Splunk Index Retention Cost

[andgarciaa]

If I have an index with a retention of 90 days. Can I make a rough estimate about the cost of increasing the retention of index=  index-name  extra 90 day?

[framirez_enova]

Would you not be able to divide your cost by the amount of data you can ingest and use that as an estimated cost per say MB then run a query that should you the usage by say day over 30 days then add a daily usage * cost per MB to get your daily cost?

At least estimated

[framirez_enova]

Once you have your base cost per day query, you can then add this to do a predictive panel..

[...]
 | timechart span=1d count(status) as "Error Status Count"
 | predict "Error Status Count" future_timespan=7

where [...] is your base query and replace 7 with the amount of days you want to predict.

This would allow you to take into account changes in the already ingested data ....

[framirez_enova]

We use this query to build our total daily ingest over a rolling 30 days:

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d
| eval _time=_time - 43200
| bin _time span=1d
| stats latest(b) AS b by slave, pool, _time
| timechart span=1d sum(b) AS "Daily Usage" fixedrange=false
| fields - _timediff
| foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]
| eval license_threshold = 1000

[gcusello · Accepted solution]

Hi @andgarciaa ,

are you speaking of Splunk Cloud or On-premise?

if Splunk Cloud, you have to ask to your Splunk Sales.

If on premise, the only cost is the additional storage that you can estimate duplicating the actual storage.

Ciao.

Giuseppe

[andgarciaa]

Hi @gcusello! I am using Splunk Cloud. I will check with Splunk Sales.

The idea is because one of the users is looking to evaluate if is worthing (cost basis) to increase retention period for the usage of this data temporary instead of backing it up in another location.

Thanks,

Andrés

[gcusello]

Hi @andgarciaa ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉