How to use splunk to compute and display the cost of a downtime

[ssudhaiyer]

Hi,

I'm new to splunk. So, please bear with me if my question is lame and splunk is not meant for such things.

I see splunk offers extensions for customizing it. I would like to use this to compute the cost of a server/network downtime ( in terms of resource cost, network usage etc) and display it graphically. I'm thinking of different instances of splunk for the various groups/departments within the org. Is this possible?

Thanks,
Sudha

[Jon_Webster · Accepted solution]

It would be fairly simple. Assign a cost per minute for each resource, then create a "lookup" that contains the resource name and the cost per minute of downtime. Next you will create a search for each resource that detects minutes of downtime, run the "lookup" to match the resource to the cost, multiply the cost by the length of time of the outage and graph it.

This is very similar to what many customers do for their management console.

Here is the documentation for lookups:
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usefieldlookupstoaddinformationtoyourev...

Here is a tutorial on how to use lookups:
http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/Usefieldlookups

Good luck!

[bmacias84]

It could do that, but what events or metrics are using to base your calculations on. Splunk is greate for Operational data, but seem over kill or something like that. Also splunk doesnt operate like a standar relational database.