In depth: Showback plan for the Splunk CoE
Showback is a method of tracking Splunk utilization by an organization’s business units or end users. Unlike chargeback, showback keeps track of utilization without actually cross-charging those costs back to the departments that use them.
A showback plan is a way to demonstrate that you are getting your money's worth from your Splunk investment. Metrics and cost tracking are a way to measure that value and allocate it to the users and beneficiaries of that value.
A showback practice is most effective for implementations with more than one constituency that are scoped as Splunk as a Service or Splunk as a Strategy. A showback plan may be more formal than is needed for Splunk-as-a-Solution deployments that serve only one team, group, or purpose. See Select a scope for an explanation of CoE charter levels.
Having a data-driven showback plan can be an effective way to foster positive competition among teams to make their Splunk usage more effective by challenging them to unlock more value per unit of cost. A showback plan should drive adoption and improve efficiency, not just track cost centers.
Guidelines for implementing a showback plan
Here are some guidelines for implementing a successful showback plan.
Measure utilization on a scale
Start by establishing a benchmark for your Splunk usage. Your initial benchmark will be a guess, but as your user community spends time with Splunk, these estimates will become more accurate and detailed.
Next, design a measurement plan that matures over time. Start out with what you can easily measure, and add in things that are harder to measure over time when you have usage patterns on which to base your estimates. Communicate this plan to your user community. For example:
- Years 1 and 2: measure license usage only
- Year 3: measure license and hardware costs
- Year 4: measure license, hardware, and support costs
This gives everyone in your organization time to establish their Splunk usage and value realization while getting licenses properly funded. Adjust the timing as needed.
Establish baseline agreements
- Establish baseline data usage agreements
- Include storage retention solutions and staff overhead.
- Base license usage requirements on near-maximum usage
- Using near-maximum measurements rather than averages will ensure that the baseline you establish has enough headroom for meeting daily volume obligations without exceeding license boundaries.
- Provide a fixed chargeback cost and account for overages
- This provides an incentive for users to be good citizens.
- Avoid providing discounts for under-usage
- This can drive less adoption.
Include a variety of factors in usage measurements
- Keep measurements general
- Include general usage measurements, such as license and overall memory usage. Avoid measuring minute details, such as the search runtime or memory usage of individual use cases.
- Account for indirect usage
- Factor in outside resources, such as storage retention solutions, hardware needs, and support usage.
- Include predictions
- Predictions help stakeholders see their growth over time. Predictions help set expectations, and keep planning and communications proactive.
Measure support time and grade on a scale
When measuring support time, design a plan that encourages adoption. If you measure support time at a flat rate, it can drive less adoption (for example, users may think if they use Splunk less, they will need less support and get charged less). You can grade groups based on percentage of certified users, search maturity, add-on support, and support time. This can build an incentive for users to increase their Splunk adoption. For example:
- Group A wrote a power shell to pull exactly what they needed and maintained the app themselves so the support group didn't have to. Support time was trivial.
- Group B spent less time learning and relied on the support group to build toolings for them. Support and training time was greater.
Next steps for implementing a showback plan
The Chargeback Analysis for Splunk app from Splunkbase is a great resource to start implementing a showback plan.
In depth: Service level definitions for the Splunk CoE
In depth: Disaster recovery for the utility tier
This documentation applies to the following versions of Splunk® Center of Excellence: current