Observability Maturity Assessment<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-25944\"><a href=\"https:\/\/weare.fi\/en\/observability-e-book-full-visibility-in-distributed-architecture\/\" class=\"elementor-sub-item menu-link\">Observability Playbook<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-23594\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/atlassian-solutions-consulting-services\/\" class=\"elementor-item menu-link\">Atlassian<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-23595\"><a href=\"https:\/\/weare.fi\/en\/atlassian-solutions-consulting-services\/jira-consulting\/\" class=\"elementor-sub-item menu-link\">Jira Services<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-19720\"><a href=\"https:\/\/weare.fi\/en\/asiakastarinat\/\" class=\"elementor-item menu-link\">Asiakastarinat<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-2467\"><a href=\"https:\/\/weare.fi\/en\/uutiset\/\" class=\"elementor-item menu-link\">Blogs<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-12800\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/meista\/\" class=\"elementor-item menu-link\">Meist\u00e4<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-11982\"><a href=\"https:\/\/careers.weare.fi\/\" class=\"elementor-sub-item menu-link\">Rekrytointi<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-2753\"><a href=\"https:\/\/weare.fi\/en\/meista\/yritysvastuullisuus\/\" class=\"elementor-sub-item menu-link\">Yritysvastuullisuus<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\t\t\t<\/nav>\n\t\t\t\t\t<div class=\"elementor-menu-toggle\" role=\"button\" tabindex=\"0\" aria-label=\"Menu Toggle\" aria-expanded=\"false\">\n\t\t\t<i aria-hidden=\"true\" role=\"presentation\" class=\"elementor-menu-toggle__icon--open eicon-menu-bar\"><\/i><i aria-hidden=\"true\" role=\"presentation\" class=\"elementor-menu-toggle__icon--close eicon-close\"><\/i>\t\t<\/div>\n\t\t\t\t\t<nav class=\"elementor-nav-menu--dropdown elementor-nav-menu__container\" aria-hidden=\"true\">\n\t\t\t\t<ul id=\"menu-2-3d3265b8\" class=\"elementor-nav-menu\"><li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-16592\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/splunk-konsultointipalvelut\/\" class=\"elementor-item menu-link\" tabindex=\"-1\">Splunk<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-25551\"><a href=\"https:\/\/weare.fi\/en\/splunk-enterprise-pricing\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Splunk Enterprice Pricing<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-24023\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/splunk-konsultointipalvelut\/observability\/\" class=\"elementor-item menu-link\" tabindex=\"-1\">Observability<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-19823\"><a href=\"https:\/\/weare.fi\/en\/splunk-konsultointipalvelut\/observability-as-a-service\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Observointi palveluna<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-21974\"><a href=\"https:\/\/weare.fi\/en\/palvelut\/weare-observability-hub\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Observability Hub<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-24069\"><a href=\"https:\/\/weare.fi\/en\/free-observability-maturity-assessment\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Free Observability Maturity Assessment<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-25944\"><a href=\"https:\/\/weare.fi\/en\/observability-e-book-full-visibility-in-distributed-architecture\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Observability Playbook<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-23594\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/atlassian-solutions-consulting-services\/\" class=\"elementor-item menu-link\" tabindex=\"-1\">Atlassian<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-23595\"><a href=\"https:\/\/weare.fi\/en\/atlassian-solutions-consulting-services\/jira-consulting\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Jira Services<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-19720\"><a href=\"https:\/\/weare.fi\/en\/asiakastarinat\/\" class=\"elementor-item menu-link\" tabindex=\"-1\">Asiakastarinat<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-2467\"><a href=\"https:\/\/weare.fi\/en\/uutiset\/\" class=\"elementor-item menu-link\" tabindex=\"-1\">Blogs<\/a><\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-12800\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/meista\/\" class=\"elementor-item menu-link\" tabindex=\"-1\">Meist\u00e4<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-11982\"><a href=\"https:\/\/careers.weare.fi\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Rekrytointi<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-2753\"><a href=\"https:\/\/weare.fi\/en\/meista\/yritysvastuullisuus\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Yritysvastuullisuus<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\t\t\t<\/nav>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1cdb4865 elementor-nav-menu__align-end header elementor-nav-menu--dropdown-tablet_extra elementor-hidden-desktop elementor-nav-menu--stretch elementor-nav-menu__text-align-aside elementor-nav-menu--toggle elementor-nav-menu--burger elementor-widget elementor-widget-nav-menu\" data-id=\"1cdb4865\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;submenu_icon&quot;:{&quot;value&quot;:&quot;&lt;i class=\\&quot;fas fa-chevron-down\\&quot; aria-hidden=\\&quot;true\\&quot;&gt;&lt;\\\/i&gt;&quot;,&quot;library&quot;:&quot;fa-solid&quot;},&quot;full_width&quot;:&quot;stretch&quot;,&quot;layout&quot;:&quot;horizontal&quot;,&quot;toggle&quot;:&quot;burger&quot;}\" data-widget_type=\"nav-menu.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t<nav aria-label=\"Menu\" class=\"elementor-nav-menu--main elementor-nav-menu__container elementor-nav-menu--layout-horizontal e--pointer-none\">\n\t\t\t\t<ul id=\"menu-1-1cdb4865\" class=\"elementor-nav-menu\"><li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-17209\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/splunk-konsultointipalvelut\/\" class=\"elementor-item menu-link\">Splunk<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-25724\"><a href=\"https:\/\/weare.fi\/en\/splunk-enterprise-pricing\/\" class=\"elementor-sub-item menu-link\">Splunk Enterprice Pricing<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-25727\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/splunk-konsultointipalvelut\/observability\/\" class=\"elementor-item menu-link\">Observability<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-25726\"><a href=\"https:\/\/weare.fi\/en\/splunk-konsultointipalvelut\/observability-as-a-service\/\" class=\"elementor-sub-item menu-link\">Observability as a Service<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-25725\"><a href=\"https:\/\/weare.fi\/en\/palvelut\/weare-observability-hub\/\" class=\"elementor-sub-item menu-link\">Observability Hub<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-25728\"><a href=\"https:\/\/weare.fi\/en\/free-observability-maturity-assessment\/\" class=\"elementor-sub-item menu-link\">Free Observability Maturity Assessment<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-25945\"><a href=\"https:\/\/weare.fi\/en\/observability-e-book-full-visibility-in-distributed-architecture\/\" class=\"elementor-sub-item menu-link\">Observability Playbook<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-23719\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/atlassian-solutions-consulting-services\/\" class=\"elementor-item menu-link\">Atlassian<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-23720\"><a href=\"https:\/\/weare.fi\/en\/atlassian-solutions-consulting-services\/jira-consulting\/\" class=\"elementor-sub-item menu-link\">Jira<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-2632\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/uutiset\/\" class=\"elementor-item menu-link\">Blogs<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-19721\"><a href=\"https:\/\/weare.fi\/en\/asiakastarinat\/\" class=\"elementor-sub-item menu-link\">Asiakastarinat<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-12801\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/meista\/\" class=\"elementor-item menu-link\">Meist\u00e4<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-11990\"><a href=\"https:\/\/careers.weare.fi\/\" class=\"elementor-sub-item menu-link\">Rekrytointi<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-4801\"><a href=\"https:\/\/weare.fi\/en\/meista\/yritysvastuullisuus\/\" class=\"elementor-sub-item menu-link\">Yritysvastuullisuus<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-13935\"><a href=\"https:\/\/weare.fi\/en\/ota-yhteytta\/\" class=\"elementor-item menu-link\">Ota yhteytt\u00e4<\/a><\/li>\n<li class=\"trp-language-switcher-container menu-item menu-item-type-post_type menu-item-object-language_switcher current-language-menu-item menu-item-2636\"><a href=\"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/posts\/20243#TRPLINKPROCESSED\" class=\"elementor-item elementor-item-anchor menu-link\"><span data-no-translation><img decoding=\"async\" class=\"trp-flag-image\" src=\"https:\/\/weare.fi\/wp-content\/plugins\/translatepress-multilingual\/assets\/images\/flags\/fi.png\" width=\"18\" height=\"12\" alt=\"fi\" title=\"Finnish\"><span class=\"trp-ls-language-name\">FI<\/span><\/span><\/a><\/li>\n<li class=\"trp-language-switcher-container menu-item menu-item-type-post_type menu-item-object-language_switcher current-language-menu-item menu-item-2634\"><a href=\"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/posts\/20243#TRPLINKPROCESSED\" class=\"elementor-item elementor-item-anchor menu-link\"><span data-no-translation><img decoding=\"async\" class=\"trp-flag-image\" src=\"https:\/\/weare.fi\/wp-content\/plugins\/translatepress-multilingual\/assets\/images\/flags\/en_GB.png\" width=\"18\" height=\"12\" alt=\"en_GB\" title=\"English\"><span class=\"trp-ls-language-name\">EN<\/span><\/span><\/a><\/li>\n<\/ul>\t\t\t<\/nav>\n\t\t\t\t\t<div class=\"elementor-menu-toggle\" role=\"button\" tabindex=\"0\" aria-label=\"Menu Toggle\" aria-expanded=\"false\">\n\t\t\t<i aria-hidden=\"true\" role=\"presentation\" class=\"elementor-menu-toggle__icon--open eicon-menu-bar\"><\/i><i aria-hidden=\"true\" role=\"presentation\" class=\"elementor-menu-toggle__icon--close eicon-close\"><\/i>\t\t<\/div>\n\t\t\t\t\t<nav class=\"elementor-nav-menu--dropdown elementor-nav-menu__container\" aria-hidden=\"true\">\n\t\t\t\t<ul id=\"menu-2-1cdb4865\" class=\"elementor-nav-menu\"><li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-17209\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/splunk-konsultointipalvelut\/\" class=\"elementor-item menu-link\" tabindex=\"-1\">Splunk<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-25724\"><a href=\"https:\/\/weare.fi\/en\/splunk-enterprise-pricing\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Splunk Enterprice Pricing<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-25727\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/splunk-konsultointipalvelut\/observability\/\" class=\"elementor-item menu-link\" tabindex=\"-1\">Observability<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-25726\"><a href=\"https:\/\/weare.fi\/en\/splunk-konsultointipalvelut\/observability-as-a-service\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Observability as a Service<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-25725\"><a href=\"https:\/\/weare.fi\/en\/palvelut\/weare-observability-hub\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Observability Hub<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-25728\"><a href=\"https:\/\/weare.fi\/en\/free-observability-maturity-assessment\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Free Observability Maturity Assessment<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-25945\"><a href=\"https:\/\/weare.fi\/en\/observability-e-book-full-visibility-in-distributed-architecture\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Observability Playbook<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-23719\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/atlassian-solutions-consulting-services\/\" class=\"elementor-item menu-link\" tabindex=\"-1\">Atlassian<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-23720\"><a href=\"https:\/\/weare.fi\/en\/atlassian-solutions-consulting-services\/jira-consulting\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Jira<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-2632\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/uutiset\/\" class=\"elementor-item menu-link\" tabindex=\"-1\">Blogs<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-19721\"><a href=\"https:\/\/weare.fi\/en\/asiakastarinat\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Asiakastarinat<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-12801\"><a aria-expanded=\"false\" href=\"https:\/\/weare.fi\/en\/meista\/\" class=\"elementor-item menu-link\" tabindex=\"-1\">Meist\u00e4<span role=\"button\" class=\"dropdown-menu-toggle ast-header-navigation-arrow\" tabindex=\"0\" aria-expanded=\"false\" aria-label=\"Menu Toggle\" aria-haspopup=\"true\"><\/span><span class=\"sub-arrow\"><i class=\"fas fa-chevron-down\" aria-hidden=\"true\"><\/i><\/span><\/a>\n<ul class=\"sub-menu elementor-nav-menu--dropdown\">\n\t<li class=\"menu-item menu-item-type-custom menu-item-object-custom menu-item-11990\"><a href=\"https:\/\/careers.weare.fi\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Rekrytointi<\/a><\/li>\n\t<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-4801\"><a href=\"https:\/\/weare.fi\/en\/meista\/yritysvastuullisuus\/\" class=\"elementor-sub-item menu-link\" tabindex=\"-1\">Yritysvastuullisuus<\/a><\/li>\n<\/ul>\n<\/li>\n<li class=\"menu-item menu-item-type-post_type menu-item-object-page menu-item-13935\"><a href=\"https:\/\/weare.fi\/en\/ota-yhteytta\/\" class=\"elementor-item menu-link\" tabindex=\"-1\">Ota yhteytt\u00e4<\/a><\/li>\n<li class=\"trp-language-switcher-container menu-item menu-item-type-post_type menu-item-object-language_switcher current-language-menu-item menu-item-2636\"><a href=\"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/posts\/20243#TRPLINKPROCESSED\" class=\"elementor-item elementor-item-anchor menu-link\" tabindex=\"-1\"><span data-no-translation><img decoding=\"async\" class=\"trp-flag-image\" src=\"https:\/\/weare.fi\/wp-content\/plugins\/translatepress-multilingual\/assets\/images\/flags\/fi.png\" width=\"18\" height=\"12\" alt=\"fi\" title=\"Finnish\"><span class=\"trp-ls-language-name\">FI<\/span><\/span><\/a><\/li>\n<li class=\"trp-language-switcher-container menu-item menu-item-type-post_type menu-item-object-language_switcher current-language-menu-item menu-item-2634\"><a href=\"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/posts\/20243#TRPLINKPROCESSED\" class=\"elementor-item elementor-item-anchor menu-link\" tabindex=\"-1\"><span data-no-translation><img decoding=\"async\" class=\"trp-flag-image\" src=\"https:\/\/weare.fi\/wp-content\/plugins\/translatepress-multilingual\/assets\/images\/flags\/en_GB.png\" width=\"18\" height=\"12\" alt=\"en_GB\" title=\"English\"><span class=\"trp-ls-language-name\">EN<\/span><\/span><\/a><\/li>\n<\/ul>\t\t\t<\/nav>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-25 elementor-top-column elementor-element elementor-element-159d77ef elementor-hidden-mobile\" data-id=\"159d77ef\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-38e99ce6 elementor-hidden-tablet_extra elementor-hidden-tablet elementor-hidden-mobile_extra elementor-hidden-mobile elementor-widget elementor-widget-button\" data-id=\"38e99ce6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"\/ota-yhteytta\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Ota yhteytt\u00e4<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-25 elementor-top-column elementor-element elementor-element-52e0c118 elementor-hidden-mobile\" data-id=\"52e0c118\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-e079aea elementor-nav-menu__align-center elementor-hidden-tablet_extra elementor-hidden-tablet elementor-hidden-mobile_extra elementor-hidden-mobile elementor-nav-menu--dropdown-tablet elementor-nav-menu__text-align-aside elementor-widget elementor-widget-nav-menu\" data-id=\"e079aea\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;submenu_icon&quot;:{&quot;value&quot;:&quot;&lt;i class=\\&quot;fas fa-globe\\&quot; aria-hidden=\\&quot;true\\&quot;&gt;&lt;\\\/i&gt;&quot;,&quot;library&quot;:&quot;fa-solid&quot;},&quot;layout&quot;:&quot;horizontal&quot;}\" data-widget_type=\"nav-menu.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t<nav aria-label=\"Menu\" class=\"elementor-nav-menu--main elementor-nav-menu__container elementor-nav-menu--layout-horizontal e--pointer-none\">\n\t\t\t\t<ul id=\"menu-1-e079aea\" class=\"elementor-nav-menu\"><li class=\"trp-language-switcher-container menu-item menu-item-type-post_type menu-item-object-language_switcher current-language-menu-item menu-item-2418\"><a href=\"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/posts\/20243#TRPLINKPROCESSED\" class=\"elementor-item elementor-item-anchor menu-link\"><span data-no-translation><img decoding=\"async\" class=\"trp-flag-image\" src=\"https:\/\/weare.fi\/wp-content\/plugins\/translatepress-multilingual\/assets\/images\/flags\/en_GB.png\" width=\"18\" height=\"12\" alt=\"en_GB\" title=\"English\"><span class=\"trp-ls-language-name\">EN<\/span><\/span><\/a><\/li>\n<li class=\"trp-language-switcher-container menu-item menu-item-type-post_type menu-item-object-language_switcher current-language-menu-item menu-item-2420\"><a href=\"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/posts\/20243#TRPLINKPROCESSED\" class=\"elementor-item elementor-item-anchor menu-link\"><span data-no-translation><img decoding=\"async\" class=\"trp-flag-image\" src=\"https:\/\/weare.fi\/wp-content\/plugins\/translatepress-multilingual\/assets\/images\/flags\/fi.png\" width=\"18\" height=\"12\" alt=\"fi\" title=\"Finnish\"><span class=\"trp-ls-language-name\">FI<\/span><\/span><\/a><\/li>\n<\/ul>\t\t\t<\/nav>\n\t\t\t\t\t\t<nav class=\"elementor-nav-menu--dropdown elementor-nav-menu__container\" aria-hidden=\"true\">\n\t\t\t\t<ul id=\"menu-2-e079aea\" class=\"elementor-nav-menu\"><li class=\"trp-language-switcher-container menu-item menu-item-type-post_type menu-item-object-language_switcher current-language-menu-item menu-item-2418\"><a href=\"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/posts\/20243#TRPLINKPROCESSED\" class=\"elementor-item elementor-item-anchor menu-link\" tabindex=\"-1\"><span data-no-translation><img decoding=\"async\" class=\"trp-flag-image\" src=\"https:\/\/weare.fi\/wp-content\/plugins\/translatepress-multilingual\/assets\/images\/flags\/en_GB.png\" width=\"18\" height=\"12\" alt=\"en_GB\" title=\"English\"><span class=\"trp-ls-language-name\">EN<\/span><\/span><\/a><\/li>\n<li class=\"trp-language-switcher-container menu-item menu-item-type-post_type menu-item-object-language_switcher current-language-menu-item menu-item-2420\"><a href=\"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/posts\/20243#TRPLINKPROCESSED\" class=\"elementor-item elementor-item-anchor menu-link\" tabindex=\"-1\"><span data-no-translation><img decoding=\"async\" class=\"trp-flag-image\" src=\"https:\/\/weare.fi\/wp-content\/plugins\/translatepress-multilingual\/assets\/images\/flags\/fi.png\" width=\"18\" height=\"12\" alt=\"fi\" title=\"Finnish\"><span class=\"trp-ls-language-name\">FI<\/span><\/span><\/a><\/li>\n<\/ul>\t\t\t<\/nav>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-4b91cd6c elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"4b91cd6c\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;,&quot;shape_divider_bottom&quot;:&quot;tilt&quot;}\">\n\t\t\t\t\t<div class=\"elementor-shape elementor-shape-bottom\" aria-hidden=\"true\" data-negative=\"false\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 1000 100\" preserveAspectRatio=\"none\">\n\t<path class=\"elementor-shape-fill\" d=\"M0,6V0h1000v100L0,6z\"\/>\n<\/svg>\t\t<\/div>\n\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-60aa8fa0\" data-id=\"60aa8fa0\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-215e112 elementor-widget elementor-widget-spacer\" data-id=\"215e112\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-30b7c61a elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"30b7c61a\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-18b1490b\" data-id=\"18b1490b\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-54e11b elementor-widget elementor-widget-theme-post-featured-image elementor-widget-image\" data-id=\"54e11b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"theme-post-featured-image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"2560\" height=\"1280\" src=\"https:\/\/weare.fi\/wp-content\/uploads\/2024\/09\/6.png\" class=\"attachment-full size-full wp-image-23060\" alt=\"\" srcset=\"https:\/\/weare.fi\/wp-content\/uploads\/2024\/09\/6.png 2560w, https:\/\/weare.fi\/wp-content\/uploads\/2024\/09\/6-300x150.png 300w, https:\/\/weare.fi\/wp-content\/uploads\/2024\/09\/6-1024x512.png 1024w, https:\/\/weare.fi\/wp-content\/uploads\/2024\/09\/6-768x384.png 768w, https:\/\/weare.fi\/wp-content\/uploads\/2024\/09\/6-1536x768.png 1536w, https:\/\/weare.fi\/wp-content\/uploads\/2024\/09\/6-2048x1024.png 2048w, https:\/\/weare.fi\/wp-content\/uploads\/2024\/09\/6-18x9.png 18w, https:\/\/weare.fi\/wp-content\/uploads\/2024\/09\/6-600x300.png 600w\" sizes=\"(max-width: 2560px) 100vw, 2560px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7858caf2 elementor-share-buttons--skin-flat elementor-grid-3 elementor-share-buttons--view-icon elementor-share-buttons--shape-square elementor-share-buttons--color-official elementor-widget elementor-widget-share-buttons\" data-id=\"7858caf2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"share-buttons.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-grid\" role=\"list\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-grid-item\" role=\"listitem\">\n\t\t\t\t\t\t<div class=\"elementor-share-btn elementor-share-btn_facebook\" role=\"button\" tabindex=\"0\" aria-label=\"Share on facebook\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-share-btn__icon\">\n\t\t\t\t\t\t\t\t<i class=\"fab fa-facebook\" aria-hidden=\"true\"><\/i>\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-grid-item\" role=\"listitem\">\n\t\t\t\t\t\t<div class=\"elementor-share-btn elementor-share-btn_twitter\" role=\"button\" tabindex=\"0\" aria-label=\"Share on twitter\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-share-btn__icon\">\n\t\t\t\t\t\t\t\t<i class=\"fab fa-twitter\" aria-hidden=\"true\"><\/i>\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-grid-item\" role=\"listitem\">\n\t\t\t\t\t\t<div class=\"elementor-share-btn elementor-share-btn_linkedin\" role=\"button\" tabindex=\"0\" aria-label=\"Share on linkedin\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-share-btn__icon\">\n\t\t\t\t\t\t\t\t<i class=\"fab fa-linkedin\" aria-hidden=\"true\"><\/i>\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6fc94dd elementor-hidden-desktop elementor-hidden-tablet_extra elementor-hidden-tablet elementor-hidden-mobile_extra elementor-widget elementor-widget-spacer\" data-id=\"6fc94dd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-26cd67c elementor-widget elementor-widget-spacer\" data-id=\"26cd67c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-48a28600 elementor-widget elementor-widget-theme-post-title elementor-page-title elementor-widget-heading\" data-id=\"48a28600\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"theme-post-title.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">Log Management 101: Tools, Best Practices and Splunk<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5c557567 elementor-align-center elementor-widget elementor-widget-post-info\" data-id=\"5c557567\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"post-info.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul class=\"elementor-inline-items elementor-icon-list-items elementor-post-info\">\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-repeater-item-b2a862d elementor-inline-item\" itemprop=\"author\">\n\t\t\t\t\t\t<a href=\"https:\/\/weare.fi\/en\/author\/ram-chhetri\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text elementor-post-info__item elementor-post-info__item--type-author\">\n\t\t\t\t\t\t\t\t\t\tRam\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t<li class=\"elementor-icon-list-item elementor-repeater-item-62990f6 elementor-inline-item\" itemprop=\"datePublished\">\n\t\t\t\t\t\t<a href=\"https:\/\/weare.fi\/en\/2024\/09\/26\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text elementor-post-info__item elementor-post-info__item--type-date\">\n\t\t\t\t\t\t\t\t\t\t<time>26\/09\/2024<\/time>\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5af03e2 elementor-hidden-mobile elementor-widget elementor-widget-spacer\" data-id=\"5af03e2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3fa053b elementor-widget elementor-widget-text-editor\" data-id=\"3fa053b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Most applications, servers, cloud platforms, databases and network devices produce or expose event data. These records can explain why a payment failed, who changed a configuration or when a service began to slow down.<\/span><\/p><p><span style=\"font-weight: 400;\">The challenge is making the right evidence available, trustworthy and searchable when someone needs it. Scattered files, missing events and inconsistent timestamps make investigations harder. Uncontrolled collection also creates storage costs without necessarily improving visibility.<\/span><\/p><p><span style=\"font-weight: 400;\">This guide explains how log management works, how the main tool categories fit together, and where Splunk supports operational analytics within a broader logging and archiving architecture.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-71c72cc elementor-widget elementor-widget-heading\" data-id=\"71c72cc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What is log management?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-59482e3 elementor-widget elementor-widget-text-editor\" data-id=\"59482e3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Log management is the coordinated practice of collecting, transporting, processing, storing, searching, monitoring, protecting and retaining log data throughout its lifecycle, including its eventual disposal.<\/b><span style=\"font-weight: 400;\"> It supports troubleshooting, security investigations, audits and business analysis.<\/span><\/p><p><span style=\"font-weight: 400;\">A log entry is typically a timestamped record of an event in a digital system. It might describe a successful sign-in, a database timeout, an API request or an administrator\u2019s action.<\/span><\/p><p><span style=\"font-weight: 400;\">Centralized log management brings records from multiple sources into a shared platform or governed pipeline. Centralization does not require every record to live in one physical location. It requires consistent ways to find, interpret, protect and manage the data.<\/span><\/p><p><span style=\"font-weight: 400;\">Consider a failed checkout. An application error alone may say little. Correlating it with a payment-provider timeout, database events and a recent configuration change can reveal the sequence behind the failure.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8826cd8 elementor-widget elementor-widget-heading\" data-id=\"8826cd8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Which logs should you collect?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f8707b3 elementor-widget elementor-widget-text-editor\" data-id=\"f8707b3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Begin with the questions your teams need to answer. Common sources include:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><b>Application logs:<\/b><span style=\"font-weight: 400;\"> errors, warnings, transactions and application-specific events.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><b>Infrastructure logs:<\/b><span style=\"font-weight: 400;\"> operating-system activity, processes, authentication and system changes.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><b>Cloud and platform logs:<\/b><span style=\"font-weight: 400;\"> cloud audit events, Kubernetes activity and managed-service events.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><b>Network logs:<\/b><span style=\"font-weight: 400;\"> firewall decisions, DNS activity, VPN connections and traffic flows.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><b>Security and identity logs:<\/b><span style=\"font-weight: 400;\"> sign-ins, access decisions, privilege changes and endpoint detections.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><b>Database and audit logs:<\/b><span style=\"font-weight: 400;\"> administrative actions, schema changes and selected database activity.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><b>Web, API and business-event logs:<\/b><span style=\"font-weight: 400;\"> requests, response codes, orders, payments and process outcomes.<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">For each source, identify an owner, expected volume, sensitivity, investigation value and retention requirement. Avoid assuming that all available data needs continuous indexing or the same storage policy.<\/span><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e476a41 elementor-widget elementor-widget-heading\" data-id=\"e476a41\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Why log management matters<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9e5b9d0 elementor-widget elementor-widget-heading\" data-id=\"9e5b9d0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Faster investigations<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6e52fc2 elementor-widget elementor-widget-text-editor\" data-id=\"6e52fc2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">A common search environment reduces the effort spent locating evidence across servers and team-owned tools. Consistent fields and correlation identifiers help responders reconstruct events across services and distinguish a symptom from its underlying cause.<\/span><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cb75769 elementor-widget elementor-widget-heading\" data-id=\"cb75769\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Better security visibility<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d837f1e elementor-widget elementor-widget-text-editor\" data-id=\"d837f1e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Suspicious activity often spans several systems. A sign-in, privilege change and unusual data transfer may look ordinary in isolation. Together, they can justify investigation. Missing sources or inconsistent parsing can leave gaps in that sequence.<\/span><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-49808b1 elementor-widget elementor-widget-heading\" data-id=\"49808b1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Stronger audit evidence<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4ca4712 elementor-widget elementor-widget-text-editor\" data-id=\"4ca4712\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Logs help establish who acted, what changed, and when. Their usefulness depends on controlled access, reliable timestamps, documented data lineage, and evidence that relevant events reached their intended destination. Retention and immutability are parts of that design, rather than proof of compliance by themselves.<\/span><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-551e284 elementor-widget elementor-widget-heading\" data-id=\"551e284\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Clearer service and business impact<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-77a142f elementor-widget elementor-widget-text-editor\" data-id=\"77a142f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Technical events can expose failed orders, slow authentication and broken integrations. Connecting them to service metrics helps teams prioritize issues by customer impact. Reliable log data also supports automation and AI-assisted investigation, provided its quality and limitations are understood.<\/span><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d14e082 elementor-widget elementor-widget-heading\" data-id=\"d14e082\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Log management, log monitoring, observability and SIEM - what\u2019s the difference?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1e373aa elementor-widget elementor-widget-text-editor\" data-id=\"1e373aa\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">These capabilities overlap, but their purposes differ.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-abc8568 elementor-widget elementor-widget-html\" data-id=\"abc8568\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<section class=\"weare-agent-table\">\n  <div class=\"weare-agent-table__inner\">\n\n    <table>\n      <thead>\n        <tr>\n          <th>Agent<\/th>\n          <th>Responsibility<\/th>\n        <\/tr>\n      <\/thead>\n\n      <tbody>\n        <tr>\n          <td><strong>Product owner<\/strong><\/td>\n          <td>\n            Reads the selected ticket, adds acceptance criteria and technical context,\n            and checks whether the task suits the agent workflow.\n          <\/td>\n        <\/tr>\n\n        <tr>\n          <td><strong>Developer<\/strong><\/td>\n          <td>\n            Implements the change on a separate branch, runs checks, and opens a pull\n            request in Bitbucket.\n          <\/td>\n        <\/tr>\n\n        <tr>\n          <td><strong>Reviewer<\/strong><\/td>\n          <td>\n            Checks the proposed code against the requirements and posts review comments.\n          <\/td>\n        <\/tr>\n\n        <tr>\n          <td><strong>Tester<\/strong><\/td>\n          <td>\n            Starts the application and tests the changed user flow in a browser.\n          <\/td>\n        <\/tr>\n      <\/tbody>\n    <\/table>\n\n  <\/div>\n<\/section>\n\n<style>\n  .weare-agent-table,\n  .weare-agent-table * {\n    box-sizing: border-box;\n    font-family: \"Raleway\", sans-serif;\n  }\n\n  .weare-agent-table {\n    width: 100%;\n    background: #FFFFFF;\n    padding: 32px 20px;\n  }\n\n  .weare-agent-table__inner {\n    max-width: 1180px;\n    margin: 0 auto;\n  }\n\n  .weare-agent-table table {\n    width: 100%;\n    border-collapse: collapse;\n    table-layout: fixed;\n    color: #000000;\n    background: #FFFFFF;\n  }\n\n  .weare-agent-table th,\n  .weare-agent-table td {\n    border: 1px solid #000000;\n    text-align: left;\n    vertical-align: middle;\n    color: #000000;\n  }\n\n  .weare-agent-table th {\n    background: #F4F4F6;\n    font-size: 20px;\n    font-weight: 700;\n    line-height: 1.4;\n    padding: 34px 32px;\n  }\n\n  .weare-agent-table td {\n    font-size: 18px;\n    font-weight: 400;\n    line-height: 1.6;\n    padding: 30px 32px;\n  }\n\n  .weare-agent-table td strong {\n    font-weight: 700;\n    color: #000000;\n  }\n\n  .weare-agent-table th:first-child,\n  .weare-agent-table td:first-child {\n    width: 35%;\n  }\n\n  .weare-agent-table th:last-child,\n  .weare-agent-table td:last-child {\n    width: 65%;\n  }\n\n  @media (max-width: 700px) {\n    .weare-agent-table {\n      padding: 24px 16px;\n      overflow-x: auto;\n    }\n\n    .weare-agent-table table {\n      min-width: 680px;\n    }\n\n    .weare-agent-table th {\n      font-size: 18px;\n      padding: 24px 22px;\n    }\n\n    .weare-agent-table td {\n      font-size: 16px;\n      padding: 24px 22px;\n    }\n  }\n<\/style>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-069b979 elementor-widget elementor-widget-text-editor\" data-id=\"069b979\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Metrics show trends and changes. Traces follow requests across services. Logs provide event-level detail. Correlating these signals helps teams move from a service-level symptom to the relevant evidence.<\/span><\/p><p><span style=\"font-weight: 400;\">A security information and event management platform, or SIEM, adds security-focused analytics and workflows. Its effectiveness still depends on the coverage, quality and governance of the underlying data.<\/span><\/p><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9d6c76a elementor-widget elementor-widget-image\" data-id=\"9d6c76a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/weare.fi\/wp-content\/uploads\/2026\/09\/log-management-graphic-1024x576.png\" class=\"attachment-large size-large wp-image-27626\" alt=\"Log Management Lifecycle\" srcset=\"https:\/\/weare.fi\/wp-content\/uploads\/2026\/09\/log-management-graphic-1024x576.png 1024w, https:\/\/weare.fi\/wp-content\/uploads\/2026\/09\/log-management-graphic-300x169.png 300w, https:\/\/weare.fi\/wp-content\/uploads\/2026\/09\/log-management-graphic-768x432.png 768w, https:\/\/weare.fi\/wp-content\/uploads\/2026\/09\/log-management-graphic-1536x864.png 1536w, https:\/\/weare.fi\/wp-content\/uploads\/2026\/09\/log-management-graphic-18x10.png 18w, https:\/\/weare.fi\/wp-content\/uploads\/2026\/09\/log-management-graphic.png 1920w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-07f775a elementor-widget elementor-widget-heading\" data-id=\"07f775a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How the log management lifecycle works<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fbec428 elementor-widget elementor-widget-heading\" data-id=\"fbec428\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">1. Define outcomes and ownership<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-edbf983 elementor-widget elementor-widget-text-editor\" data-id=\"edbf983\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Agree on priority services, investigation scenarios and audit requirements. Assign responsibility for the source, pipeline, platform and response. Define success in practical terms: finding a failed transaction, detecting missing audit events or retrieving an archived record within an agreed timeframe.<\/span><\/p><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-deb165d elementor-widget elementor-widget-heading\" data-id=\"deb165d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">2. Generate useful events<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7a5f5dc elementor-widget elementor-widget-text-editor\" data-id=\"7a5f5dc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Where you control the source, establish a logging standard. Useful fields normally include:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Timestamp with an explicit timezone.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Service, application and environment identifiers.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Event type, severity and outcome.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">An unambiguous message and relevant error details.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Request, transaction or trace identifiers where available.<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">Structured formats such as JSON simplify automated interpretation. Stable field names and meaningful values matter more than format alone. A consistently structured event that says only \u201csomething failed\u201d still provides little diagnostic value.<\/span><\/p><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2b3816d elementor-widget elementor-widget-heading\" data-id=\"2b3816d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">3. Collect and transport reliably<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0fecb4b elementor-widget elementor-widget-text-editor\" data-id=\"0fecb4b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Collection options include agents, forwarders, syslog receivers, APIs, cloud integrations, and event streams. Splunk HTTP Event Collector, or HEC, provides an HTTP-based ingestion interface.<\/span><\/p><p><span style=\"font-weight: 400;\">Buffering absorbs temporary bursts, while backpressure helps manage downstream congestion. Neither guarantees delivery. Depending on the integration, reliability also requires persistent queues, acknowledgements, retries, duplicate handling and a dead-letter destination for events that cannot be processed.<\/span><\/p><p><span style=\"font-weight: 400;\">Document where an acknowledgement occurs: receipt by a collector is not necessarily confirmation that the final destination stored the event. Test outages, restarts and queue exhaustion, including how operators recover rejected data.<\/span><\/p><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-48a1527 elementor-widget elementor-widget-heading\" data-id=\"48a1527\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">4. Parse, enrich and normalize<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d9c9c2c elementor-widget elementor-widget-text-editor\" data-id=\"d9c9c2c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Extract fields such as service, host, user, severity and outcome. Add context such as application ownership or asset criticality where useful.<\/span><\/p><p><span style=\"font-weight: 400;\">Normalization establishes shared meaning across different source formats. In Splunk, the Common Information Model, or CIM, provides common field conventions and data models for compatible searches and content. A source still needs the appropriate mappings; ingestion alone does not make it CIM-compliant.<\/span><\/p><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-530b596 elementor-widget elementor-widget-heading\" data-id=\"530b596\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">5. Route and store intentionally<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9701b6c elementor-widget elementor-widget-text-editor\" data-id=\"9701b6c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Separate data that needs frequent interactive search from records held primarily for long-term retention. Govern filtering, masking and routing so that cost controls do not remove required evidence.<\/span><\/p><p><span style=\"font-weight: 400;\">Define retention and access rules by data category. Include how quickly older records must be retrieved, what restoration costs, and whether the retained format remains usable without the original application.<\/span><\/p><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a97e443 elementor-widget elementor-widget-heading\" data-id=\"a97e443\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">6. Investigate, alert and complete the lifecycle<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8d0e209 elementor-widget elementor-widget-text-editor\" data-id=\"8d0e209\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Use searches for investigation, dashboards for recurring questions and alerts for conditions requiring action. Each production alert needs an owner, severity, response path and supporting context.<\/span><\/p><p><span style=\"font-weight: 400;\">At the end of the applicable retention period, dispose of records according to approved policy, accounting for any valid holds. Include archive copies and exports in that policy; deleting an indexed copy does not necessarily delete the underlying record elsewhere.<\/span><\/p><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e5f7862 elementor-widget elementor-widget-heading\" data-id=\"e5f7862\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What does a centralized logging architecture look like?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1936984 elementor-widget elementor-widget-text-editor\" data-id=\"1936984\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">A practical architecture separates six responsibilities:<\/span><\/p><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a97e1f6 elementor-widget elementor-widget-html\" data-id=\"a97e1f6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<section class=\"weare-layer-table\">\n  <div class=\"weare-layer-table__inner\">\n\n    <table>\n      <thead>\n        <tr>\n          <th>Layer<\/th>\n          <th>Responsibility<\/th>\n          <th>Key design question<\/th>\n        <\/tr>\n      <\/thead>\n\n      <tbody>\n        <tr>\n          <td><strong>Sources<\/strong><\/td>\n          <td>Generate relevant events<\/td>\n          <td>Are required actions actually logged?<\/td>\n        <\/tr>\n\n        <tr>\n          <td><strong>Collection<\/strong><\/td>\n          <td>Receive and transport records<\/td>\n          <td>What happens during an interruption?<\/td>\n        <\/tr>\n\n        <tr>\n          <td><strong>Processing<\/strong><\/td>\n          <td>Parse, redact, enrich and route<\/td>\n          <td>Are transformations controlled and observable?<\/td>\n        <\/tr>\n\n        <tr>\n          <td><strong>Analytics<\/strong><\/td>\n          <td>Support search, correlation and alerting<\/td>\n          <td>Which records need fast access?<\/td>\n        <\/tr>\n\n        <tr>\n          <td><strong>Archive<\/strong><\/td>\n          <td>Preserve records for longer retention<\/td>\n          <td>Can records be located, restored and eventually deleted?<\/td>\n        <\/tr>\n\n        <tr>\n          <td><strong>Operations<\/strong><\/td>\n          <td>Manage access, changes and pipeline health<\/td>\n          <td>Who detects gaps and restores service?<\/td>\n        <\/tr>\n      <\/tbody>\n    <\/table>\n\n  <\/div>\n<\/section>\n\n<style>\n  .weare-layer-table,\n  .weare-layer-table * {\n    box-sizing: border-box;\n    font-family: \"Raleway\", sans-serif;\n  }\n\n  .weare-layer-table {\n    width: 100%;\n    background: #FFFFFF;\n    padding: 32px 20px;\n  }\n\n  .weare-layer-table__inner {\n    max-width: 1180px;\n    margin: 0 auto;\n  }\n\n  .weare-layer-table table {\n    width: 100%;\n    border-collapse: collapse;\n    table-layout: fixed;\n    background: #FFFFFF;\n    color: #000000;\n  }\n\n  .weare-layer-table th,\n  .weare-layer-table td {\n    border: 1px solid #000000;\n    text-align: left;\n    vertical-align: middle;\n    color: #000000;\n  }\n\n  .weare-layer-table th {\n    background: #F4F4F6;\n    font-size: 20px;\n    font-weight: 700;\n    line-height: 1.4;\n    padding: 30px 28px;\n  }\n\n  .weare-layer-table td {\n    font-size: 18px;\n    font-weight: 400;\n    line-height: 1.55;\n    padding: 28px;\n  }\n\n  .weare-layer-table td strong {\n    color: #000000;\n    font-weight: 700;\n  }\n\n  .weare-layer-table th:nth-child(1),\n  .weare-layer-table td:nth-child(1) {\n    width: 18%;\n  }\n\n  .weare-layer-table th:nth-child(2),\n  .weare-layer-table td:nth-child(2) {\n    width: 38%;\n  }\n\n  .weare-layer-table th:nth-child(3),\n  .weare-layer-table td:nth-child(3) {\n    width: 44%;\n  }\n\n  @media (max-width: 700px) {\n    .weare-layer-table {\n      padding: 24px 16px;\n      overflow-x: auto;\n    }\n\n    .weare-layer-table table {\n      min-width: 780px;\n    }\n\n    .weare-layer-table th {\n      font-size: 18px;\n      padding: 22px 20px;\n    }\n\n    .weare-layer-table td {\n      font-size: 16px;\n      padding: 22px 20px;\n    }\n  }\n<\/style>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0984d80 elementor-widget elementor-widget-text-editor\" data-id=\"0984d80\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Analytics and archive destinations can receive data through separate routes. Archiving does not always mean waiting for searchable data to expire and then moving it elsewhere.<\/span><\/p><p><span style=\"font-weight: 400;\">Document each route, its transformations and its failure behaviour. For audit data, establish how to reconcile source activity with destination records, using suitable counts, identifiers or other completeness checks. A healthy storage account cannot reveal events that never arrived.<\/span><\/p><\/div><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bb6c16d elementor-widget elementor-widget-heading\" data-id=\"bb6c16d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Log management best practices<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e5c67fc elementor-widget elementor-widget-heading\" data-id=\"e5c67fc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Protect data before it spreads<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9b3d1ef elementor-widget elementor-widget-text-editor\" data-id=\"9b3d1ef\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Avoid logging passwords, access tokens and unnecessary personal information. Apply minimization and redaction early, especially before routing records to several destinations. Restrict access to sensitive sources and audit use of the logging platform itself. The<\/span><span style=\"text-decoration: underline;\"><strong><a href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Logging_Cheat_Sheet.html\"> OWASP Logging Cheat Sheet<\/a><\/strong><\/span><span style=\"font-weight: 400;\"> provides practical guidance on event content, sensitive data and verification.<\/span><\/p><\/div><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e600060 elementor-widget elementor-widget-heading\" data-id=\"e600060\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Treat pipeline health as a production concern<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e96283e elementor-widget elementor-widget-text-editor\" data-id=\"e96283e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Monitor source freshness, ingestion delays, parsing failures, rejected events, queue utilisation and destination availability. Distinguish a quiet source from a broken integration by recording its expected behaviour. Assign an owner and response process to pipeline alerts.<\/span><\/p><\/div><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e374fdb elementor-widget elementor-widget-heading\" data-id=\"e374fdb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Design retention and immutability together<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bff401c elementor-widget elementor-widget-text-editor\" data-id=\"bff401c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">WORM means \u201cwrite once, read many.\u201d It can protect records against modification and deletion during an enforced retention period. That protection can also prevent an intended deletion, so reconcile privacy, retention, and legal-hold policies before data enters immutable storage.<\/span><\/p><\/div><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7918c79 elementor-widget elementor-widget-heading\" data-id=\"7918c79\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Verify the evidence, not just the storage<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a0a317c elementor-widget elementor-widget-text-editor\" data-id=\"a0a317c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Trustworthy audit evidence also depends on synchronized clocks, access auditing, controlled configuration changes and verified ingestion completeness. Record transformation rules and preserve the information needed to interpret events later. Test archive retrieval against realistic requests, including older formats and restricted-access records.<\/span><\/p><\/div><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-30f636e elementor-widget elementor-widget-heading\" data-id=\"30f636e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Measure cost and usefulness together<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c2d7396 elementor-widget elementor-widget-text-editor\" data-id=\"c2d7396\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Track volume and cost by source alongside search usage, investigation value and retention obligations. Include infrastructure, licensing, archive retrieval, network transfer and operating effort. Review noisy sources with their owners before changing collection rules, and validate that detections and audit requirements remain supported.<\/span><\/p><\/div><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ce11969 elementor-widget elementor-widget-html\" data-id=\"ce11969\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div style=\"background:#0f172a; border-radius:16px; padding:40px; color:#ffffff; font-family:Raleway, sans-serif; position:relative; overflow:hidden;\">\n\n  <!-- CONTENT -->\n  <div style=\"z-index:2; position:relative;\">\n    <h2 style=\"font-size:36px; line-height:1.2; font-weight:600; margin-bottom:16px; color:#ffffff; \">\n       Looking for out-of-the-box log management and archive solution? \n    <\/h2>\n\n    <a href=\"https:\/\/weare.fi\/en\/services-2\/weare-observability-hub\/log-management-and-archive\/\" \n       style=\"display:inline-flex; align-items:center; gap:10px; background:#f4b765; color:#0f172a; padding:14px 22px; border-radius:10px; text-decoration:none; font-weight:500; transition:all 0.2s ease;\">\n       \n    Yes! Show me Observability Hub\n      \n      <span style=\"display:inline-block; transform:translateY(1px);\">\n        \u2192\n      <\/span>\n    <\/a>\n  <\/div>\n\n  <!-- DECORATION -->\n  <div style=\"position:absolute; right:-60px; top:-60px; width:300px; height:300px; background: radial-gradient(circle, rgba(59, 130, 246, 0.4) 0%,#04065b 100%); filter:blur(40px);\"><\/div>\n\n  <div style=\"position:absolute; bottom:-80px; left:-80px; width:300px; height:300px; background:radial-gradient(circle, rgba(99,102,241,0.3), transparent 70%); filter:blur(50px);\"><\/div>\n\n<\/div>\n\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-54959e1 elementor-widget elementor-widget-heading\" data-id=\"54959e1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Which log management tools do you need?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7a5d203 elementor-widget elementor-widget-text-editor\" data-id=\"7a5d203\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">\u201cLog management tools\u201d describes several categories rather than one interchangeable product type.\u00a0<\/span><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9b4eade elementor-widget elementor-widget-html\" data-id=\"9b4eade\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<section class=\"weare-tool-table\">\n  <div class=\"weare-tool-table__inner\">\n\n    <table>\n      <thead>\n        <tr>\n          <th>Tool category<\/th>\n          <th>Main role<\/th>\n          <th>What to evaluate<\/th>\n        <\/tr>\n      <\/thead>\n\n      <tbody>\n        <tr>\n          <td><strong>Log analytics tools<\/strong><\/td>\n          <td>Search, correlate, and visualize event data<\/td>\n          <td>Query performance, parsing, access controls and investigation usability<\/td>\n        <\/tr>\n\n        <tr>\n          <td><strong>SIEM platforms<\/strong><\/td>\n          <td>Apply security analytics and investigation workflows<\/td>\n          <td>Detection content, normalization, security integrations and analyst workflows<\/td>\n        <\/tr>\n\n        <tr>\n          <td><strong>Observability platforms<\/strong><\/td>\n          <td>Connect telemetry to application and service health<\/td>\n          <td>Relationships between logs, metrics and traces, and troubleshooting context<\/td>\n        <\/tr>\n\n        <tr>\n          <td><strong>Data pipelines<\/strong><\/td>\n          <td>Collect, transform, buffer and route events<\/td>\n          <td>Delivery behaviour, persistent storage, processing controls and failure recovery<\/td>\n        <\/tr>\n\n        <tr>\n          <td><strong>Archive storage<\/strong><\/td>\n          <td>Retain records outside the primary analytics tier<\/td>\n          <td>Retention enforcement, immutability, retrieval time, portability and deletion controls<\/td>\n        <\/tr>\n      <\/tbody>\n    <\/table>\n\n  <\/div>\n<\/section>\n\n<style>\n  .weare-tool-table,\n  .weare-tool-table * {\n    box-sizing: border-box;\n    font-family: \"Raleway\", sans-serif;\n  }\n\n  .weare-tool-table {\n    width: 100%;\n    background: #FFFFFF;\n    padding: 32px 20px;\n  }\n\n  .weare-tool-table__inner {\n    max-width: 1180px;\n    margin: 0 auto;\n  }\n\n  .weare-tool-table table {\n    width: 100%;\n    border-collapse: collapse;\n    table-layout: fixed;\n    background: #FFFFFF;\n    color: #000000;\n  }\n\n  .weare-tool-table th,\n  .weare-tool-table td {\n    border: 1px solid #000000;\n    text-align: left;\n    vertical-align: middle;\n    color: #000000;\n  }\n\n  .weare-tool-table th {\n    background: #F4F4F6;\n    font-size: 20px;\n    font-weight: 700;\n    line-height: 1.4;\n    padding: 30px 28px;\n  }\n\n  .weare-tool-table td {\n    font-size: 18px;\n    font-weight: 400;\n    line-height: 1.55;\n    padding: 28px;\n  }\n\n  .weare-tool-table td strong {\n    color: #000000;\n    font-weight: 700;\n  }\n\n  .weare-tool-table th:nth-child(1),\n  .weare-tool-table td:nth-child(1) {\n    width: 20%;\n  }\n\n  .weare-tool-table th:nth-child(2),\n  .weare-tool-table td:nth-child(2) {\n    width: 31%;\n  }\n\n  .weare-tool-table th:nth-child(3),\n  .weare-tool-table td:nth-child(3) {\n    width: 49%;\n  }\n\n  @media (max-width: 700px) {\n    .weare-tool-table {\n      padding: 24px 16px;\n      overflow-x: auto;\n    }\n\n    .weare-tool-table table {\n      min-width: 820px;\n    }\n\n    .weare-tool-table th {\n      font-size: 18px;\n      padding: 22px 20px;\n    }\n\n    .weare-tool-table td {\n      font-size: 16px;\n      padding: 22px 20px;\n    }\n  }\n<\/style>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9d54b91 elementor-widget elementor-widget-text-editor\" data-id=\"9d54b91\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">These categories overlap. A platform may provide several capabilities, but their availability, limits, and commercial terms need evaluation separately. Archive storage, for example, does not necessarily offer the same interactive search experience as an analytics platform.<\/span><\/p><p><span style=\"font-weight: 400;\">Use representative data in a proof of concept. Test your important searches, peak ingestion, a destination outage, and archive recovery. Compare total operating cost and the skills needed to run the proposed architecture, rather than relying on feature lists alone.<\/span><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d4009aa elementor-widget elementor-widget-heading\" data-id=\"d4009aa\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Splunk supports log management<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-979fa5f elementor-widget elementor-widget-text-editor\" data-id=\"979fa5f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Splunk Enterprise and Splunk Cloud Platform support ingestion, indexing, searching, correlation, dashboards and alerting for machine data. Splunk Search Processing Language, or SPL, allows teams to turn events into investigation results and operational views.<\/span><\/p><p><span style=\"font-weight: 400;\">Splunk can work with varied source formats, including field extraction at search time. This flexibility does not eliminate the need to validate event boundaries, timestamps, source types and field quality.<\/span><\/p><p><span style=\"font-weight: 400;\">Implementation choices determine the result: source onboarding, index design, permissions, search workloads, retention and capacity all require ownership. Use Splunk Validated Architectures where applicable and check capabilities against the deployed product and version.<\/span><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9fd1d12 elementor-widget elementor-widget-heading\" data-id=\"9fd1d12\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Splunk retention versus external archiving<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-250d797 elementor-widget elementor-widget-text-editor\" data-id=\"250d797\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Splunk\u2019s own data lifecycle options and an external archive are distinct architectural choices.<\/span><\/p><p><span style=\"font-weight: 400;\">In <\/span><b>Splunk Enterprise<\/b><span style=\"font-weight: 400;\">, data reaching the frozen stage is deleted by default unless archiving is configured. Archived data must be restored to a searchable state for investigation; frozen does not mean immediately searchable. See<\/span><span style=\"text-decoration: underline;\"><strong><a href=\"https:\/\/help.splunk.com\/en\/data-management\/manage-splunk-enterprise-indexers\/9.3\/back-up-and-archive-your-indexes\/archive-indexed-data\"> Splunk\u2019s indexed-data archiving documentation<\/a>.<\/strong><\/span><\/p><p><b>Splunk Cloud Platform<\/b><span style=\"font-weight: 400;\"> has archive options whose availability and configuration depend on the service. For example, Splunk documents a managed archive option for expired data. Confirm entitlement, retention and restoration behaviour for the actual environment in the<\/span><span style=\"text-decoration: underline;\"><strong><a href=\"https:\/\/help.splunk.com\/en\/splunk-cloud-platform\/administer\/admin-manual\/10.5.2605\/manage-your-indexes-and-data-in-splunk-cloud-platform\/store-expired-splunk-cloud-platform-data-in-a-splunk-managed-archive\"> Cloud Platform archive documentation<\/a>.<\/strong><\/span><\/p><p><span style=\"font-weight: 400;\">An <\/span><b>external archive architecture<\/b><span style=\"font-weight: 400;\"> can instead route records to object storage independently of Splunk\u2019s index lifecycle. Its immutability, retention, access and recovery controls must be designed explicitly. Using Splunk for analytics does not automatically provide those controls for external copies.<\/span><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9a08e35 elementor-widget elementor-widget-heading\" data-id=\"9a08e35\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Case study: Splunk analytics with Azure-based archiving<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-41cfcb9 elementor-widget elementor-widget-text-editor\" data-id=\"41cfcb9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">For a financial-sector customer, WeAre combined Splunk operational analytics with Azure Storage for long-term immutable retention, using a Kafka-based integration layer.<\/span><\/p><p><span style=\"font-weight: 400;\">At publication, the project reported:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><b>Approximately 50 GB\/day ingested<\/b><span style=\"font-weight: 400;\"> across 15 integrated source systems.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><b>An architecture designed to scale toward 1 TB\/day.<\/b><span style=\"font-weight: 400;\"> This is a design target; the case does not report throughput testing at that level.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><b>\u201c10+1 years\u201d of immutable retention:<\/b><span style=\"font-weight: 400;\"> 10 years plus one additional year, or 11 years in total. This was a customer-specific requirement, not a universal retention rule.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><b>Approximately 80% compression for the archived raw dataset.<\/b><span style=\"font-weight: 400;\"> This result is specific to the data and implementation; it is not a guaranteed saving for other environments.<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">Splunk served operational search and analytics, while Azure WORM policies supported the customer\u2019s stated compliance requirements for long-term retention. The case illustrates a cost-conscious separation of analytics and archival responsibilities. Read the<\/span><span style=\"text-decoration: underline;\"><strong><a href=\"https:\/\/weare.fi\/en\/log-and-data-management-with-splunk-case-study\/\"> full log and data management case study<\/a>.<\/strong><\/span><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-38e210a elementor-widget elementor-widget-heading\" data-id=\"38e210a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How to get started<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2af22c4 elementor-widget elementor-widget-text-editor\" data-id=\"2af22c4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">Choose one important service and a small set of representative sources. Define the investigation questions, owners and retention requirements before expanding collection.<\/span><\/p><p><span style=\"font-weight: 400;\">Validate that you can follow a transaction, detect a missing source, recover from an ingestion interruption and retrieve an archived record. Document the working configuration and onboarding process so that subsequent sources follow a repeatable pattern.<\/span><\/p><p><span style=\"font-weight: 400;\">Review the results with operations, application, security and governance teams. Expand when the pipeline delivers usable evidence and its operating responsibilities are clear.<\/span><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e613087 elementor-widget elementor-widget-heading\" data-id=\"e613087\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">About WeAre<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5caff47 elementor-widget elementor-widget-text-editor\" data-id=\"5caff47\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"article-main__content\" data-test-id=\"publishing-text-block\"><p><span style=\"font-weight: 400;\">WeAre Solutions Oy is a Finnish observability-focused consultancy and a leading <\/span><a href=\"https:\/\/www.weare.fi\/en\/splunk-consulting-services\/\"><b><span style=\"text-decoration: underline;\">Splunk Elite Partner<\/span><\/b><\/a><span style=\"font-weight: 400;\"> in the Nordics. We specialize in observability and monitoring (using Splunk), Atlassian services (Jira), and software development. Founded in 2016 and headquartered in Helsinki, our mission is to turn observability into a competitive advantage for organizations.<\/span><\/p><p><span style=\"font-weight: 400;\">At WeAre, we help organizations assess their Splunk environments, identify improvement opportunities, and align performance with real business needs. You can start with an <\/span><span style=\"text-decoration: underline;\"><a href=\"https:\/\/www.weare.fi\/en\/free-observability-maturity-assessment\/\"><b>observability assessment<\/b><\/a><\/span><span style=\"font-weight: 400;\"> to understand your current state, or <\/span><span style=\"text-decoration: underline;\"><a href=\"https:\/\/www.weare.fi\/en\/contact-us\/\"><b>contact our team<\/b><\/a><\/span><span style=\"font-weight: 400;\"> for a free consultation.<\/span><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-2e8c3e4 e-flex e-con-boxed e-con e-parent\" data-id=\"2e8c3e4\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-2c1837f e-con-full e-flex e-con e-child\" data-id=\"2c1837f\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t<div class=\"elementor-element elementor-element-d8c2ce7 e-con-full e-flex e-con e-child\" data-id=\"d8c2ce7\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t<div class=\"elementor-element elementor-element-9fb6e03 e-con-full e-flex e-con e-child\" data-id=\"9fb6e03\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-107ac0e elementor-widget elementor-widget-heading\" data-id=\"107ac0e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Frequently asked questions<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-006b5a8 elementor-widget elementor-widget-n-accordion\" data-id=\"006b5a8\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;default_state&quot;:&quot;expanded&quot;,&quot;max_items_expended&quot;:&quot;one&quot;,&quot;n_accordion_animation_duration&quot;:{&quot;unit&quot;:&quot;ms&quot;,&quot;size&quot;:400,&quot;sizes&quot;:[]}}\" data-widget_type=\"nested-accordion.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"e-n-accordion\" aria-label=\"Accordion. Open links with Enter or Space, close with Escape, and navigate with Arrow Keys\">\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-4390\" class=\"e-n-accordion-item\" open>\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"1\" tabindex=\"0\" aria-expanded=\"true\" aria-controls=\"e-n-accordion-item-4390\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><div class=\"e-n-accordion-item-title-text\"> What is the difference between log management and log analysis? <\/div><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><i aria-hidden=\"true\" class=\"fas fa-minus\"><\/i><\/span>\n\t\t\t<span class='e-closed'><i aria-hidden=\"true\" class=\"huge huge-plus-sign\"><\/i><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-4390\" class=\"elementor-element elementor-element-54b1041 e-con-full e-flex e-con e-child\" data-id=\"54b1041\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-69ac8ff elementor-widget elementor-widget-text-editor\" data-id=\"69ac8ff\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Log management covers the complete data lifecycle. Log analysis examines the records to investigate incidents, identify patterns or answer operational and business questions.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-4391\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"2\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-4391\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><div class=\"e-n-accordion-item-title-text\"> How long should logs be retained? <\/div><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><i aria-hidden=\"true\" class=\"fas fa-minus\"><\/i><\/span>\n\t\t\t<span class='e-closed'><i aria-hidden=\"true\" class=\"huge huge-plus-sign\"><\/i><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-4391\" class=\"elementor-element elementor-element-44c47d3 e-con-full e-flex e-con e-child\" data-id=\"44c47d3\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f70193b elementor-widget elementor-widget-text-editor\" data-id=\"f70193b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">There is no universal period. Define retention by data category, using the relevant investigation window, contractual commitments, legal requirements, sensitivity and recovery needs. Searchable retention and archive retention may differ.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-4392\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"3\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-4392\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><div class=\"e-n-accordion-item-title-text\"> Is Splunk a log management tool? <\/div><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><i aria-hidden=\"true\" class=\"fas fa-minus\"><\/i><\/span>\n\t\t\t<span class='e-closed'><i aria-hidden=\"true\" class=\"huge huge-plus-sign\"><\/i><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-4392\" class=\"elementor-element elementor-element-4686c22 e-con-full e-flex e-con e-child\" data-id=\"4686c22\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-816f05f elementor-widget elementor-widget-text-editor\" data-id=\"816f05f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Yes. Splunk Enterprise and Splunk Cloud Platform support collecting, indexing, searching and analysing machine data. Their role within a complete solution depends on the surrounding collection, governance and storage architecture.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d5e7200 elementor-share-buttons--skin-flat elementor-share-buttons--color-custom elementor-share-buttons--view-icon-text elementor-share-buttons--shape-square elementor-grid-0 elementor-widget elementor-widget-share-buttons\" data-id=\"d5e7200\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"share-buttons.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-grid\" role=\"list\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-grid-item\" role=\"listitem\">\n\t\t\t\t\t\t<div class=\"elementor-share-btn elementor-share-btn_facebook\" role=\"button\" tabindex=\"0\" aria-label=\"Share on facebook\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-share-btn__icon\">\n\t\t\t\t\t\t\t\t<i class=\"fab fa-facebook\" aria-hidden=\"true\"><\/i>\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<div class=\"elementor-share-btn__text\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-share-btn__title\">\n\t\t\t\t\t\t\t\t\t\tFacebook\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-grid-item\" role=\"listitem\">\n\t\t\t\t\t\t<div class=\"elementor-share-btn elementor-share-btn_twitter\" role=\"button\" tabindex=\"0\" aria-label=\"Share on twitter\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-share-btn__icon\">\n\t\t\t\t\t\t\t\t<i class=\"fab fa-twitter\" aria-hidden=\"true\"><\/i>\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<div class=\"elementor-share-btn__text\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-share-btn__title\">\n\t\t\t\t\t\t\t\t\t\tTwitter\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-grid-item\" role=\"listitem\">\n\t\t\t\t\t\t<div class=\"elementor-share-btn elementor-share-btn_linkedin\" role=\"button\" tabindex=\"0\" aria-label=\"Share on linkedin\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-share-btn__icon\">\n\t\t\t\t\t\t\t\t<i class=\"fab fa-linkedin\" aria-hidden=\"true\"><\/i>\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<div class=\"elementor-share-btn__text\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-share-btn__title\">\n\t\t\t\t\t\t\t\t\t\tLinkedIn\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2c4d486 elementor-widget elementor-widget-spacer\" data-id=\"2c4d486\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-6cc0d761 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"6cc0d761\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-4f28b13d\" data-id=\"4f28b13d\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-885b1d1 elementor-widget elementor-widget-spacer\" data-id=\"885b1d1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-6334508 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"6334508\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-24b81a6\" data-id=\"24b81a6\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap\">\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>A practical guide to centralized log management: what to collect, how to build reliable pipelines, which tool categories to evaluate, and how to separate operational analytics from long-term retention.<\/p>","protected":false},"author":14,"featured_media":23060,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"elementor_header_footer","format":"standard","meta":{"_templately_pack_id":"","_templately_imported_at":"","_templately_source":"","_templately_import_session_id":"","site-sidebar-layout":"right-sidebar","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[19,77,143],"tags":[],"blog":[124,144],"customer-cases":[],"class_list":["post-20243","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-all","category-blogs","category-observability","blog-cases","blog-observability"],"_links":{"self":[{"href":"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/posts\/20243","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/comments?post=20243"}],"version-history":[{"count":30,"href":"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/posts\/20243\/revisions"}],"predecessor-version":[{"id":27636,"href":"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/posts\/20243\/revisions\/27636"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/media\/23060"}],"wp:attachment":[{"href":"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/media?parent=20243"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/categories?post=20243"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/tags?post=20243"},{"taxonomy":"blog","embeddable":true,"href":"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/blog?post=20243"},{"taxonomy":"customer-cases","embeddable":true,"href":"https:\/\/weare.fi\/en\/wp-json\/wp\/v2\/customer-cases?post=20243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}