Installation

Can you help me with a question about Splunk licensing?

Sukisen1981
Champion

So, I checked the Splunk licensing information here - https://www.splunk.com/en_us/products/pricing/calculator.html

Assuming that I go for a 100 GB per day perpetual license, it costs around 2700/GB.

What does this mean?

total costs = 2700*100= 270000 USD? Of course, this is a one time expense, provided I do not exceed 100GB of indexing per day.

Now, if I reduce my log per day to 95 GB at a peak, does this mean I will save 5*2700=13500 USD? Or, since I have already bought a perpetual license for 100GB and am not exceeding 100 GB of daily indexing volume, this just means I am within my limits and there is no savings, even if i ingest less data per day?

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You do not get money back for indexing less than your quota. The license size is an upper bound. You can index any amount less than or equal to your limit for the same price.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You do not get money back for indexing less than your quota. The license size is an upper bound. You can index any amount less than or equal to your limit for the same price.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Sukisen1981
Champion

I am going to accept this, it makes sense.....

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Sukisen1981

I'm not sure Splunk provide licensing billing on the volume of daily indexing data. Your Splunk Enterprise daily indexing volume should less or equal to the license you have. Check below link for FAQ.

https://www.splunk.com/en_us/software/pricing/faqs.html#Splunk-Enterprise

If still not getting the answer I suggest you contact the salesperson for more information.

Thanks

0 Karma

Sukisen1981
Champion

Hi @kamlesh_vaghela Thanks I had gone through the link you provided, it is not very clear. I do understand that this is a grey area. Excerpt from the link you posted -
Do I get a volume discount if I buy a larger Splunk Enterprise license?

Yes. Splunk Enterprise pricing has built-in volume discounts. You pay based on the amount of data indexed by your Splunk instance on a daily basis, calculated in GB per day. We determine the total plan price by multiplying your desired daily index volume by the unit price per GB. For example, the unit price per GB decreases by 67% as total daily index volume grows from 1GB/day to 100 GB/day.

So, as you see it does talk about the daily indexing volume. What I am asking is what happens if I am over provisioned? Do i have to pay less, be it even a small amount, or does it mean there is no payment reduction? All it means is that as long as I am less than/equal to my agrred upon daily indexing volume , i won't encounter any license violations/have to pay more. The window here is also an important consideration, is it a rolling 30 day period or something else? My gut feel says there are 0 savings in the scenario I described, but I wanted to ascertain more.
And no, I do not want to contact splunk sales, rather depend upon a ground report from users who might have faced this situation in real life 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...