Track usage, use case, and savings

Track usage, use case, and savings with Cloud Monitoring Console.

Cloud Monitoring Console provides dashboards to help you track usage, use cases, and savings.

Access the Value Insights dashboard

Value Insights is part of the Cloud Monitoring Console (CMC). Use its menu to open the view you need.
  1. In Splunk Web, select Cloud Monitoring Console.
  2. In the CMC navigation, select Value Insights.
  3. In the Value Insights menu, select Usage, Use-cases & Savings or Optimization Advisor.

Review and personalize the value metrics panels

The value metrics panels are in the Usage, Use-cases & Savings view of Value Insights.

The value metrics panels provide an at-a-glance overview of key metrics. Each panel shows the current usage and the percentage by which usage has increased or decreased since the previous time interval.

You can prioritize metrics and personalize your experience:

  • Select the time interval that you want to review. By default, you are viewing the last 7 days, but you can also view the last day, last month, last quarter, or last year. Monthly, quarterly, and yearly intervals are calculated up to the beginning of the current day.

  • Click Add or remove metrics to customize the metrics that are displayed on the dashboard.

  • Click Filter category to filter the results. You can view all metrics, usage metrics only, or use case metrics only, or Savings metrics only.

  • Open the savings metrics calculation view to review and edit the values used to calculate the savings metrics for your environment.

These preferences are set at the user level, which enables different users to configure the dashboard according to their own requirements.

By default, the dashboard displays Top use case domain, Use case categories, Daily active users, Search automation Savings, and Troubleshooting savings. You can also choose from the following additional metrics:

  • Regularly used apps
  • Regularly used dashboards
  • Searches over time
  • Total use case categories
  • Users using AI assistant

For detailed information about these metrics, refer to Review Use case coverage and Review Splunk Usage Metrics.

Review the Use case coverage

Review the use cases that are currently addressed with Splunk software.

The Use case coverage tab provides graphs to help you understand the areas in which you are delivering business outcomes, such as application monitoring, threat detection, and data analytics. The use case domains and categories are defined by Splunk Lantern. With this information, you can refine your implementation, tailoring searches and dashboards to your needs.

Use the Time comparison and Chart type drop-down menus to set your preferences for how you want to view the data. You can compare usage by day, week, month, quarter, or year.

You can also discover new use case capabilities that you can implement, based on your existing ingested data. Click the FInd new use cases button to open the Use Case Discovery dashboard.

See the following table to learn about each type of use case information that you can select:

Panel Description
Use case domains

Activity in the use case domains in the currently selected time interval, compared with the activity for the previous interval. This metric shows the business areas that are most engaged with Splunk tools.

A domain is a high-level class of use case types. The domains are:

  • Platform
  • Security
  • Observability
  • Unclassified.

Unclassified sourcetypes are those that are not currently mapped to a known domain. Use case domains can be viewed as column charts or stacked column charts.
Use case categories

The total number of use case categories that are actively searched in your environment. This metric shows the diversity of Splunk usage across your organization’s functional needs.

Use cases include Anomaly Detection, Security Monitoring, Threat Hunting, Compliance, Incident Management, or Troubleshooting Mission-Critical Apps, and more.

This panel also includes a bar graph that shows the top 10 most active use cases in the current week, sorted by the number of capabilities linked to each use case.

Use case categories can be viewed as line charts or column charts.

The Splunk Lantern Customer Success Center has additional information about use case categories, data sources, and data types.

Review the Savings Metrics

Understand the Splunk Savings Metrics graph.

The Splunk saving metrics tab provides graphs that track how your organization is gaining savings via Splunk use.

Use the Time comparison and Chart type drop-down menus to set your preferences for how you want to view the data and the time intervals that you want to compare. You can select a line graph, a column chart, or a stacked bar chart.

  1. See the following table to learn about each metric that you can select:
    Option Description
    Troubleshooting savings Use this metric to understand the estimated time and dollar value saved when Splunk helps users investigate and troubleshoot issues more efficiently. This metric includes troubleshooting-related searches, including ad hoc searches and saved troubleshooting searches.
    Note: As a best practice, customize the assumption used in the calculations to align with your organization.
    Search automation savings Use this metric to understand how much time Splunk saves when saved and scheduled searches run automatically instead of requiring manual execution. This metric displays hours saved and the equivalent Full-Time Equivalent (FTE) value.
    Note: As a best practice, customize the assumption used in the calculations to align with your organization.
    Phishing attack detection savings Use this metric to understand how much cost is avoided when you use Splunk Enterprise Security to complete automated ES phishing workflows . This metric displays dollars saved when automated phishing workflows stop attacks.
    Note: Install Enterprise Security version 8.5 or higher to show this metric. As a best practice, customize the assumption used in the calculations to align with your organization.
  2. Review how the savings metrics are calculated.

    Open the savings metrics calculation view to review the formulas behind the savings metrics and update the values used in the calculations.

    In this view, you can:

    • Review how each savings metric is calculated.

    • Edit the values used in the calculations.

    • Validate the values that you enter.

    • Reset the calculation values to the default settings.

  3. Interpret the savings metrics.

    Use the savings metrics as directional indicators of the value delivered during the selected time interval.

    • Compare the current period with the previous equivalent period to understand whether savings are increasing or decreasing.

    • Review the savings metrics together with the usage and use case metrics to understand both adoption and value.

    • Review the calculation values before sharing the metrics with stakeholders if your organization wants the dashboard to reflect different assumptions.

Review the Splunk Usage Metrics

Understand the Splunk Usage Metrics graph

The Splunk usage metrics tab provides graphs that track how your organization is leveraging Splunk, including app and dashboard usage, daily active users, and AI assistant activity. Each panel also includes a Top Ten bar chart for each metric.

Use the Time comparison and Chart type drop-down menus to set your preferences for how you want to view the data and the time intervals that you want to compare. You can select a line graph, a column chart, or a stacked bar chart.

See the following table to learn about each metric that you can select:

Panel Description
Regularly used apps

Regularly used apps are those that have been used daily for at least 10% of the selected interval.

The usage metrics show whether your organization is maximizing or underutilizing the available Splunk tools. Understanding this information can help you ensure your organization is leveraging the correct apps to support your objectives.
Regularly used dashboards

Regularly used dashboards are those that have been accessed at least once per day for at least 10% of the selected interval.

The usage metrics reflect your organization's engagement with the available dashboards. Underutilization of dashboards may result in users missing key insights.
Daily active users

An active user is a unique individual that accesses your Splunk deployment. This metric shows the distinct count of users who log into and actively use Splunk each day.

A higher number of daily active users shows that your organization's user base is highly engaged with Splunk, deeply integrating the tools into their workflows.
Users using AI assistant

This graph shows the adoption of the Splunk AI Assistant by the users in your organization. The metrics reflect user engagement with the Splunk AI tools
Searches over time

The number of searches run over time is a key indicator of user engagement, analytic activity, and overall utilization.

Consistent increases in the number of searches indicate that users are highly engaged and are regularly accessing Splunk tools and information.

Discover new use cases and capabilities

Explore Splunk software capabilities on the Use case discovery dashboard

Open Usage, Use-cases & Savings in Value Insights to access the Use case discovery dashboard.

The Use case discovery dashboard

This dashboard enables you to see how your data maps to Splunk Lantern use cases and helps you explore capabilities related to those use cases.

A use case capability is a specific analytic function or solution. The Value Insights feature identifies capabilities with the data already ingested in your Splunk environment, mapping your sourcetypes to Splunk Lantern use cases. You can think of each capability as an opportunity to improve business and operational outcomes by leveraging your existing data more effectively.

See the following table to learn about the features of this dashboard.

Panel Description
Use case capabilities supported by data The number of use cases that you can implement, based on the data in your environment.
Top categories to expand A summary of the categories with the most capabilities that you can implement.
Your bookmarked capabilities Capabilities that you have bookmarked. Bookmark a capability to prioritize it for later implementation.

Use case capability details

This table lists all use case capabilities that you have implemented or are ready to implement. Click the tabs at the top of the table to view All capabilities, Ready to implement capabilities, Implemented capabilities, and Bookmarked capabilities. You can further filter the table by Domains and Category from the drop-down menus.

Column Description
Capability name The name of the capability, as defined by Splunk Lantern.
Implementation status May be Implemented or Ready to implement
Mark as implemented A manual toggle to mark whether you have implemented the capability. This status is saved at the stack level.
Note: Switching the toggle does not automatically implement the capability. For implementation steps, refer to the capability's documentation. For more information, see Identify and implement a use case capability.
Domain A domain is a high-level class of use case types. The domains are:
  • Platform
  • Security
  • Observability
  • Unclassified (not currently mapped to a known domain)
Category Use cases include Anomaly Detection, Security Monitoring, Threat Hunting, Compliance, Incident Management, or Troubleshooting Mission-Critical Apps, and more.
Action Available actions, including:

  • A link to the Splunk Lantern documentation for the capability, where you can learn the implementation steps.

  • A bookmark icon to mark capabilities that you are interested in. Bookmarks are saved at the stack level.

Identify and implement a use case capability

Use the Use Case Discovery dashboard to identify and implement a new use case capability

The Use case discovery dashboard uses the data already ingested in your Splunk environment to identify analytic functions or solutions that you can implement in your environment. To use the dashboard to identify and implement a use case, follow these steps.
  1. Locate the capability that you want to use in the Use case capability details table. Filter the table with the tabs and the drop-down menus to refine your search.
  2. In the Action column, click the link to the capability's documentation in Splunk Lantern.
  3. Follow the steps in the Lantern documentation to implement the capability.
  4. When you have finished implementing the capability, return to the dashboard and use the Mark as implemented toggle in the table to show that the implementation is complete.
When you review the list of capabilities, you decide that you want to implement the capability for the "Expected host not reporting events" use case. You bookmark this capability so that you can quickly refer to it later. Clicking the documentation link in the Action column takes you to the page for that use case. You follow the steps on that page to implement the capability. When you have completed this work and are satisfied with the results, you return to the Use case discovery dashboard and mark it as implemented.

Review the optimization opportunities

In Usage, Use-cases & Savings, review the Optimization opportunities section for sourcetypes that might be underutilized. The section identifies sourcetypes with 0 searches in the past 30 days. You can edit this threshold in Splunk Web. Some search activity might not be fully captured, so review results carefully before taking action.

Optimization Opportunity Description
Underutilized sourcetypes Displays all source types identified as underutilized by Splunk, defined as those with 0 searches in the past 30 days. You can edit this threshold in Splunk Web.
Note: Some search activity might not be fully captured. Review results carefully before taking action. This section appears empty if condition is not met.

To review license capacity options and projections, see Use the Optimization Advisor dashboard.

Export Value Insights reports

Save a Value Insights reports as a PDF.

To create and export a Value Insights report, perform the following steps:
  1. Select the time interval for which you want to generate the report.
  2. Click the Export to PDF button in the upper right corner of the dashboard.
  3. If prompted by your browser, save the PDF.