topic Splunk Index Retention Cost in Splunk Search

Splunk Index Retention Cost

andgarciaa — Mon, 13 May 2024 08:56:57 GMT

If I have an index with a retention of 90 days. Can I make a rough estimate about the cost of increasing the retention of index= index-name extra 90 day?

Re: Splunk Index Retention Cost

gcusello — Mon, 13 May 2024 09:05:58 GMT

Hi @andgarciaa ,

are you speaking of Splunk Cloud or On-premise?

if Splunk Cloud, you have to ask to your Splunk Sales.

If on premise, the only cost is the additional storage that you can estimate duplicating the actual storage.

Ciao.

Giuseppe

Re: Splunk Index Retention Cost

andgarciaa — Mon, 13 May 2024 09:13:57 GMT

Hi @gcusello! I am using Splunk Cloud. I will check with Splunk Sales.

The idea is because one of the users is looking to evaluate if is worthing (cost basis) to increase retention period for the usage of this data temporary instead of backing it up in another location.

Thanks,

Andrés

Re: Splunk Index Retention Cost

gcusello — Mon, 13 May 2024 10:54:09 GMT

Hi @andgarciaa ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Splunk Index Retention Cost

framirez_enova — Tue, 14 May 2024 18:43:26 GMT

Would you not be able to divide your cost by the amount of data you can ingest and use that as an estimated cost per say MB then run a query that should you the usage by say day over 30 days then add a daily usage * cost per MB to get your daily cost?

At least estimated

Re: Splunk Index Retention Cost

framirez_enova — Tue, 14 May 2024 18:45:00 GMT

We use this query to build our total daily ingest over a rolling 30 days:

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d
| eval _time=_time - 43200
| bin _time span=1d
| stats latest(b) AS b by slave, pool, _time
| timechart span=1d sum(b) AS "Daily Usage" fixedrange=false
| fields - _timediff
| foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]
| eval license_threshold = 1000

Re: Splunk Index Retention Cost

framirez_enova — Tue, 14 May 2024 18:48:48 GMT

Once you have your base cost per day query, you can then add this to do a predictive panel..

[...]
 | timechart span=1d count(status) as "Error Status Count"
 | predict "Error Status Count" future_timespan=7

where [...] is your base query and replace 7 with the amount of days you want to predict.

This would allow you to take into account changes in the already ingested data ....