Chronicle uses the Unified Data Model to parse all data. Most GCP data sources use this, but non-GCP data sources do not. If custom application logs or data sources outside GCP are important, then Chronicle may not be the best choice. Chronicle comes with 1 year of hot storage included. Search speed for data older than 90 days is good for standard fields like IP address, hostname, etc. But custom searches using regex are much slower.
Devo’s cloud-native architecture provides a unique method of ingesting and storing data. This enables significant performance benefits in ingest rate, search performance, and data compression. Devo uses a component known as a Relay to aggregate data from sources, tag it, and transmit it via a secure connection. Data from one or more Relays enters an event load balancer before being sent into the Devo Data Node for storage. As Data Nodes scale up, Meta Nodes coordinate searches across multiple Data Nodes.