splunk pricing / license cost scenario

Champion

Hi,
I am working to reduce some excessive splunk logging with my customer to reduce enterprise licensing costs, while doing this exercise I came across this scenario -
With reference to the pricing calculator link here - https://www.splunk.com/en_us/products/pricing/calculator.html
Suppose I have 45gb of daily data indexing. I will probably go for a 50gb per day license which costs \$1140 annually.
So i need to pay , 51300 dollars as my license fees
BUT
what if i procure a license for 100gb daily data ingestion per day? Then my per gb costs reduce to \$900 per gb and I need to pay 40,500 dollars only....
We all know that splunk has a license quota upper limit, meaning that I can not exceed my license upper limit per day on a continued basis.
But what If i buy a higher slab rate AND index significantly lower GB per day?
As far as I am aware , there is no lower limit check or 'indexing less than the purcahsed for GB per day' check.
So theoretically, I could buy a higher license volume and save on my cost by indexing lower GB per day due to the lower per GB costs associated with it !?
I am sure there is some catch to this and I am not able to figure out exactly how the licensing works in cases like this, can anyone throw some light on this?

Tags (2)
1 Solution
SplunkTrust

Splunk licensing is quite simple the more Gb /day the less you pay by Gb. The license is based on peak volume ingestion. So the price is based on the volume purchased (Gb) * price per Gb. Its not based on the actual volume used.

So your calculations are not correct because, using the values and prices you posted (mine might be diferent since im based in EMEA), if 100Gb/day is \$900/gb you'll need to pay \$90,000 and not \$40,500.

------------
Hope I was able to help you. If so, some karma would be appreciated.
SplunkTrust

Splunk licensing is quite simple the more Gb /day the less you pay by Gb. The license is based on peak volume ingestion. So the price is based on the volume purchased (Gb) * price per Gb. Its not based on the actual volume used.

So your calculations are not correct because, using the values and prices you posted (mine might be diferent since im based in EMEA), if 100Gb/day is \$900/gb you'll need to pay \$90,000 and not \$40,500.

------------
Hope I was able to help you. If so, some karma would be appreciated.
Communicator

He is correct saying that we are paying for the highest amount of data ingesting possible and not for what we ingest/day, that would be harder for splunk and sales to manage aswell.

Champion

hi @diogofgm
That makes sense and avoids the scenario that is confusing me.
So basically what you are saying is - if i buy a 100gb per day license, I will still need to pay 100 * pergb cost, even if my peak ingestion does not cross say 80 gb on any given day?
I will just wait for a couple of more perspectives , I think you are correct though and I will accept the answer after hearing from 1/2 other forum members

SplunkTrust

Yes, that's it. Believe I am correct. My company is a Splunk partner in EMEA and we are elite tier authorised resellers. This (and Splunk PS) its what we do 😉

------------
Hope I was able to help you. If so, some karma would be appreciated.
Champion

thanks @diogofgm
Accepted your answer, sorry if my question appeared too silly / stupid

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...