dvvy Chargeback
dvvy enables Splunk chargeback and showback capabilities for organizations providing Splunk as a Service.
Get visibility into vCPU, search runtime, data ingest, storage, forwarder count, indexer load, and Splunk admin/FTE utilization by customer. Mix in per-customer rates, entitlements, and charge modes and you have a metric ton of control over your showback or chargeback reporting.
View on GitHub
Showback & Chargeback
Need to deploy Splunk as a Service or understand Splunk operating costs? Want to better quantify or justify your Splunk budget? The dvvy app can help.
dvvy provides comprehensive resource utilization and charge reporting by customer, cost center, and data source.
Flexibility, FTW!
dvvy 2.0 introduces new chargeback dimensions and modes that provide granular reporting on customer usage.
Data Ingest
Daily license usage by customer, cost center, and data source.
vCPU
vCPU approximation based on customer data ingest and search load.
Hot/Warm Storage
Hot/warm storage usage (TB) by customer.
Cold Storage
Hot/warm storage usage (TB) by customer.
Search Runtime
Runtime (seconds) of all non-real-time user searches, tallied by customer.
RT Search Runtime
Runtime (seconds) of all real-time user searches, tallied by customer.
Indexer Load (IDXL)
Estimation of indexer resources based on ingest and system sizing.
Forwarder Count
Count of forwarders by customer with charges per 100.
Admin
The impact of license, users, storage, and forwarders on Splunk Admin FTE.
Flat Fee
A daily charge per customer for administration.
Entitlements
Resources included before charges are incurred.
Charge Modes
Charge for all use or only resources over a customer's entitlement(s).
dvvy Operation
dvvy relies on index-time metadata (pipeline keys) and internal logs to track utilization by customer.
Want to learn more? Check out the dvvy Installation & Configuration Guide.
# tagging configuration example
# in your UF inputs.conf
[monitor:///var/log/syslog]
_meta = org_id::noc
disabled = false
index = linux
sourcetype = syslog
Frequently Asked Questions
Where do I install dvvy?
The dvvy app is installed on your search head(s) or search head cluster.
What about overlapping data sources?
Tagging allows you to delineate between customer data that have the same index and sourcetype.
How often are charges calculated?
Utilization is measured and charges are calculated on a daily basis.
Can we use existing _meta keys?
Yes! If you are already using pipeline keys to segment your data by customer, that tagging can be used.
Where is the data stored?
dvvy configuration resides in KV store collections and utilization/chargeback data in summary indexes.
Can I open up the dashboards to my customers?
Yes. Customers will only see their utilization and charge data in dvvy dashboards.
Will dvvy use my consumption-based license?
Adding the index-time customer tagging will result in a few extra bytes per event.
Will I need to manually add data to dvvy?
Nope. Tagged data is automatically added to dvvy for tracking.
Happy New Year! The dvvy app is now free and open.
As of 1/1/2024, the rqst app is freely available on GitHub. Please consider using and contributing.
If you previously licensed dvvy, you will be fully supported for the duration of your license term.