The Splunk ROI

Splunk customers typically achieve an ROI measured in weeks or months, sometimes even before deploying Splunk into production. The source of ROI varies as much as how they use Splunk — keeping critical web services up and running, lowering operations costs, quickly investigating security incidents, providing valuable analytics and insights to business people, eliminating maintenance costs of legacy software ... the list goes on.

Our customers typically achieve fast payback from their very first Splunk use case, and then expand their use. The ROI is often comprised of multiple business and financial benefits, such as:

• Reduce Costs: dramatically higher productivity, eliminate legacy software costs, reduce fraud and abuse, reduce SLA violation penalties ...
• Increase Revenue: dramatically reduce downtime of revenue-producing services and e-commerce sites, offer new services, reduce customer churn ...
• Better Support the Business: new real-time business insights for execs, marketing, sales and others; meet compliance mandates, better protect the business ...

This top global money management firm is using Splunk to troubleshoot customer issues. They dramatically reduced escalations beyond Tier 1 support. As a result they were able to redeploy 70 Tier 2 and higher support people to more important tasks such as development, saving $3 million over 2 years.

A major financial/credit information company decreased its average downtime per incident from 89 to 11 minutes (90% reduction) with Splunk. For a service that generates $20,000 in revenue per minute the reduced downtime represents a savings of millions of dollars per year in extra revenue.

This top online retailer is using Splunk to proactively monitor their website, e-commerce and application infrastructure. With Splunk they eliminated downtime during peak shopping periods and avoided lost revenues of $300,000 per incident.

This top five US wireless carrier uses Splunk to optimize their call routing, "Lowest cost routing has direct impact on bottom line—saving hundreds of thousands of dollars per month." They also use Splunk to analyze their CDRs (call detail records) and reconcile them with the charges they receive from their inter-carrier partners.

One of the world's largest business publishers replaced their old server monitoring software with Splunk and other open source software. This eliminated large annual software maintenance payments and lowered server management costs by 60%, saving $1.6 million/year.

This large mutual fund is using Splunk for compliance review. They were able to reduce staff dedicated to this area, and Splunk paid for itself in 60 days.

A major communications equipment manufacturer brought Splunk in for security monitoring and investigations and avoided a $1.5M software license upgrade for their existing SIEM. In addition, they were able to reassign 5 full-time security analysts to other duties ($600,000 savings/year) and are now able to monitor new data sources to identify previously unknown attacks.

For a large services provider, "Splunk was up and running on commodity hardware in 2 weeks. Our incumbent product would have required an 8-month services engagement."

This SaaS provider first used Splunk to monitor/improve application performance. By further taking advantage of their machine data with Splunk, they can now proactively monitor for renewal risks. Today, account managers are notified when large customers are infrequently using the service. With Splunk they can also provide new services to their customers, such as tracking email campaigns.

This wireless service provider first deployed Splunk to monitor for sophisticated security threats. Soon thereafter they used Splunk to create in one day real-time executive-level dashboards showing new account activations by minute, region, service plan, handset type, etc. This brand new capability is being used by execs and marketing people to better promote and run the core business.

This large telecommunications provider initially brought Splunk in to help monitor and manage their network and services. They are now using Splunk to identify and eliminate service abusers (peer-to-peer/Torrent downloaders, roaming abusers). "Splunk is the one place we go to find our heaviest 'users' and 'abusers.' Within the first month the ROI we gained on fraud detection was enough to pay for Splunk."

A top university switched to Splunk to store, analyze and report on their IT (SMARTS) data. As a result, they saved $100,000 in relational database and reporting software costs, and freed up server hardware.

This major energy utility brought in Splunk and was able to eliminate 6 other tools. The maintenance cost savings paid for Splunk—a much more flexible solution that also helped them meet NERC and SOX compliance mandates and enhance security.

After trying for 6 months to use traditional web analytics software, this media company created the dashboards and reports needed to run their online media business in just a few days. Splunk was able to track the digital assets on their web pages—video and audio program views, perform the required royalty accounting, and help them better market their content.

Splunk helped this cable MSO identify content delivery network issues that were causing serious revenue losses. They used Splunk to determine 1,000s of dropped video views, before the revenue-producing advertisements could be served, and determined the issue was network latency problems with their CDN supplier.

For this major telco, Splunk more than paid for itself by helping them identify problems in their dev/test environment before moving to production. "Splunk dashboards show trend visualizations and indicate when something will stop working, that's priceless."

Before Splunk, VMware routinely had to restart over twenty servers one by one, over a six-hour period, to eliminate downtime for their critical software license provisioning system. Now with Splunk they identify the root cause in minutes, and can alert for this issue and restart a single server if necessary.

If we solve a problem in one minute versus 30 minutes during peak hours—Splunk pays for itself.

Abuse traffic dilutes our ad rates and diminishes revenue. With Splunk we were able to eliminate 400,000 pages of abuse traffic daily.

Splunk was able to give this major insurance company a combined view of their physical and virtual environments, greatly reducing downtime.

This large network services provider can now monitor in real-time true SLA levels, provide reports to their customers, and prove and avoid unjustified SLA violation claims/penalties.

Using Splunk in their CSIRT (computer security incident response team), Cisco now monitors information and events previously impossible to track and investigate—improving company security and security staff productivity.

Splunk has helped us identify spam profiles and led to a 98% overall reduction in spam.

Splunk has helped us recognize a 90% reduction in time taken to trace an email message.

Splunk reduced our escalations by 90% and our problem resolution time by 67%"

CVS Caremark used a schema-based RDBMS-based Big 4 solution for PCI audits that proved inadequate. Splunk provided the flexibility they needed, helping them pass two PCI audits in a row.

As we are moving to an 85-90% virtualized infrastructure— Splunk can pull VM host data and correlate it with physical infrastructure data for a complete view of our environment. Splunk helps me to understand and solve issues before we face downtime.