Monitoring Splunk

Estimating Cost By Sourcetype

daniel333
Builder

All, 

 

Just trying to get a swag of cost by sourcetype. I wrote this search, but seems to me there is a more cost effective way to do this. 

 

index=* sourcetype=*
NOT sourcetype=stash
NOT index=stash
| fields _raw
| eval bytes=len(_raw)/1024/1024/1024
| eval splunk_cost = 685
| eval gigcost = bytes * splunk_cost
| stats sum(gigcost) as CostPerYear by sourcetype
| sort - CostPerYear
| addcoltotals

Labels (1)

bowesmana
Champion
0 Karma

inventsekar
Super Champion

Hi @daniel333 ...so this case depends on your own log, not a generic one like apache logs/win basic logs, etc.. 

if its a generic log, others would have had this issue and they can give suggestions. 

May i know if this use-case is to understand that which sourcetype consumed how much splunk license cost?

if yes, maybe other users also have had this issue and they can give some suggestions. 

 

(PS - i have given around 500+ karma points so far, received badge for that, if an answer helped you, a karma point would be nice!. we all should start "Learn, Give Back, Have Fun")

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!