dvvy Chargeback
dvvy enables Splunk chargeback and showback capabilities for organizations providing Splunk as a Service.
Get visibility into vCPU, search runtime, data ingest, storage, forwarder count, indexer load, and Splunk admin/FTE utilization by customer. Mix in per-customer rates, entitlements, and charge modes and you have a metric ton of control over your showback or chargeback reporting.
hello@redfactorapps.com
Showback & Chargeback
Need to deploy Splunk as a Service or understand Splunk operating costs? Want to better quantify or justify your Splunk budget? The dvvy app can help.
dvvy provides comprehensive resource utilization and charge reporting by customer, cost center, and data source.
Flexibility, FTW!
dvvy 2.0 introduces new chargeback dimensions and modes that provide granular reporting on customer usage.
Data Ingest
Daily license usage by customer, cost center, and data source.
vCPU
vCPU approximation based on customer data ingest and search load.
Hot/Warm Storage
Hot/warm storage usage (TB) by customer.
Cold Storage
Hot/warm storage usage (TB) by customer.
Search Runtime
Runtime (seconds) of all non-real-time user searches, tallied by customer.
RT Search Runtime
Runtime (seconds) of all real-time user searches, tallied by customer.
Indexer Load (IDXL)
Estimation of indexer resources based on ingest and system sizing.
Forwarder Count
Count of forwarders by customer with charges per 100.
Admin
The impact of license, users, storage, and forwarders on Splunk Admin FTE.
Flat Fee
A daily charge per customer for administration.
Entitlements
Resources included before charges are incurred.
Charge Modes
Charge for all use or only resources over a customer's entitlement(s).
dvvy Operation
dvvy relies on index-time metadata (pipeline keys) and internal logs to track utilization by customer.
Want to learn more? Check out the dvvy Installation & Configuration Guide.
# tagging configuration example
# in your UF inputs.conf
[monitor:///var/log/syslog]
_meta = org_id::noc
disabled = false
index = linux
sourcetype = syslog
Easy-peasy, lemon-squeezy.
A single license covers a production and dev/test instance of dvvy. Whether you index 10 MB, 10 GB, or 10 TB, the dvvy license is the same.
We wanted to make dvvy available to the Splunk community for free but chickened out (but got pretty close). dvvy's modest price tag of $2500 for a 1-year license or $5000 for a 3-year license, includes maintenance and support.
Contact our distributor Carahsoft for a formal quote: (855) 377-5865 or redfactor@carahsoft.com
- 3-Year Term License
- 1 Production Installation
- 1 Development Installation
- Software Updates
- Email Support
Frequently Asked Questions
Where do I install dvvy?
The dvvy app is installed on your search head(s) or search head cluster.
What about overlapping data sources?
Tagging allows you to delineate between customer data that have the same index and sourcetype.
How often are charges calculated?
Utilization is measured and charges are calculated on a daily basis.
Can we use existing _meta keys?
Yes! If you are already using pipeline keys to segment your data by customer, that tagging can be used.
This is a Splunk app? Couldn't I build this myself?
Yes! However, we've logged a ton of development time, as well as extensive collaboration with Splunk customers. The tiny price tag allows you to buy it for much less than the expense of developing it internally or outsourcing. If your requirements necessitate a custom build, use dvvy as a framework to greatly accelerate your efforts.
Where is the data stored?
dvvy configuration resides in KV store collections and utilization/chargeback data in summary indexes.
Can I open up the dashboards to my customers?
Yes. Customers will only see their utilization and charge data in dvvy dashboards.
Will dvvy use my consumption-based license?
Adding the index-time customer tagging will result in a few extra bytes per event.
Will I need to manually add data to dvvy?
Nope. Tagged data is automatically added to dvvy for tracking.