DCS & PCI Audit: Realtime vs Bulk Logging

Hi Team

I would like to know what is more effective during a PCI Audit if having all the PCI related logs at Realtime or use Bulk logging for the PCI Requirement 10.

According with some training and Symantec documentation Bulk logging is more used for compliance, but what is your experience in terms of a real PCI Audit?

Thanks in advance