Use Internet2 SiteID

Already have an Internet2 SiteID?
Sign in here.

Internet2 SiteID

Your organization not listed? Create a local account to use Internet2 services.

Create SiteID


Service Type:
Security & Identity
General Availability
Eligible Subscribers:
Internet2 Member or Other R&E Participant
Baylor University, California Polytechnic State University - San Luis Obispo, Indiana University, University of Illinois - Urbana-Champaign, University of Washington
Nick Lewis

NET+ Splunk Offering

Internet2 member and non-member schools can buy on-premise Splunk Enterprise software at a discounted, 3-year term basis. Refer to the fees section for details. Member institutions can also benefit from further reduced pricing should they increase their Splunk usage through the NET+ program.

In addition, there is the “waterfall” pricing model, meaning as more Internet2 Member institutions increase their usage of Splunk through the NET+ program the pricing will be reduced further from the already substantially discounted prices.

Plus, Internet2 Members using Splunk can access free eLearning classes. Learn more.

About Splunk

Splunk Inc. is the market-leading platform that powers Operational Intelligence. We pioneer innovative, disruptive solutions that make machine data accessible, usable and valuable to everyone.

Machine-generated data is one of the fastest growing and complex areas of big data. It's also one of the most valuable, containing a definitive record of all user transactions, customer behavior, machine behavior, security threats, fraudulent activity and more. Splunk turns machine data into valuable insights. It's what we call Operational Intelligence.

Machine data provides an untapped opportunity for institutions of higher education. Campus networks, infrastructure, applications, servers, learning management systems and end-user devices generate huge volumes of data that—when leveraged—can provide unparalleled insight into problems, usage patterns and trends across an entire campus IT infrastructure.

Higher education institutions use Splunk to:

  • Identify problems, risks and opportunities to drive lower costs and provide more effective operations
  • Detect security risks and network abuse
  • Improve student and faculty experience across all systems used
  • Manage and monitor machine data from multiple sources
  • Collect and audit data to meet regulatory requirements

General Information

Splunk Enterprise is a fully featured platform that collects and indexes any machine data from virtually any source in real time. Search, monitor, analyze and visualize your data to gain new visibility, insight and intelligence. Index everything for deep visibility, forensics and troubleshooting. Create ad hoc reports to identify trends or prove compliance controls. Create interactive dashboards to monitor for security incidents, service levels and other KPIs. Analyze student transactions, user behavior, machine behavior, security threats and fraudulent activity, all in real time.

Index Any Data

Index any machine data regardless of format or location—logs, clickstream data, configurations, traps and alerts, change events, the output of diagnostic commands, data from APIs and message queues and even multi-line logs from custom applications. With no predefined schema, data can be indexed from virtually any source, format or location. Then it's available for troubleshooting, security incident investigations, network monitoring, compliance reporting, business analytics and other valuables uses.

Search and Investigate

Search real-time and historical data using the same search interface. Use familiar search commands to define, limit or widen your search. Search doesn't stop there. Use statistical reporting commands, update transaction counts and calculate metrics and even look for specific conditions within a rolling time window. The search assistant offers type-ahead suggestions and contextual help so that you can leverage the full power of the search processing language.

Interact with Search Results

Interact with your search results in real time. Zoom in and out on a timeline of your results to quickly reveal trends, spikes and anomalies. Click to drill down immediately into your results and eliminate noise to get to the needle in the haystack. Whether you're troubleshooting a ticket, investigating a security alert, or simply discovering your data, you'll get to the answer in minutes rather than hours or days. And avoid the need to escalate to other groups to get the data you need.

Add Knowledge

Splunk automatically extracts knowledge from your machine data at search time. You can add more knowledge and meaning by identifying, naming and tagging fields and data points. You can even add information from external asset management databases, configuration management systems and user directories.

Correlate Complex Events

Splunk search makes it easy to establish or find relationships between seemingly unrelated events or activity. Use Splunk to correlate based on time, external data, sub-searches or joins. Identify related events as a transaction or session. Visualize trends and characteristics in reports and dashboards.

Monitor and Alert

Turn searches into real-time alerts and automatically trigger notifications via email or RSS, execute remedial actions, send an SNMP trap to your system management console or generate a ticket at a service desk. Alerts can trigger based on a variety of threshold, trend-based conditions and other complex searches.

Report and Analyze

Use the integrated report builder to quickly build advanced graphs and charts to visualize important trends, see highs and lows, create sparklines, summarize top values or the frequency of conditions. Create robust, information-rich reports from scratch without any advanced knowledge of search commands. Save reports, integrate them into dashboards and share them with management or other colleagues via PDF. Built-in acceleration technology delivers your mission-critical insights when it's needed.

Custom Dashboards and Views

Create live dashboards in a few clicks with the dashboard editor. Dashboards integrate multiple charts and views of your real-time data for the needs of different users—technical and non-technical. You can personalize dashboards for anyone and share them via PDF. Or view and edit them on tablets, smartphones and non-Flash browsers.

Splunk Apps

Do more by taking advantage of hundreds of apps and other content that run on top of the Splunk platform. These apps deliver a targeted user experience for different roles and use cases. There are a growing number of apps, built by our community, partners and Splunk—browse what's out there or even create and post your own, all through the Splunk Apps website (


The price of the Internet2 NET+ Splunk offering is based upon the amount of data indexed PER DAY; there are no charges for number of users, number of CPUs/cores/nodes, data sources or data types, number of searches or volume of data searched. And there is no charge for the total amount of data you store in your Splunk instance. Once you have licensed your Splunk offering, you can have as many people as you want use the software and create as many searches, alerts, correlations, reports, dashboards and automated remedial actions as you need, at no additional cost. To receive this pricing, schools must commit to three years of the Splunk offering, paid annually. To help universities with predicting demand for data indexing needs, onboarding licenses for evaluating the Splunk offering are available. Please see the FAQ or email if you have additional questions on pricing.

Internet2 Member - Fees for Software and Support - 3 Year Term License

Tier (GB) Fees for Software and Support
(total amount, payable over three years in annual installments)
Example Annual Payment $/GB/YR
20 $43,680 $14,560/YR 728
50 $69,150 $23,050/YR 461
100 $109,200 $36,400/YR 364
200 $204,000 $68,000/YR 340
500 $472,500 $157,500/YR 315
1,000 $873,000 $291,000/YR 291

Non-Internet2 Member - Fees for Software and Support - 3 Year Term License

Tier (GB) Fees for Software and Support
(total amount, payable over three years in annual installments)
Example Annual Payment $/GB/YR
20 $50,553 $16,851/YR 843
50 $80,043 $26,681/YR 534
100 $126,384 $42,128/YR 421
200 $235,914 $78,638/YR 393
500 $547,659 $182,553/YR 365
1,000 $1,011,063 $337,021/YR 329

One-time Startup Cost

Internet2 Member Universities wishing to purchase any tier of the NET+ Splunk offering must also pay a one-time education fee of $8,000, which buys 16 training credits to be used on WebEx classes led by NET+ Splunk instructors.  16 credits is enough to train one contact as a Splunk Architect, but the credits may be used however each campus feels is most appropriate for their Splunk training needs.   Non-Internet2 Member Universities must pay a service fee of $8,800.  These training credits will expire after one (1) year of the purchase date.

“Waterfall” pricing

As more Internet2 Member institutions increase their usage of Splunk through the NET+ program the pricing will be reduced further from the already substantially discounted prices.


Universities that purchase the Splunk offering at the 20GB or 50GB tiers will be allowed three named support contacts. Those who purchase the Splunk offering at the 100gb tier or higher will be allowed five named contacts.

License Management

Even in the best run environments, there may be unanticipated spikes in the daily data volume. Users of the Splunk offering can currently exceed the daily indexing amount specified in their license up to 5 times within a rolling 30-day window. While users will receive a warning each time, the data will continued to be indexed and all functionality will remain. If the user exceeds the daily licensing limit more than 5 times within that rolling window, then all data continues to be collected and indexed but the user must contact Internet2 for additional license capacity in order to access Splunk's search capability and other features.


The 3-year subscription term is based on the effective date of your service.  The initial invoice will include the one-time mandatory education service fee and one-third of the total cost of the license, with invoices for years 2 and 3 covering the licensing cost.

Internet2 Membership Participation Status Changes

If your institution is currently not an Internet2 member, but subsequently joins, your institution will be afforded the appropriate discounts upon the next Splunk offering renewal.

If your institution is currently an Internet2 member, but subsequently drops membership (your membership period might not coincide with your Splunk offering subscription) it will necessitate an increase in Splunk pricing. The service functions and special pricing are dependent upon active and continued membership in Internet2. The pricing provided for Internet2 members is due to the administrative efficiencies that are gained as a result.

Upgrading (Co-Terming)

If I have already purchased the NET+ Splunk Offering, can I upgrade?

Yes.  You can purchase additional Splunk capacity at any time after your initial purchase, up to two times per calendar year.

Click here to complete the UPGRADE Application.

How do I calculate my upgrade costs?

First, find the full three year cost of moving from your current tier to the desired tier, using the table below:

Upgrade Fees for Increased Peak Daily Volume


Internet2 Member Schools
5% Waterfall

Non-Internet2 Schools

Upgrade Path 3 Year Upgrade Fee Annual Upgrade Fee
(pro-rate for year 1)
3 Year Upgrade Fee Annual Upgrade Fee
(pro-rate for year 1)

20GB to 50GB

$25,470 $8,490 $29,490 $9,830

50GB to 100GB

$40,050 $13,350 $46,341 $15,447

100GB to 150GB

$47,400 $15,800 $54,765 $18,255

150GB to 200GB

$47,400 $15,800 $54,765 $18,255

200GB to 250GB

$44,751 $14,917 $51,957 $17,319

Each additional
50GB increment
up to 500 GB

$44,751 $14,917 $51,957 $17,319

500GB to 550GB

$40,050 $13,350 $46,341 $15,447

Each additional
50GB increment
up to 1000 GB

$40,050 $13,350 $46,341 $15,447

Then, calculate the pro-rated cost of the co-termed upgrade.  “Co-term” means that the start date will be determined by when you place the order for the upgrade, but the end date will be the same as your original purchase.  To calculate co-termed upgrade fees, then, find out how many days are left in the current year of your contract, take that and divide by the number of days in that year, and multiply that % amount by the annual incremental upgrade cost.


Big University purchases their first NET+ Splunk Offering on January 1, 2015.  They purchase a 50GB Daily Indexing Volume for $69,150 (payable over three years).   Their invoice will show that the Year 1 payment is $31,050 ($23,050 plus the $8,000 training fee), the Year 2 payment is $23,050, and the Year 3 Payment is $23,050.

After five months, they realize that they actually need 200GB of Daily Indexing Volume, and have to purchase it by the end of June 2015.

The full three year cost of moving from 50GB to 200GB is ($40,050 + $47,400 + $47,400), or $134,850.  This is an annual incremental cost of $44,950.  Since they are already well into Year 1 of the contract, the Year 1 cost is (185 days left in year)/(365 total days in 2015) times $44,950, or $22,782.88.  Year 2 and Year 3 incremental costs would be $44,950 per year.  Adding up the three years of incremental costs would be ($22,782.88 + $44,950 + $44,950), or $112,682.88 as the incremental cost for the entire three years of upgrading from 50gb to 200gb.

Note: 2016 is a Leap Year, and will have an extra day.

Again, please complete the UPGRADE Application if you desire an upgrade.


Have a question about the Internet2 NET+ Splunk offering that wasn't answered through our menu options? Take a few moments to browse through our frequently asked questions. Click Show all to view all the answers at once. Feel free to email us if you have a question that's not answered here.

Internet2 NET+ Splunk - General

Who is Splunk?

Splunk shipped its first software in 2006 with the goal of making machine data accessible, usable and valuable to everyone. Machine data is one of the fastest growing and most pervasive segments of "big data"—generated by websites, applications, servers, networks, mobile devices and all the sensors and RFID assets that produce data every second of every day. By monitoring and analyzing digital footprints – everything from clickstreams to network activity to learning management systems transactions - Splunk can help universities turn machine data into strategic insights for the institution. Headquartered in San Francisco with offices worldwide, Splunk is a publicly traded company.

What is the NET+ Splunk offering?

The NET+ Splunk offering provides Internet2 member schools with the opportunity to buy on-premise Splunk Enterprise software on a discounted, 3-year term basis. Splunk software licenses are based on total daily volume of data indexed, freeing your institution from worrying about counting seats or FTEs or report usage to determine the appropriate tier to purchase. The offering will have tiers at the 20GB, 50GB, 100GB, 200GB, 500GB, and 1000GB levels; the price per gb of Splunk goes down dramatically as more volume is purchased, so building campus-wide use cases and buy-in can drive dramatic savings for universities. If your campus has software needs outside of these tiers, then please contact for additional pricing information. With an Internet2 member initial purchase, there will also be a service fee of $8,000 to cover the cost of training at least one individual on campus up through Splunk Architect (see for more details); initial purchases from non-Internet2 member universities will have a service fee of $8,800. Each member campus can buy one Splunk license, and schools must make a three-year commitment, payable annually. There is the potential for deeper discounts in subsequent program years as additional schools sign up for this offering, so driving peer participation can help all involved.

What is the relationship between Splunk and Internet2?

Internet2 has signed a business agreement with Splunk that provides a unique offering specific to the higher education community. In addition, Internet2 has worked with Splunk to provide no-cost classroom and research licenses to not-for-profit institutions to better meet the needs of the Internet2 community.

If I already have an existing Splunk perpetual license over 20GB, can I switch this license to an annual subscription license with Internet2?

Internet2 licenses are stackable, so if your university needs additional capacity, you can buy a new license to add to your daily indexing needs. Buying a license through the NET+ Splunk offering, however, will not change or impact existing Splunk licenses that you have already purchased.

The NET+ Splunk offering gives me a way to buy Core Splunk only; can I purchase Splunk classes, professional services, or applications like Enterprise Security, PCI Compliance, and Splunk for VMware through this offering?

Core Splunk can serve as the foundation for gaining operational intelligence for machine data across your enterprise. Training and professional services (beyond what may be covered in the mandatory service fee for all initial purchases) are not included in the Net+ offering because each university’s needs are unique. Nearly all Splunk applications at can be downloaded and extended for free; the Splunk applications for Enterprise Security, PCI Compliance and Splunk for VMware are commercially developed and supported so that you can focus your energies on other tasks if need be.

Eligibility and Enrollment

Do I have to be a direct Internet2 member to get the Net+ Splunk offering?

No. Your institution has to be a not-for-profit university located in the United States in order to qualify for the NET+ Splunk offering. Direct Internet2 members get an additional discount, but membership in Internet2 is not required.

When will the Splunk offering be available to higher education members?

NET+ Splunk offering is available now! Six universities participated in an early-adopter program that allowed us to identify potential issues before the general offering was initiated. These schools are North Dakota State University; Indiana University; California Polytechnic State University-San Luis Obispo; Baylor University, University of Washington and the University of Illinois at Urbana-Champaign.

How does my institution sign up for the offering?

Internet2 members may purchase the new offering by signing a Customer Agreement between the Internet2 member and Internet2. A trial NET+ Splunk offering can also be made available so that a campus can evaluate the features and benefits of the offering before committing; please contact to investigate the evaluation option. Visit "How To Participate" to gather and prepare required information and then fill out the online application form (linked at the bottom of that page). You will then be assigned a Splunk account representative who will work with you to discuss how to get the most value out of your Net+ Splunk offering.

Can a portion of my institution sign up (for example, a business school, medical school, or even a single department)?

No, it must be a single, institution-wide license. The benefits of a solution like Splunk are viral collaborations and connections that occur between individuals and groups by allowing the entire community to quickly and easily share data, searches, reports and dashboards. Offering it to a single department would generally cost more than higher-volume tiers for an entire campus. This program is also intended to minimize the contracting effort for the members to help achieve the most favorable pricing.

For questions regarding cost, upgrade, terms of agreement, and billing, please see our FEES tab.

Cost and Terms

More Information

Thank you for your interest in Internet2 NET+ Splunk. Please check NET+ Splunk home for updates as they become available. CheckInternet2 NET+ Services for news and updates on all Internet2 NET+ service offerings. Have a question not answered here? Email:

One-Time Education Fee

What do I get for the one-time Education Fee?

The one-time education fee gets your institution 16 training credits which can be used on WebEx classes led by NET+ Splunk instructors. Sixteen (16) credits is enough to train one contact as a Splunk Architect, but the credits may be used however each campus sees fit.

How do I claim the education credits and register for training after signing up for NET+ Splunk?

To register for Splunk courses, simply go the link below and click through the register button to search and register for classes. When checking out, there should be a payment dropdown with a “Pay by PO” selection; Splunk education will then approve your selection and you will get a registration confirmation via email. See more information

How could I become a certified Splunk Architect with the NET+ Splunk program education credits?

For example, if someone would like to get training to become a certified Splunk Architect (, they can go through the following sequence of courses:

Using Splunk 6 Video Tutorial (eLearning)
Searching and Reporting (2 credits)
Creating Splunk Knowledge Objects (1 credit)
Splunk Administration (5 credits)
Developing Apps with Splunk (3 credits)
Architecting and Deploying Splunk (3 credits)
Splunk Architect Certification Lab (2 credits)

What other free online learning does Splunk offer?

Splunk now offers free online elearning classes. The free classes can be seen on the bottom right link on the General Education page for Splunk, or directly accessed via the links below:

Ready to subscribe and get all the great features of the Internet2 NET+ Splunk offering for your organization? You'll need to get some information together, as outlined in the following steps, before you can fill out the online application.

Also, you may want to review the Customer Agreement to understand some of the information we need in the application process.

[1] Determine your eligibility

Not-for-profit institutions of higher education headquartered in the United States are eligible to sign up for the NET+ Splunk offering. Internet2 members receive special pricing, but membership in Internet2 is not required.

You'll need to indicate whether you're an Internet2 member on the form.

For more information on becoming an Internet2 member, see "Internet2 Membership."

[2] Determine your pricing tier

The annual price of the Internet2 NET+ Splunk service is based on the total amount of data your institution would like to index per day; six tiers are offered.

You'll need to select your desired tier on the form.  See the FEES tab to learn more about your pricing options.

NOTE:  You have an option for an up-front payment.   You will be able to decide if you want this option when completing the application [see # 5].  Please note that if the service is paid for up-front, then all future upgrades must also be paid for up front.

[3] Are any special considerations required?

Does your institution require special considerations due to state law or regulation? Are there any mandated limitations on renewal periods? You'll need to indicate this on the form.

[4] Gather contact information for the required Net+ Splunk offering service roles

You'll have to enter the name, address, phone and email information for each of these service roles on your application.

  • CIO/Senior information technology officer – This is your organization's senior information technology officer, typically the CIO
  • Application submitter – The submitter of the application form will receive the submission confirmation email and will be the point of contact for confirmation of details or clarification
  • Technical contact – The technical contact is the individual with responsibility for the deployment of the NET+ Splunk offering at your organization
  • Customer support contact – The Customer Support contact is the individual who will receive correspondence from Splunk about updates, outages, and other issues related to customer support; Tier 1 and Tier 2 customer support is the responsibility of the subscribing institution  Note: You'll need to include the Web address for this role as well
  • Administrative contact – The administrative contact is the individual with the power to authorize the service contract and fees
  • Billing contact – The billing contact is the individual to whom invoices should be addressed
  • Primary legal contact (Campus Address for Legal Notices) – The primary legal contact is the individual who serves as contact point and/or legal resource, to whom legal inquiries and concerns should be addressed
  • Secondary legal contact – The secondary legal contact is the individual who serves as a backup for the primary legal contact

[5] Fill out and submit the application

Complete the application. The submitter will be contacted within three (3) business days for confirmation of details or clarification.

If you would like to upgrade your current NET+ Splunk environment, click here to complete the UPGRADE Application.


NOTE:  Completing the application is NOT the same as signing the agreement.  

Also, Internet2 uses electronic signatures with Docusign for the Customer Agreement and/or Customer Order Document.