All Apps and Add-ons

splunk pricing / license cost scenario

Sukisen1981
Champion

Hi,
I am working to reduce some excessive splunk logging with my customer to reduce enterprise licensing costs, while doing this exercise I came across this scenario -
With reference to the pricing calculator link here - https://www.splunk.com/en_us/products/pricing/calculator.html
Suppose I have 45gb of daily data indexing. I will probably go for a 50gb per day license which costs $1140 annually.
So i need to pay , 51300 dollars as my license fees
BUT
what if i procure a license for 100gb daily data ingestion per day? Then my per gb costs reduce to $900 per gb and I need to pay 40,500 dollars only....
We all know that splunk has a license quota upper limit, meaning that I can not exceed my license upper limit per day on a continued basis.
But what If i buy a higher slab rate AND index significantly lower GB per day?
As far as I am aware , there is no lower limit check or 'indexing less than the purcahsed for GB per day' check.
So theoretically, I could buy a higher license volume and save on my cost by indexing lower GB per day due to the lower per GB costs associated with it !?
I am sure there is some catch to this and I am not able to figure out exactly how the licensing works in cases like this, can anyone throw some light on this?

0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

Splunk licensing is quite simple the more Gb /day the less you pay by Gb. The license is based on peak volume ingestion. So the price is based on the volume purchased (Gb) * price per Gb. Its not based on the actual volume used.

So your calculations are not correct because, using the values and prices you posted (mine might be diferent since im based in EMEA), if 100Gb/day is $900/gb you'll need to pay $90,000 and not $40,500.

------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

diogofgm
SplunkTrust
SplunkTrust

Splunk licensing is quite simple the more Gb /day the less you pay by Gb. The license is based on peak volume ingestion. So the price is based on the volume purchased (Gb) * price per Gb. Its not based on the actual volume used.

So your calculations are not correct because, using the values and prices you posted (mine might be diferent since im based in EMEA), if 100Gb/day is $900/gb you'll need to pay $90,000 and not $40,500.

------------
Hope I was able to help you. If so, some karma would be appreciated.

broberg
Communicator

He is correct saying that we are paying for the highest amount of data ingesting possible and not for what we ingest/day, that would be harder for splunk and sales to manage aswell.

0 Karma

Sukisen1981
Champion

hi @diogofgm
That makes sense and avoids the scenario that is confusing me.
So basically what you are saying is - if i buy a 100gb per day license, I will still need to pay 100 * pergb cost, even if my peak ingestion does not cross say 80 gb on any given day?
I will just wait for a couple of more perspectives , I think you are correct though and I will accept the answer after hearing from 1/2 other forum members

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Yes, that's it. Believe I am correct. My company is a Splunk partner in EMEA and we are elite tier authorised resellers. This (and Splunk PS) its what we do 😉

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

Sukisen1981
Champion

thanks @diogofgm
Accepted your answer, sorry if my question appeared too silly / stupid

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...