The bill keeps growing, and nobody owns it
Most Splunk and Cribl bills grow for a simple reason: data gets added when something breaks or a new service ships, and almost nothing ever gets removed. Nobody is tasked with asking whether the bill still matches the value.
A cost audit is a structured look at that gap. This post walks through what ours covers, so you know what to expect and can start on some of it yourself.
What the audit looks at
1. Where the data comes from
We start with an inventory: every source, how much it sends, and who uses it. The result is a ranked list of sources by volume, next to a note on whether anyone searches, alerts on, or reports from that data. High volume with no consumer is the first place savings tend to hide.
2. License and tier fit
Depending on your agreement, Splunk may be licensed by daily ingest, by compute workload, or under other models. We check that the model and tier still match how you use the platform, and whether you pay for premium add-ons that see little use. Renewal timing matters here, because it decides when changes can take effect.
3. Pipeline waste
Verbose debug logging, duplicate events, fields nobody searches, and chatty sources are common. A pipeline tool like Cribl Stream can drop, trim, sample, or aggregate events before they reach the indexer, and route lower-value data to cheaper storage. We identify which candidates look safe, and flag anything your compliance or security teams may need to keep.
4. Searches and dashboards
Scheduled searches and dashboards use compute and attention. We look for jobs that run on a schedule while nobody opens the results, expensive searches that could be rewritten or accelerated, and dashboards with no recent viewers.
5. Alert noise
For each alert, we ask one question: when it fires, does someone act? Alerts that fire often, get muted, or lead to no action train a team to ignore pages, and that is how real incidents get missed. We rank alerts by how often they fire and how often anyone acts, then recommend what to retune, merge, or retire.
6. Retention and storage
We compare how long data is kept against how long it is needed, whether for searching, compliance, or investigation. Older data can often move to cheaper storage or a shorter retention window without affecting anyone.
What you receive
- A written report on what we found in each of the six areas
- A prioritized savings list, ranked by estimated impact and effort
- A roadmap you keep, whether or not you continue with us
What the audit does not do
The audit is a review and a plan, not a migration. Large changes are scoped and quoted separately as fixed-price projects. Decisions about what data to keep stay with you, especially anything tied to compliance or security investigations.
When it makes sense
An audit is worth doing if your renewal is coming up, your ingest keeps climbing, or your team has stopped trusting its alerts.
Next step
The two-week audit is a fixed fee of $3,500, and the fee credits toward your first quarter if you continue. If you would rather start smaller, we offer a free 30-minute cost-leak review.
Book the two-week audit · Start with a free 30-minute review · See how fractional observability works