Showback best practices for a Splunk deployment
Showback is a method of tracking Splunk utilization by an organization's business units or end users. Unlike chargeback, showback keeps track of utilization without actually cross-charging those costs back to the departments that use them.
A showback plan is a way to demonstrate that you are getting your money's worth from your Splunk investment. Metrics and cost tracking are a way to measure that value and allocate it to the users and beneficiaries of that value.
A showback practice is most effective for implementations with more than one constituency that are scoped as Splunk as a Service or Splunk as a Strategy. A showback plan may be more formal than is needed for Splunk-as-a-Solution deployments that serve only one team, group, or purpose. See Define a charter for your Splunk implementation for an explanation of charter levels.
Having a data-driven showback plan can be an effective way to foster positive competition among teams to make their Splunk usage more effective by challenging them to unlock more value per unit of cost. A showback plan should drive adoption and improve efficiency, not just track cost centers.
- Executive sponsor
- Program manager
For more about these roles, see Roles best practices.
Guidelines for implementing a showback plan
Here are some guidelines for implementing a successful showback plan.
Measure utilization on a scale
Start by establishing a benchmark for your Splunk usage. Your initial benchmark will be a guess, but as your user community spends time with Splunk, these estimates will become more accurate and detailed.
Next, design a measurement plan that matures over time. Start out with what you can easily measure, and add in things that are harder to measure over time when you have usage patterns on which to base your estimates. Communicate this plan to your user community. For example:
- Years 1 and 2: measure license usage only
- Year 3: measure license and hardware costs
- Year 4: measure license, hardware, and support costs
This gives everyone in your organization time to establish their Splunk usage and value realization while getting licenses properly funded. Adjust the timing as needed.
Establish baseline agreements
- Establish baseline data usage agreements
- Include storage retention solutions and staff overhead.
- Base license usage requirements on near-maximum usage
- Using near-maximum measurements rather than averages will ensure that the baseline you establish has enough headroom for meeting daily volume obligations without exceeding license boundaries.
- Provide a fixed chargeback cost and account for overages
- This provides an incentive for users to be good citizens.
- Avoid providing discounts for under-usage
- This can drive less adoption.
Include a variety of factors in usage measurements
- Keep measurements general
- Include general usage measurements, such as license and overall memory usage. Avoid measuring minute details, such as the search runtime or memory usage of individual use cases.
- Account for indirect usage
- Factor in outside resources, such as storage retention solutions, hardware needs, and support usage.
- Include predictions
- Predictions help stakeholders see their growth over time. Predictions help set expectations, and keep planning and communications proactive.
Measure support time and grade on a scale
When measuring support time, design a plan that encourages adoption. If you measure support time at a flat rate, it can drive less adoption (for example, users may think if they use Splunk less, they will need less support and get charged less). You can grade groups based on percentage of certified users, search maturity, add-on support, and support time. This can build an incentive for users to increase their Splunk adoption. For example:
- Group A wrote a power shell to pull exactly what they needed and maintained the app themselves so the support group didn't have to. Support time was trivial.
- Group B spent less time learning and relied on the support group to build tooling for them. Support and training time was greater.
Next steps for implementing a showback plan
The Chargeback Analysis for Splunk app from Splunkbase is a great resource to start implementing a showback plan.
Service-level best practices for a Splunk deployment
Utility tier disaster recovery best practices for a Splunk deployment
This documentation applies to the following versions of Splunk® Success Framework: ssf