icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Multicloud Cost Management for Splunk
SHA256 checksum (multicloud-cost-management-for-splunk_140.tgz) 375f72f8bb2e7a3885e549f1343ef491281c1792134cee9c181e464e9ceca5b5 SHA256 checksum (multicloud-cost-management-for-splunk_130.tgz) f5f3ad393dc02ac8efaeb2ecb51f191b49945de9d133c7bba3e308f8a978d318 SHA256 checksum (multicloud-cost-management-for-splunk_121.tgz) 623f9ba3f2e2a0d782fe67906aed37c324dd2bbe4f5daec671f2d072e933f269 SHA256 checksum (multicloud-cost-management-for-splunk_111.tgz) fdfe95007d656e445d9a73c2a834a4b4ff217cff1f22d71b932737b98a64a776 SHA256 checksum (multicloud-cost-management-for-splunk_102.tgz) 7860e7de3abe7c69512ff18b381cf91fc7789131900732ca343f8a5606c736d4 SHA256 checksum (multicloud-cost-management-for-splunk_10.tgz) 896ef9e2a56b6dde85fe890385307245936a4eac4f766dc8d9edb7aada561622
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

splunk

Multicloud Cost Management for Splunk

This app has been archived. Learn more about app archiving.
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
------------------------------------------------------
Developed by Apto Solutions Ltd.
------------------------------------------------------

The Multi-cloud Cost Management for Splunk App is designed to give insights into your spending across cloud services. It allows you to see which services are costing money unnecessarily in an attempt to make recommendations as where to make a reduction in spending throughout your Cloud Environments. The current cloud services that are supported are Amazon Web Services, Windows Azure, and Google Cloud.

This app provides a set of dashboards and saved searches to help to give insights into where savings could be found within your cross-cloud infrastructure without reducing the performance.

This app retrieves up to date costing from AWS, Azure and GCP using API calls to give accurate cost saving estimates based on recommendations regarding changes to your Cloud Infrastructure.

GBP and USD conversion is support across all cost estimations and summations. Conversion rates are onboarded hourly by default. Default values are also configurable. Fuctionality is also set to change the conversion rate on the fly.

Dashboards:
General Spending Overview - Shows historic spending trending

VM Instances - Shows data regarding unused VM's and what component of this VM is costing money

VM Utilization - Shows system utilization statistics suggesting which VM's should be investigated for downsizing

Volumes - Summarizes data surrounding unattached volumes and the accumulated cost of these

Elastic IPs - Displays information regarding both unused and unattached public ip addresses that cost money through reservation charges

MultiCloud Cost Management v1.4.0

This multicloud billing app is designed to give insights into your spending with cloud services. It allows you to see which services are costing money unnecessarily across AWS, Azure and Google Cloud environments.

It is important to note that this app will work for ANY combination of the previously mentioned Cloud Environments set up. ALL of them are optional. If you do not have all of these Cloud environments, only follow the instructions for the specific cloud environment(s) that you have.


Prerequisites

If your Splunk environment is on-premise (not Splunk Cloud) you'll need to ensure that the SPLUNK_HOME variable is set. This should be set to the top directory of your Splunk installation (e.g. /opt/splunk)

You must also have the required data onboarded. The data source requirements are listed below.


Data Source Requirements

Amazon Web Services

For AWS the Multicloud App requires that the Splunk Add-on for Amazon Web Services (AWS) is installed and configured. The following data sources are required.

  • VM Asset Data: AWS Description input with the 'aws:description' sourcetype. The specific API required is 'ec2_instances'.
  • Volume Asset Data: AWS Description input with the 'aws:description' sourcetype. The specific API required is 'ec2_volumes'.
  • IP Asset Data: AWS Description input with the 'aws:description' sourcetype. The specific API required is 'ec2_addresses'.
  • VM CPU Utilization Metrics: Cloudwatch input with the 'aws:cloudwatch' or 'aws:cloudwatch:metric' sourcetype. The specific Metric Namespace required is 'AWS/EC2'.
  • Billing Data: Billing (Legacy) input with the 'aws:billing' sourcetype.

Information on how to configure these data sources can be found on the documentation site for the Splunk Add-on for Amazon Web Services (AWS) here

Microsoft Azure

For Azure the Multicloud App requires that the Splunk Add-on for Microsoft Azure and Splunk Add-on for Microsoft Cloud Services are installed and configured. The following data sources are required.

  • VM Asset Data: Azure Resource input from the Splunk Add-on for Microsoft Cloud Services. The resource type required is 'Virtual Machine'.
  • Volume Asset Data: Azure Compute input from the Splunk Add-on for Microsoft Azure. The option required is 'Collect Managed Disk Data' with a sourcetype of 'azure:compute:disk'.
  • IP Asset Data: Azure Virtual Network input from the Splunk Add-on for Microsoft Azure. The option required is 'Collect Public IP Address Data' with a sourcetype of 'azure:vnet:ip:public'.
  • VM CPU Utilization Metrics: Azure Storage Table input from the Splunk Add-on for Microsoft Cloud Services. This requires a storage table setup within Azure to store VM metrics. Follow the instructions within the addon to achieve this.
  • Billing Data: Azure Billing and Consumption input from the Splunk Add-on for Microsoft Azure. This requires a sourcetype of 'azure:billing'.

Information on how to configure these data sources can be found on the documentation sites for the Splunk Add-on for Microsoft Azure and Splunk Add-on for Microsoft Cloud Services.

Google Cloud Platform

For GCP the Multicloud App requires that the Splunk Add-on for Google Cloud Platform is installed and configured. The following data sources are required.

  • VM Asset Data: Resource Metadata input required with a sourcetype of 'google:gcp:resource:metadata'. The specific API required is 'Instances'.
  • Volume Asset Data: Resource Metadata input required with a sourcetype of 'google:gcp:resource:metadata'. The specific API required is 'Disks'.
  • IP Asset Data: Unfortunately, IP Asset data is not easily supported through GCP and therefore is not used within this app.
  • VM CPU Utilization Metrics: Cloud Monitoring input with the specific Cloud Monitor Metric of 'compute.googleapis.com/instance/cpu/utilization'
  • Billing Data: Google Cloud BigQuery Billing input.

Information on how to configure these data sources can be found on the documentation site for the Splunk Add-on for Google Cloud Platform.


Installation Instructions

Download the app from Splunkbase.

Either unpack the app in $SPLUNK_HOME/etc/app or install the app from file using the App Manager Page.

First, go to the Inputs of this app, and input the appropriate information to onboard Azure, Google Cloud or AWS prices. To use the GCP pricing inputs you must enable Cloud Billing API within your project.

Configure the macro `aws_index` to search the index/indexes where your AWS data is stored.

Configure the macro `azure_index` to search the index/indexes where your Azure data is stored.

Configure the macro `gcp_index` to search the index/indexes where your Google Cloud data is stored.

This can be found in Settings -> Advanced Search -> Macros


Overview

Multicloud Cost Management for Splunk App is designed to give insights into your spending with cloud services. It allows you to see which services are costing money unnecessarily.

This app provides a set of dashboards and saved searches to help to give insights into where savings could be found within your cloud infrastructure without reducing the performance.

This app retrieves up to date costing from AWS, Azure and Google using API calls to give accurate cost saving estimates based on recommendations regarding changes to your Cloud Infrastructure.

GBP and USD conversion is supported across all cost estimations and summations. Conversion rates are onboarded hourly by default. Default values are also configurable. Fuctionality is also set to change the conversion rate on the fly.

General Spending Overview

This Dashboard displays an overview of your spending historically.

Clicking on a particular month on the column chart displays the breakdown of costs within that month.

VM Instances

On this page, we can see VMs that are being unutilised and what configurations on these instances are costing capital.

The Estimated cost of Stopped Instances per Month is calculated a predictor that takes all instances currently in the stopped state and extrapolates the cost of their downtime for the entire month.

On the Unused Instances panel, we can see instances that have not been utilised for a specified consectutive number of days and the cost of that accumulated downtime

VM Utilization

Here we can investigate which instances show low utilization. We look here specifically at low CPU usage of instances. We can filter to see where the max CPU and average CPU are less than a specific value.

We can then drilldown on a specific instance to see the cpu utilization over a customizable time range.

Volumes

Volumes that are unattached to instances still apply a cost to your accounts.

These panels show the extent of the volumes that are unused and the extent of the cost during the time in which they have been unused.

The Estimated Cost Per Month panel represents an estimated cost for all unused volumes extrapolated across the entire month.

IP Addresses

The IP Addresses dashboard displays information regarding both unused and unattached ip addresses.

Cloud services charge for the reservation of ip addresses when they are not in use.

This dashboard shows the accumulated cost of unassociated ip addresses, an estimate for the ip addresses that are not in use, and also the location of the unassociated ip addresses split by account.

If the duration of a IP address shows "Unknown", it is likely that the IP address has never been associated.


Contact Information

For any enquiries or requests for more customised billing, alerting and prediction please contact: apto_support@aptosolutions.co.uk

Release Notes

Version 1.4.0
Sept. 27, 2022

Data sources for all 3 providers have been updated. Please check the instructions and details page for the precise data needed for the dashboards to run.
All dashboards have been improved and a large number of bugs have been fixed.
Now jQuery 3.5 compatible

Version 1.3.0
May 19, 2020

Now compatible with Python 3 and Splunk version 8

Version 1.2.1
March 2, 2020

Allows aggregation of AWS, Azure AND Google Cloud Billing Data.

Version 1.1.1
Jan. 8, 2020

Now with the inclusion of data from Microsoft Azure Billing

Version 1.0.2
July 22, 2019

Minor Fixes - savedsearch ownership

Version 1.0
July 15, 2019

Initial release. First version for AWS only, Azure coming soon.


Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk LLC in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.