Splunk App for Chargeback

The Splunk App for Chargeback aids customers in both Splunk Enterprise and Splunk Cloud Platform to better understand their license usage by categorizing it usage by business units and departments. To access bonus videos from conf23, click on the "Details" tab. IMPORTANT NOTES: 1. The document is now integrated into the app, accessible from the home dashboard. 2. For an optimal experience, consider installing the app independently. Search for "chargeback" among available apps, then click "Install" next to the Splunk App for Chargeback. Refer to the document on the home page for guidance. 3. If you're comfortable reviewing a slightly older document, visit this site: https://docs.splunk.com/Documentation/ChargebackApp/current/Use/Overview Description Splunk App for Chargeback provides an easy-to-use experience to analyze how internal business units are leveraging Splunk. The App provides the framework necessary for Chargeback and/or Showback use cases for: 1. Splunk Workload Pricing (Splunk Enterprise = vCPU, Splunk Cloud = SVC) 2. Splunk Ingest Pricing (Splunk Enterprise & Splunk Cloud) 3. Dynamic Data: Active Searchable (DDAS) 4. Dynamic Data: Active Archive (DDAA) 5. Dynamic Data: Self-Storage (DDSS) 6. SmartStore The app provide the following functionally to all Splunk customers: - Framework for customers to build their own Chargeback and/or Showback models - Means to determine how many SVCs/vCPUs are allocated to various business units, departments, and users in those departments [Accounting]. - Means to automatically determine how a Splunk stack's resources are being used by the various business units [Utilization]. - Ability to drill-down and break down the usage starting at the highest level in the business all the way down to the user level - Ability to forecast SVC/vCPU usage for the entire organization and by business unit using Splunk Machine Learning - Accurately maintained up-to-date list of identities along with corresponding Business Unit & Department information by way of indexing the data from a source like DB Connect or Active Directory ODS Support You can open an ODS request under task Install/Configure App or TA/Add-On in the support portal (https://www.splunk.com/pdfs/professional-services/splunk-ondemand-services-portal.pdf). Select after choosing Pick your Product = Splunk Core - Enterprise/Splunk Cloud. Enter under the subject/description that you need help configuring the Splunk App for Chargeback specifically. Feedback is always welcome and appreciated.