How do we calculate SVCs on-prem to the best of our ability assuming data from _audit?

[danielbb]

As we prepare to transition our Splunk deployment to the cloud, we are aiming to estimate the Splunk Virtual Compute (SVCs) that may be incurred during typical usage. Specifically, we are interested in understanding how to best calculate on-prem SVC usage using data available from the _audit index, or any other recommended sources. Our primary focus is on dashboard refreshes, as they represent a significant portion of our ongoing search activity.

We’re looking for guidance on any methodologies, SPL queries, or best practices that can help us approximate SVC consumption in our current environment to better forecast usage and cost implications post-migration.

[livehybrid]

Hi @danielbb 

As far as I know there arent any public SPL searches that can determine the SVC usage based on on-premise ingest based licensing, however your Splunk account team usually work through the Splunk Cloud Migration Assessment with customers prior to migration to Splunk Cloud and this should help shape the environment.

Id suggest speaking to your account team to see if there are any searches they can share to give you this overview.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing