We are currently working a chargeback model for our Splunk platform. At first glance we were thinking it would be fairly easy as we can charge each team/department for the data they index per day and also any associated support/maintenance costs.
After looking at this for some time know, we realize now that some of our biggest consumers of the platform have very little data being indexed but perform the most searches with some of these searches being quite expensive (ie CPU time, disk IO etc). We believe we will have to take into consideration the cost of these searches across the platform, as they can have a significant impact on the platform overall.
Has anyone created a model that includes all of these factors?
Cheers
Shaun
... View more