> Not even remotely true, You can have these things called "spares", a lot of DCs have on-site technicians or engineers as well if it comes to requiring physical replacement.
You seem to have skipped part of my post.
I gave an example of Timor-Leste. Let me tell you about the TL D/C.
It's unmanned and (unsurprisingly) on the island of Timor-Leste. Space is incredibly tight, TL is small, and the D/C is even smaller. So, no, you can't really justify dropping another box in to run Splunk.
There's 1 boat there a week - your remote hands will need to get that boat, fit/replace the kit *and wait a week* to get home unless he's exceptionally speedy at doing it - after you've paid a pretty exorbitant price for the cargo space.
Connectivity to TL? I mean, it exists, but it's pretty fucking limited.
You seem to interpret Global scale as "I've got servers across the world". Whereas I'm interpreting it as - I've got locations fucking everywhere. Big central locations, and lots of little fingers with much more limited connectivity.
> Well apparently the set-up I'm dealing with is considerably better than the one you're dealing with since where I work, there are solutions to ALL those issues already.
You've an unmanned D/C on TL, with enough local demand to justify the existence of the kit there. You don't have particularly good international uplinks available - even the links over to ID are pretty poor.
What solution do you have for that which is better than not fucking with the logs in the first place? And throwing money at it isn't an option for most orgs
> prevent them from replacing out a rack in Austria.
Sorry, Austria? I give you the example of a small remote island and your counter is that it works just fine in central fucking Europe?
Don't make the mistake of thinking TL is the only example I have either, there's a whole lot of world that has extremely remote D/Cs with limited connectivity outside their immediate region.
To be clear, I'm not taking issue with your suggestion to use ELK/Splunk in general. Only that you seem to be suggesting that it is suitable as a *replacement* (and apparently in all use-cases at that). It's not.