Help estimating cost of metrics in Splunk?

[daniel333]

All,

I am trying to get my head around host much Splunk costs for metric points. I have three metric indexes and let's assume Splunk costs me $1000 a gig. (it doesn't, but need a round number to work with).

How does my math look here?

| mstats count WHERE metric_name=* (index="collectd" OR index="metrics" OR index="winmetrics")
| rename count as "Countofmetrics"
| eval bytes = 150 * Countofmetrics
| eval gigs = bytes / 1024 / 1024 / 1024
| eval cost = 1000 * gigs
| table gigs, cost

[niketn]

@daniel333 you should contact Splunk Sales team for this however, as per the documentation it is not just straight 150 bytes. If per event metric data consumes more tat 150 bytes they would still be capped at 150 bytes. So you would need to know the size of each metric payload being sent to metrics index.

https://docs.splunk.com/Documentation/Splunk/latest/Admin/HowSplunklicensingworks#How_data_is_metere...

Second thing is that once you have calculated raw metrics data volume correctly the license cost per GB is same as regular index license cost.

[niketn]

@daniel333 you should check out Splunk .Conf session on what's new with Metrics as the licensing will change a bit in favor of really small sized metric events. For metric event smaller than 150 bytes, actual size will be used and from 150 bytes and above it will be capped to 150 bytes.

[gjanders]

FYI @niketnilay, the metrics started been measured as <= 150 bytes as of version 7.3.0, below this version it was 150 bytes for all metrics, above this version 150 bytes is the maximum license cost per metric...

[niketn]

Information overload may be 🙂 The session was for Past Present and Future of Metrics and things got mixed up. Thanks for correction!