This is a bit more complicated topic than it seems. You'd do best to consult it with your local Splunk representative and your local Splunk Partner (possibly a higher-tier one). As the names suggest, with ingest pricing you're paying a fee for the data you're ingesting but you have no limits imposed on the overall architecture of your environment, number of servers, redundamcy, number of sites and so on. So as long as you are within the ingestion size limit you can easily grow your environment if you expand your use cases, add more users and so on. With the workload pricing you're limited by the size of the main components (indexers and search heads) of your environment but can ingest as much data as the hardware can handle. So it is indeed naturally suited for high-volume, low-search environments. But there are obvious caveats - redundancy (especially multisite clustering) and generally horizontal scaling can quickly kill any savings since you need more indexers. Of course horizontal scaling is also obviously beneficial for search speed but here you're limited by your licensed environment size. To some extent you can mitigate the redundancy requirements by decoupling storage from indexers to smartstore but that's another advanced topic to discuss with your local Splunk staff/partner. BTW, I moved this thread to a more fitting section (assuming you talked about on-prem Splunk Enterpise).
... View more
