Splunk tools and apps
Splunk solutions built by August Schell
Planning tools and Splunk apps our engineers built from real customer work. Size a deployment, plan a move to Splunk Cloud, measure what IEV is worth on your Cisco data, and migrate indexed data with proof that every day of it arrived.
Start here
Which one do I need?
The solutions
Two planners in your browser, two apps for your Splunk
The planners are free and need nothing installed, and nothing you enter leaves your browser. The apps run inside your own Splunk deployment, under your own sign-in.
Splunk Sizing Calculator
For Splunk Enterprise
Size a self-managed Splunk Enterprise deployment from daily ingest, retention and search load, using Splunk’s published sizing guidance.
- Indexer and search head counts
- Hot, warm, cold, frozen and SmartStore storage
- Enterprise Security, ITSI and SOAR sizing
- Server bill of materials and a matching indexes.conf
Requires Nothing to install. No sign-up.
Splunk Cloud Ingest Planner
For Splunk Cloud Platform
Work out which data sources Splunk Cloud collects for you, which need a collector of yours, and what your teams need to do.
- Collector servers for syslog, flow and databases
- Firewall rules to request
- Peak internet bandwidth
- Migration work items by team
Requires Nothing to install. No sign-up.
IEV Evaluation App
For Splunk Enterprise or Splunk Cloud
Measure how much of your ingest is eligible Cisco data, what that does to effective license consumption, and where you can claim more.
- Eligible Cisco ingest and estimated savings
- Cisco data on the wrong sourcetype, listed for cleanup
- Daily history beyond the usual 30 days of license logs
- Installs on the search tier only
Requires Splunk Enterprise 9.2 or later, or Splunk Cloud Platform, on an ingest-based license.
Data Migration Toolkit for Splunk
For Splunk Enterprise
Move Splunk data to new servers, such as Windows to Linux, a new cluster or new hardware, and verify every day of it on the other side.
- Discovery and a plan before anything moves
- Copies while Splunk keeps running, each file checked on arrival
- PASS or FAIL report of event counts per index and day
- Old servers stay in place until you are satisfied
Requires Splunk Enterprise 9.0 or later. Not for Splunk Cloud or SmartStore indexes.
How we help
From a first estimate to finished work
- 1
Start with a tool
Use a planner in your browser, or request one of the apps for your own Splunk environment.
- 2
Review the results with us
Our engineers check the numbers against your environment and tell you where the estimate needs a closer look.
- 3
Deliver the work
We scope, run or review it with you, from sizing a new deployment and planning a Splunk Cloud move to an IEV evaluation or a data migration.
Talk to a Splunk engineer
Every tool here comes from work we deliver for customers. Tell us what you are planning and we will help you get it right.
Splunk, Splunk Enterprise, Splunk Cloud Platform and Splunk Enterprise Security are trademarks of Splunk LLC, a Cisco company. Cisco is a trademark of Cisco Systems, Inc. August Schell is an independent systems integrator. These tools are not affiliated with, endorsed by or sponsored by Splunk or Cisco. Results are planning estimates, so validate them before you buy hardware or change a license.