Splunk® Success Framework

Splunk Success Framework Handbook

Download manual as PDF

Download topic as PDF

Showback best practices for a Splunk deployment

Showback is a method of tracking Splunk utilization by an organization's business units or end users. Unlike chargeback, showback keeps track of utilization without actually cross-charging those costs back to the departments that use them.

A showback plan is a way to demonstrate that you are getting your money's worth from your Splunk investment. Metrics and cost tracking are a way to measure that value and allocate it to the users and beneficiaries of that value.

A showback practice is most effective for implementations with more than one constituency that are scoped as Splunk as a Service or Splunk as a Strategy. A showback plan may be more formal than is needed for Splunk-as-a-Solution deployments that serve only one team, group, or purpose. See Define a charter for your Splunk implementation for an explanation of charter levels.

Having a data-driven showback plan can be an effective way to foster positive competition among teams to make their Splunk usage more effective by challenging them to unlock more value per unit of cost. A showback plan should drive adoption and improve efficiency, not just track cost centers.

Audience

  • Executive sponsor
  • Program manager

For more about these roles, see Roles best practices.

Guidelines for implementing a showback plan

Here are some guidelines for implementing a successful showback plan.

Measure utilization on a scale

Start by establishing a benchmark for your Splunk usage. Your initial benchmark will be a guess, but as your user community spends time with Splunk, these estimates will become more accurate and detailed.

Next, design a measurement plan that matures over time. Start out with what you can easily measure, and add in things that are harder to measure over time when you have usage patterns on which to base your estimates. Communicate this plan to your user community. For example:

  • Years 1 and 2: measure license usage only
  • Year 3: measure license and hardware costs
  • Year 4: measure license, hardware, and support costs

This gives everyone in your organization time to establish their Splunk usage and value realization while getting licenses properly funded. Adjust the timing as needed.

Establish baseline agreements

Establish baseline data usage agreements
Include storage retention solutions and staff overhead.
Base license usage requirements on near-maximum usage
Using near-maximum measurements rather than averages will ensure that the baseline you establish has enough headroom for meeting daily volume obligations without exceeding license boundaries.
Provide a fixed chargeback cost and account for overages
This provides an incentive for users to be good citizens.
Avoid providing discounts for under-usage
This can drive less adoption.

Include a variety of factors in usage measurements

Keep measurements general
Include general usage measurements, such as license and overall memory usage. Avoid measuring minute details, such as the search runtime or memory usage of individual use cases.
Account for indirect usage
Factor in outside resources, such as storage retention solutions, hardware needs, and support usage.
Include predictions
Predictions help stakeholders see their growth over time. Predictions help set expectations, and keep planning and communications proactive.

Measure support time and grade on a scale

When measuring support time, design a plan that encourages adoption. If you measure support time at a flat rate, it can drive less adoption (for example, users may think if they use Splunk less, they will need less support and get charged less). You can grade groups based on percentage of certified users, search maturity, add-on support, and support time. This can build an incentive for users to increase their Splunk adoption. For example:

  • Group A wrote a power shell to pull exactly what they needed and maintained the app themselves so the support group didn't have to. Support time was trivial.
  • Group B spent less time learning and relied on the support group to build tooling for them. Support and training time was greater.

Next steps for implementing a showback plan

The Chargeback Analysis for Splunk app from Splunkbase is a great resource to start implementing a showback plan.

PREVIOUS
Service-level best practices for a Splunk deployment
  NEXT
Utility tier disaster recovery best practices for a Splunk deployment

This documentation applies to the following versions of Splunk® Success Framework: ssf


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters