Skip to main content


Splunk Lantern

Showing the value of your Splunk deployment


Create a showback plan to demonstrate that you are getting your money's worth from your Splunk investment.

Showback is a method of tracking Splunk utilization by an organization's business units or end users. Unlike chargeback, showback keeps track of utilization without actually cross-charging those costs back to the departments that use them.

A showback plan is a way to demonstrate that you are getting your money's worth from your Splunk investment. Metrics and cost tracking are a way to measure that value and allocate it to the users and beneficiaries of that value.

A showback practice is most effective for implementations with more than one constituency that are scoped as Splunk as a Service or Splunk as a Strategy. A showback plan may be more formal than is needed for Splunk-as-a-Solution deployments that serve only one team, group, or purpose. See Defining a charter for your Splunk implementation for an explanation of charter levels.

Having a data-driven showback plan can be an effective way to foster positive competition among teams to make their Splunk usage more effective by challenging them to unlock more value per unit of cost. A showback plan should drive adoption and improve efficiency, not just track cost centers.


  • Executive sponsor
  • Program manager

For more about these roles, see Setting Roles & Responsibilities.

Guidelines for implementing a showback plan

Here are some guidelines for implementing a successful showback plan.

Measure utilization on a scale

Start by establishing a benchmark for your Splunk usage. Your initial benchmark will be a guess, but as your user community spends time with Splunk, these estimates will become more accurate and detailed.

Next, design a measurement plan that matures over time. Start out with what you can easily measure, and add in things that are harder to measure over time when you have usage patterns on which to base your estimates. Communicate this plan to your user community. For example:

  • Years 1 and 2: measure license usage only
  • Year 3: measure license and hardware costs
  • Year 4: measure license, hardware, and support costs

This gives everyone in your organization time to establish their Splunk usage and value realization while getting licenses properly funded. Adjust the timing as needed.

Establish baseline agreements

Establish baseline data usage agreements

Include storage retention solutions and staff overhead.

Base license usage requirements on near-maximum usage

Using near-maximum measurements rather than averages will ensure that the baseline you establish has enough headroom for meeting daily volume obligations without exceeding license boundaries.

Provide a fixed chargeback cost and account for overages

This provides an incentive for users to be good citizens.

Avoid providing discounts for under-usage

This can drive less adoption.

Include a variety of factors in usage measurements

Keep measurements general

Include general usage measurements, such as license and overall memory usage. Avoid measuring minute details, such as the search runtime or memory usage of individual use cases.

Account for indirect usage

Factor in outside resources, such as storage retention solutions, hardware needs, and support usage.

Include predictions

Predictions help stakeholders see their growth over time. Predictions help set expectations, and keep planning and communications proactive.

Measure support time and grade on a scale

When measuring support time, design a plan that encourages adoption. If you measure support time at a flat rate, it can drive less adoption (for example, users may think if they use Splunk less, they will need less support and get charged less). You can grade groups based on percentage of certified users, search maturity, add-on support, and support time. This can build an incentive for users to increase their Splunk adoption. For example:

  • Group A wrote a power shell to pull exactly what they needed and maintained the app themselves so the support group didn't have to. Support time was trivial.
  • Group B spent less time learning and relied on the support group to build tooling for them. Support and training time was greater.

Next steps for implementing a showback plan

The Chargeback Analysis for Splunk app from Splunkbase is a great resource to start implementing a showback plan.