Workload Pricing and SVCs: What You Can See and Control

Share:

By Anna Mensing September 13, 2021

The Cloud Monitoring Console (CMC) lets Splunk Cloud Platform administrators view information about the status of a Splunk Cloud Platform deployment. For workload pricing, the CMC lets you monitor usage and stay within your subscription entitlement. From the CMC you can see both ingest and SVC usage information and can gain insight into how your Splunk Cloud Platform deployment is performing.

Nearly anything you do within your environment will improve your workload yield: by simply running more searches you'll use more SVCs than ingest. Additionally, you can write more efficient searches (i.e., using more tightly constrained time ranges), which use less SVCs. Finally, app hygiene is another way to improve workload yield. Removing unused apps to improve SVC usage is a good start. Using apps that come with accelerated searches turned on by default can also help, as well as apps that have extra knowledge objects (i.e., tags, sourcetypes). You can learn more about how to manage your console here.

Monitor your SVC usage by navigating to Cloud Monitoring Console > License Usage > Workload. From here you'll be able to see the following usage panels:

Hourly SVC usage:

SVC usage, ingest vs search hourly:

SVC usage by search type:

SVC usage split by index or sourcetype:

SVC usage split by Top 10 Apps, Searches, or Users:

Levers You Can Use to Change SVC Usage

There are several aspects of an efficient and healthy Splunk Cloud Platform stack. The more efficient a stack is, the more value you will get out of each SVC. Here are the main ways you can get more efficient with your SVCs:

Considerations for improving the search profile:

• Search frequency: how often searches are running
  
• Search density: how many data sources and how wide of a time range your searches run against
  

Practical tips to better search SVC usage:

• Review Long Time Running Searches and optimize the SPL
  
• Review Skipped Searches and adjust the frequency or scheduling
  
• Disable Unused Scheduled Searches
  
• Remove unused Apps and Technology Add-ons
  
• Tune DataModels to search only the indexes needed.
  

Considerations for improving the ingest profile:

• The quality of data ingest matters
  
• Transformation of data ingest required to draw insights
  

Practical tips to better ingest SVC usage:

• Review the quality of the data ingested and fix it at the source. Fixing data quality issues is possible in Splunk but it will consume more SVCs.
  
• Time stamp quality
  
• Line breakers
  

You can learn more about search and ingest through the following courses we offer:

• The Splunk Admin education courses teach our best practices for running a healthy Splunk environment.
  
• Splunk Fundamentals 1 and 2 will help your users and power users build more efficient searches, reports, alerts and dashboards. This will greatly improve your SVC usage.
  
• Leverage Admin on Demand or Professional Services when needed
  

You can also take advantage of the prebuilt dashboards in the CMC. There are also prebuilt views of both search and ingest health. Every item represented in the CMC is an aspect of Splunk that you can control.

To Sum It Up

It's easy to see how the workload pricing model allows you to truly unlock the power of the Splunk Cloud Platform - all with complete control to monitor and manage your usage through the CMC.

Read on for more information about the workload pricing model and what makes up Splunk Virtual Compute (SVCs) in What is Splunk Virtual Compute (SVC)?.