Ultimately for an organization to use Splunk, it has to be bought for that organization. Briefly here, we will cover some of the important points to consider related to the purchase of software from Splunk.
The most important concept to understand is the concept of Indexed Volume per Day. Index volume per day represents the total of all the data you intend to send to Splunk on a daily basis. Any size license can be purchased over 1 GB per day, and over time the organization can purchase additional license capacity as new data sources are loaded into Splunk to support additional Splunk solutions.
After a license size estimate, the next decision to make is whether the organization intends to buy Splunk Cloud or buy Splunk to run and maintain on its own:
- Splunk Cloud is priced on a monthly basis, but billed annually. Meaning, if you buy an annual license, the price quoted could be $150 per month, but the invoice you receive to pay will be for 12 months or $1,800. We will refer to this way to buy software as Term.
- Splunk Enterprise bought to be captured, installed and maintained by the organization can be bought in one of two ways:
- Term: The same method as discussed above for Splunk Cloud
- Perpetual: Take ownership of software with a higher up front cost and lower annual costs after 1 year.
The main difference is in perpetual, the organization takes ownership of the software to do as they so chose, for a higher up front cost. In the case of term, if the organization decides after 1 year to not purchase another year for 2 year, they lose access to the software and all its contents.
Splunk provides a good deal of information on how it prices its software on its website here: https://www.splunk.com/en_us/products/pricing.html. There is also a helpful page of frequently asked questions to review: https://www.splunk.com/en_us/products/pricing/faqs.html.
Commonly in software, there is also a cost for what as known as support. Support generally covers the ability to work with Splunk on product issues you may encounter as well as the rights to use new releases of software in your environments as they are delivered to the market. Depending on which type of license you buy, support will be bundled into the cost of the software or listed as a separate item, as is the case with perpetual licenses.
To close the topic of Splunk pricing, there are a few important things to understand about Splunk software which you can do for free:
- Deploy to unlimited amount of users – no cost per user
- Deploy to an unlimited amount of hardware resources – increase performance and resiliency without additional software cost
- Collect data from an unlimited number of sources
- There is no cost to deploy universal forwarders where needed