I had a customer a couple years ago move from Qradar to Splunk due to:
- cost
- ease of getting new data sources into it
- flexibility of permissions model
- scalability
This was ALL on-prem, however (including a classified, air-gapped environment)
April 30, 2020 at 02:32PM
via reddit https://www.reddit.com/r/Splunk/comments/gb0d2d/anyone_make_the_change_from_qradar_to_splunk/fp31nda?utm_source=ifttt