Has anyone created a Splunk Chargeback Model that includes number of and performance heavy searches, not just data indexed and support costs?

[shaun_dyble]

We are currently working a chargeback model for our Splunk platform. At first glance we were thinking it would be fairly easy as we can charge each team/department for the data they index per day and also any associated support/maintenance costs.

After looking at this for some time know, we realize now that some of our biggest consumers of the platform have very little data being indexed but perform the most searches with some of these searches being quite expensive (ie CPU time, disk IO etc). We believe we will have to take into consideration the cost of these searches across the platform, as they can have a significant impact on the platform overall.

Has anyone created a model that includes all of these factors?

Cheers

Shaun

[jdonn_splunk]

Hi Shaun,

This is an interesting problem to solve. I would put "heavy use" customers on their own search head and charge them for that extra hardware. While the searches also impact the indexing tier, it is going to be extremely difficult to charge for that. Depending on the size of your implementation, that incremental cost might not be noticed if it were distributed throughout the company. I'm not trying to promote bad behavior, just trying to determine the feasibility of chasing down the small stuff.

Jim