---
icon: material/scale-balance
title: "Comparisons"
---

10x vs Splunk Ingest Actions, vs Splunk Federated Search for S3, vs Splunk Edge Processor, and a supported-version matrix plus integration order.

??? tenx-compare "10x vs Splunk Ingest Actions"

    **The two are complementary.** Ingest Actions run on Heavy Forwarders and Indexers and can route data to S3 or drop it before it is indexed, and Splunk does not meter data routed away before indexing. 10x acts before data reaches any Splunk component , and its compact and offload actions keep every line: compact in Splunk, or in a bucket the team owns with fetch-back.

    **Key differences:**

    - **Processing location:** Ingest Actions on indexers or Heavy Forwarders; 10x before Splunk, at the log source
    - **License impact:** both keep dropped or routed-away data off the licence meter; 10x also compacts the lines that stay, so they meter at a fraction of their size
    - **Template encoding:** Ingest Actions not supported; 10x Engine yes ([template-based](https://doc.log10x.com/run/transform/){target="_blank"})
    - **Destination reach:** Ingest Actions route to Splunk indexes, S3 or a file system; the 10x Engine forwards to Splunk, Datadog, Elastic, or your own S3. Lossless compact applies on Splunk (up to 256 KB per event) and self-hosted Elasticsearch or OpenSearch; on other destinations the cost levers are tier_down, offload, and sample or drop.

    **Use together:** Ingest Actions for Splunk-specific parsing/routing after ingestion. 10x Engine for cost optimization before ingestion.

    **Note:** Splunk Ingest Actions run on Splunk Enterprise 9.0+ and Splunk Cloud. 10x Engine works with Splunk Cloud and Enterprise.

??? tenx-compare "Federated Search for S3 and Retriever"

    **Retriever runs beside Federated Search and fetches back what the 10x Engine offloads.** Once the 10x Engine offloads low-value patterns to your own S3 to cut the Splunk bill, [Retriever](https://doc.log10x.com/apps/retriever/){target="_blank"} fetches that data on demand, scoped by Bloom filter to the offloaded events, and ships matching events back to Splunk or hands them off for analysis. Every offloaded event stays reachable, however much of the stream a team offloads.

    **Key points:**

    - **Offload and fetch:** Retriever indexes at upload and fetches only the patterns you ask for, scoped by Bloom filter.
    - **Storage cost:** Offloaded logs are stored in your own bucket at $0.023/GB; Federated Search for S3 charges per scan, in Data Scan Units (DSU).
    - **Reachable anywhere:** Splunk Cloud + Enterprise, AWS + Azure, on-prem + air-gapped.

    **Use together:** Federated Search for ad-hoc queries across Splunk-managed data; Retriever to reach the slice the Engine offloaded to cut cost, and pull it back when you need it.

??? tenx-compare "10x vs Splunk Edge Processor"

    **Edge Processor needs hand-written SPL2 rules and does not compact what it keeps. 10x regulates automatically by cost and severity per event type, enforces per-app K8s budgets, and on Splunk compacts what ships, losslessly up to 256 KB per event.**

    |  | Edge Processor | 10x |
    |---|---|---|
    | Filtering | Hand-written SPL2 rules per pattern | Automatic byte limits per event type; an error type passes up to 50 events a window over its limit |
    | Budget control | None | Per-app K8s budgets that hold as pods scale |
    | Compact mode | None; an SPL2 pipeline can filter, mask or trim an event, not compact it | Lossless reduction on Splunk (up to 256 KB per event) and self-hosted Elasticsearch or OpenSearch; on Datadog and managed Elasticsearch the cost levers are tier_down, offload, and sample or drop |
    | Sources | Splunk forwarders, syslog and HEC | Any forwarder (UF, Fluent Bit, OTel, Vector, Logstash) |
    | Destinations | Splunk and S3 | Splunk, Datadog, Elastic, S3 |
    | Fleet config | Per-forwarder SPL2 pipelines | Environment-wide GitOps driven by cost metrics |

??? tenx-compare "Splunk version compatibility & integration order"

    **Version compatibility:**

    | Component | Minimum | Tested | Supported |
    |---|---|---|---|
    | **Splunk Cloud** | n/a | The package passes AppInspect's Splunk Cloud checks | After Splunk's vetting of the uploaded app |
    | **Splunk Enterprise** | 9.4 | 9.4, 10.0, 10.2, 10.4, 10.6 | 9.4 to 10.6 |
    | **Universal Forwarder** | 8.0 | 8.1, 9.0, 9.1, 10.4.3 | 8.0+ |
    | **Fluentd** (if used) | 1.14 | 1.14, 1.16 | 1.14+ |
    | **Fluent Bit** (if used) | 2.0 | 2.0, 2.1 | 2.0+ |
    | **Helm** (K8s deployment) | 3.0 | 3.0, 3.12 | 3.0+ |
    | **Kubernetes** | 1.20 | 1.24, 1.27 | 1.20+ |

    **Integration order:**

    1. **Verify prerequisites**
       - [ ] Admin access to Splunk instance
       - [ ] HEC token configured (or ability to create one)
       - [ ] K8s cluster with 4GB+ available memory (DaemonSet test)

    2. **Install Splunk App**
       - [ ] Download [Log10x App](https://github.com/log-10x/splunk-app/releases){target="_blank"} from GitHub
       - [ ] Install via Splunk UI: Apps → Install app from file
       - [ ] Verify installation: Settings → Installed apps (lists "Log10x App")

    3. **Deploy Receiver**
       - [ ] Deploy via Helm with `--dry-run` first to verify manifests
       - [ ] Apply Helm chart alongside forwarder (sidecar)
       - [ ] Verify pods are running: `kubectl get pods -l app=log10x-receiver`
       - [ ] Check logs for startup errors: `kubectl logs -l app=log10x-receiver`

    4. **Check the KV Store**
       - [ ] The app creates the `tenx_dml` collection; confirm templates arrive with `| inputlookup tenx-dml-lookup | head`. Templates indexed before the app was installed need the backfill search on the [KV Store](kv-store.md) page

    5. **Validate end-to-end**
       - [ ] Query compact events in Splunk
       - [ ] Verify events expand automatically at search time
       - [ ] Check that dashboards display expanded events correctly
       - [ ] Confirm reduction ratio in logs

    **Rollback procedure:**
    - **Remove Receiver:** `helm uninstall log10x-receiver` (logs resume at full volume)
    - **Remove app:** Splunk UI → Apps → Uninstall the Log10x App
    - **Both actions keep every indexed event in place**

    **Compatibility checklist before full deployment:**
    - [ ] Test on non-production environment first
    - [ ] Verify with actual log volume from your apps
    - [ ] Confirm reduction ratio meets expectations
    - [ ] Run for 24+ hours with the Receiver in read-only mode
    - [ ] Confirm each alert reaches compact events, through the Compile Alert view or the `tx` macro
    - [ ] Compare saved-search run times over compact events with the measured [overhead](optimization.md)