Use Internet2 SiteID

Already have an Internet2 SiteID?
Sign in here.

Internet2 SiteID

Your organization not listed? Create a local account to use Internet2 services.

Create SiteID


Service Type:
Security & Identity
General Availability
Eligible Subscribers:
Internet2 Member or Other R&E Participant
Baylor University, California Polytechnic State University - San Luis Obispo, Indiana University, University of Illinois - Urbana-Champaign, University of Washington
Nick Lewis

NET+ Splunk Offering

Internet2 member and non-member schools can buy on-premise Splunk Enterprise software at a discounted, 3-year term basis. Refer to the fees section for details. Member institutions can also benefit from further reduced pricing should they increase their Splunk usage through the NET+ program.

In addition, there is the “waterfall” pricing model, meaning as more Internet2 Member institutions increase their usage of Splunk through the NET+ program the pricing will be reduced further from the already substantially discounted prices.

Plus, Internet2 Members using Splunk can access free eLearning classes. Learn more.

About Splunk

Splunk Inc. is the market-leading platform that powers Operational Intelligence. We pioneer innovative, disruptive solutions that make machine data accessible, usable and valuable to everyone.

Machine-generated data is one of the fastest growing and complex areas of big data. It's also one of the most valuable, containing a definitive record of all user transactions, customer behavior, machine behavior, security threats, fraudulent activity and more. Splunk turns machine data into valuable insights. It's what we call Operational Intelligence.

Machine data provides an untapped opportunity for institutions of higher education. Campus networks, infrastructure, applications, servers, learning management systems and end-user devices generate huge volumes of data that—when leveraged—can provide unparalleled insight into problems, usage patterns and trends across an entire campus IT infrastructure.

Higher education institutions use Splunk to:

  • Identify problems, risks and opportunities to drive lower costs and provide more effective operations
  • Detect security risks and network abuse
  • Improve student and faculty experience across all systems used
  • Manage and monitor machine data from multiple sources
  • Collect and audit data to meet regulatory requirements

Get more value from your data.

Splunk Enterprise collects data from any source, including logs, clickstreams, sensors, stream network traffic, web servers, custom applications, hypervisors, containers, social media and cloud services. It then enables you to search, monitor and analyze that data to discover powerful insights across multiple use cases like security, IT operations, application delivery, industrial data and IoT, giving you valuable intelligence across your entire organization.

Collect and Index Data

Index data regardless of format or location. Because the structure and schema are applied only at search time you can analyze the data without limitation.

Search and Investigate

Search data using the powerful and intuitive Splunk Search Processing Language (SPL TM). Splunk automatically normalizes your varying data formats and provides 140+ commands so you can perform statistical searches, calculate metrics and even look for specific conditions within a rolling time window. Zoom in and out on timelines to automatically reveal trends, spikes and patterns and click to drill down into search results.

Correlate and Analyze

Splunk makes it easy to find relations between events and activities. Correlated based on time, location, or custom search results. Use the Transaction command to identify related events as a transaction or session and investigate failed transactions. Let the Event Pattern Detection command automatically find common or rare patterns in your big data. Enable users to discover and share additional insights with the point-and-click ease of the unique Pivot interface.

Visualize and Report

Visualize trends and characteristics in custom dashboards and reports suited to any business, operational or security need. Analyze further with chart overlay and pan and zoom controls. Predictive visualizations let you forecast highs and lows, plan system resources and anticipate workloads. You can also personalize dashboards and reports for anyone, share them as PDFs, or embed them into other applications.

Monitor and Alert

Turn searches into real-time alerts and automatically trigger notifications via email or RSS; then execute remedial conditions and other complex criteria. Gain additional information at the time of the alert to assist with faster root cause analysis and problem resolution.

Apps and Premium Solutions

Extend the power of Splunk Enterprise. Apps deliver a targeted user experience for typical use cases and data sources. Splunk Premium Solutions combine real-time analytics and rich features to manage your security posture, IT operations and more. (



The price of the Internet2 NET+ Splunk offering is based upon the amount of data indexed PER DAY; there are no charges for number of users, number of CPUs/cores/nodes, data sources or data types, number of searches or volume of data searched. And there is no charge for the total amount of data you store in your Splunk instance. Once you have licensed your Splunk offering, you can have as many people as you want use the software and create as many searches, alerts, correlations, reports, dashboards and automated remedial actions as you need, at no additional cost. To receive this pricing, schools must commit to three years of the Splunk offering, paid annually. To help universities with predicting demand for data indexing needs, onboarding licenses for evaluating the Splunk offering are available. Please see the FAQ or email if you have additional questions on pricing.

Internet2 Member - Fees for Software and Support - 3 Year Term License

Tier (GB) Fees for Software and Support
(total amount, payable over three years in annual installments)
Example Annual Payment $/GB/YR
20 $43,680 $14,560/YR 728
50 $69,150 $23,050/YR 461
100 $109,200 $36,400/YR 364
200 $204,000 $68,000/YR 340
500 $472,500 $157,500/YR 315
1,000 $873,000 $291,000/YR 291

Non-Internet2 Member - Fees for Software and Support - 3 Year Term License

Tier (GB) Fees for Software and Support
(total amount, payable over three years in annual installments)
Example Annual Payment $/GB/YR
20 $50,553 $16,851/YR 843
50 $80,043 $26,681/YR 534
100 $126,384 $42,128/YR 421
200 $235,914 $78,638/YR 393
500 $547,659 $182,553/YR 365
1,000 $1,011,063 $337,021/YR 329

One-time Startup Cost

Internet2 Member Universities wishing to purchase any tier of the NET+ Splunk offering must also pay a one-time education fee of $8,000, which buys 16 training credits to be used on WebEx classes led by NET+ Splunk instructors.  16 credits is enough to train one contact as a Splunk Architect, but the credits may be used however each campus feels is most appropriate for their Splunk training needs.   Non-Internet2 Member Universities must pay a service fee of $8,800.  These training credits will expire after one (1) year of the purchase date.

“Waterfall” pricing

As more Internet2 Member institutions increase their usage of Splunk through the NET+ program the pricing will be reduced further from the already substantially discounted prices.


Universities that purchase the Splunk offering at the 20GB or 50GB tiers will be allowed three named support contacts. Those who purchase the Splunk offering at the 100gb tier or higher will be allowed five named contacts.

License Management

Even in the best run environments, there may be unanticipated spikes in the daily data volume. Users of the Splunk offering can currently exceed the daily indexing amount specified in their license up to 5 times within a rolling 30-day window. While users will receive a warning each time, the data will continued to be indexed and all functionality will remain. If the user exceeds the daily licensing limit more than 5 times within that rolling window, then all data continues to be collected and indexed but the user must contact Internet2 for additional license capacity in order to access Splunk's search capability and other features.


The 3-year subscription term is based on the effective date of your service.  The initial invoice will include the one-time mandatory education service fee and one-third of the total cost of the license, with invoices for years 2 and 3 covering the licensing cost.

Internet2 Membership Participation Status Changes

If your institution is currently not an Internet2 member, but subsequently joins, your institution will be afforded the appropriate discounts upon the next Splunk offering renewal.

If your institution is currently an Internet2 member, but subsequently drops membership (your membership period might not coincide with your Splunk offering subscription) it will necessitate an increase in Splunk pricing. The service functions and special pricing are dependent upon active and continued membership in Internet2. The pricing provided for Internet2 members is due to the administrative efficiencies that are gained as a result.

Upgrading (Co-Terming)

If I have already purchased the NET+ Splunk Offering, can I upgrade?

Yes.  You can purchase additional Splunk capacity at any time after your initial purchase, up to two times per calendar year.

Click here to complete the UPGRADE Application.

How do I calculate my upgrade costs?

First, find the full three year cost of moving from your current tier to the desired tier, using the table below:

Upgrade Fees for Increased Peak Daily Volume


Internet2 Member Schools
5% Waterfall

Non-Internet2 Schools

Upgrade Path 3 Year Upgrade Fee Annual Upgrade Fee
(pro-rate for year 1)
3 Year Upgrade Fee Annual Upgrade Fee
(pro-rate for year 1)

20GB to 50GB

$25,470 $8,490 $29,490 $9,830

50GB to 100GB

$40,050 $13,350 $46,341 $15,447

100GB to 150GB

$47,400 $15,800 $54,765 $18,255

150GB to 200GB

$47,400 $15,800 $54,765 $18,255

200GB to 250GB

$44,751 $14,917 $51,957 $17,319

Each additional
50GB increment
up to 500 GB

$44,751 $14,917 $51,957 $17,319

500GB to 550GB

$40,050 $13,350 $46,341 $15,447

Each additional
50GB increment
up to 1000 GB

$40,050 $13,350 $46,341 $15,447

Then, calculate the pro-rated cost of the co-termed upgrade.  “Co-term” means that the start date will be determined by when you place the order for the upgrade, but the end date will be the same as your original purchase.  To calculate co-termed upgrade fees, then, find out how many days are left in the current year of your contract, take that and divide by the number of days in that year, and multiply that % amount by the annual incremental upgrade cost.


Big University purchases their first NET+ Splunk Offering on January 1, 2015.  They purchase a 50GB Daily Indexing Volume for $69,150 (payable over three years).   Their invoice will show that the Year 1 payment is $31,050 ($23,050 plus the $8,000 training fee), the Year 2 payment is $23,050, and the Year 3 Payment is $23,050.

After five months, they realize that they actually need 200GB of Daily Indexing Volume, and have to purchase it by the end of June 2015.

The full three year cost of moving from 50GB to 200GB is ($40,050 + $47,400 + $47,400), or $134,850.  This is an annual incremental cost of $44,950.  Since they are already well into Year 1 of the contract, the Year 1 cost is (185 days left in year)/(365 total days in 2015) times $44,950, or $22,782.88.  Year 2 and Year 3 incremental costs would be $44,950 per year.  Adding up the three years of incremental costs would be ($22,782.88 + $44,950 + $44,950), or $112,682.88 as the incremental cost for the entire three years of upgrading from 50gb to 200gb.

Note: 2016 is a Leap Year, and will have an extra day.

Again, please complete the UPGRADE Application if you desire an upgrade.


Have a question about the Internet2 NET+ Splunk offering that wasn't answered through our menu options? Take a few moments to browse through our frequently asked questions. Click Show all to view all the answers at once. Feel free to email us if you have a question that's not answered here.

Internet2 NET+ Splunk - General

Who is Splunk?

Splunk shipped its first software in 2006 with the goal of making machine data accessible, usable and valuable to everyone. Machine data is one of the fastest growing and most pervasive segments of "big data"—generated by websites, applications, servers, networks, mobile devices and all the sensors and RFID assets that produce data every second of every day. By monitoring and analyzing digital footprints – everything from clickstreams to network activity to learning management systems transactions - Splunk can help universities turn machine data into strategic insights for the institution. Headquartered in San Francisco with offices worldwide, Splunk is a publicly traded company.

What is the NET+ Splunk offering?

The NET+ Splunk offering provides Internet2 member schools with the opportunity to buy on-premise Splunk Enterprise software on a discounted, 3-year term basis. Splunk software licenses are based on total daily volume of data indexed, freeing your institution from worrying about counting seats or FTEs or report usage to determine the appropriate tier to purchase. The offering will have tiers at the 20GB, 50GB, 100GB, 200GB, 500GB, and 1000GB levels; the price per gb of Splunk goes down dramatically as more volume is purchased, so building campus-wide use cases and buy-in can drive dramatic savings for universities. If your campus has software needs outside of these tiers, then please contact for additional pricing information. With an Internet2 member initial purchase, there will also be a service fee of $8,000 to cover the cost of training at least one individual on campus up through Splunk Architect (see for more details); initial purchases from non-Internet2 member universities will have a service fee of $8,800. Each member campus can buy one Splunk license, and schools must make a three-year commitment, payable annually. There is the potential for deeper discounts in subsequent program years as additional schools sign up for this offering, so driving peer participation can help all involved.

What is the relationship between Splunk and Internet2?

Internet2 has signed a business agreement with Splunk that provides a unique offering specific to the higher education community. In addition, Internet2 has worked with Splunk to provide no-cost classroom and research licenses to not-for-profit institutions to better meet the needs of the Internet2 community.

If I already have an existing Splunk perpetual license over 20GB, can I switch this license to an annual subscription license with Internet2?

Internet2 licenses are stackable, so if your university needs additional capacity, you can buy a new license to add to your daily indexing needs. Buying a license through the NET+ Splunk offering, however, will not change or impact existing Splunk licenses that you have already purchased.

The NET+ Splunk offering gives me a way to buy Core Splunk only; can I purchase Splunk classes, professional services, or applications like Enterprise Security, PCI Compliance, and Splunk for VMware through this offering?

Core Splunk can serve as the foundation for gaining operational intelligence for machine data across your enterprise. Training and professional services (beyond what may be covered in the mandatory service fee for all initial purchases) are not included in the Net+ offering because each university’s needs are unique. Nearly all Splunk applications at can be downloaded and extended for free; the Splunk applications for Enterprise Security, PCI Compliance and Splunk for VMware are commercially developed and supported so that you can focus your energies on other tasks if need be.

Eligibility and Enrollment

Do I have to be a direct Internet2 member to get the Net+ Splunk offering?

No. Your institution has to be a not-for-profit university located in the United States in order to qualify for the NET+ Splunk offering. Direct Internet2 members get an additional discount, but membership in Internet2 is not required.

When will the Splunk offering be available to higher education members?

NET+ Splunk offering is available now! Six universities participated in an early-adopter program that allowed us to identify potential issues before the general offering was initiated. These schools are North Dakota State University; Indiana University; California Polytechnic State University-San Luis Obispo; Baylor University, University of Washington and the University of Illinois at Urbana-Champaign.

How does my institution sign up for the offering?

Internet2 members may purchase the new offering by signing a Customer Agreement between the Internet2 member and Internet2. A trial NET+ Splunk offering can also be made available so that a campus can evaluate the features and benefits of the offering before committing; please contact to investigate the evaluation option. Visit "How To Participate" to gather and prepare required information and then fill out the online application form (linked at the bottom of that page). You will then be assigned a Splunk account representative who will work with you to discuss how to get the most value out of your Net+ Splunk offering.

Can a portion of my institution sign up (for example, a business school, medical school, or even a single department)?

No, it must be a single, institution-wide license. The benefits of a solution like Splunk are viral collaborations and connections that occur between individuals and groups by allowing the entire community to quickly and easily share data, searches, reports and dashboards. Offering it to a single department would generally cost more than higher-volume tiers for an entire campus. This program is also intended to minimize the contracting effort for the members to help achieve the most favorable pricing.

For questions regarding cost, upgrade, terms of agreement, and billing, please see our FEES tab.

Cost and Terms

More Information

Thank you for your interest in Internet2 NET+ Splunk. Please check NET+ Splunk home for updates as they become available. CheckInternet2 NET+ Services for news and updates on all Internet2 NET+ service offerings. Have a question not answered here? Email:

One-Time Education Fee

What do I get for the one-time Education Fee?

The one-time education fee gets your institution 16 training credits which can be used on WebEx classes led by NET+ Splunk instructors. Sixteen (16) credits is enough to train one contact as a Splunk Architect, but the credits may be used however each campus sees fit.

How do I claim the education credits and register for training after signing up for NET+ Splunk?

To register for Splunk courses, simply go the link below and click through the register button to search and register for classes. When checking out, there should be a payment dropdown with a “Pay by PO” selection; Splunk education will then approve your selection and you will get a registration confirmation via email. See more information

How could I become a certified Splunk Architect with the NET+ Splunk program education credits?

For example, if someone would like to get training to become a certified Splunk Architect (, they can go through the following sequence of courses:

Using Splunk 6 Video Tutorial (eLearning)
Searching and Reporting (2 credits)
Creating Splunk Knowledge Objects (1 credit)
Splunk Administration (5 credits)
Developing Apps with Splunk (3 credits)
Architecting and Deploying Splunk (3 credits)
Splunk Architect Certification Lab (2 credits)

What other free online learning does Splunk offer?

Splunk now offers free online elearning classes. The free classes can be seen on the bottom right link on the General Education page for Splunk, or directly accessed via the links below:

Ready to subscribe and get all the great features of the Internet2 NET+ Splunk offering for your organization? You'll need to get some information together, as outlined in the following steps, before you can fill out the online application.

Also, you may want to review the Customer Agreement to understand some of the information we need in the application process.

[1] Determine your eligibility

Not-for-profit institutions of higher education headquartered in the United States are eligible to sign up for the NET+ Splunk offering. Internet2 members receive special pricing, but membership in Internet2 is not required.

You'll need to indicate whether you're an Internet2 member on the form.

For more information on becoming an Internet2 member, see "Internet2 Membership."

[2] Determine your pricing tier

The annual price of the Internet2 NET+ Splunk service is based on the total amount of data your institution would like to index per day; six tiers are offered.

You'll need to select your desired tier on the form.  See the FEES tab to learn more about your pricing options.

NOTE:  You have an option for an up-front payment.   You will be able to decide if you want this option when completing the application [see # 5].  Please note that if the service is paid for up-front, then all future upgrades must also be paid for up front.

[3] Are any special considerations required?

Does your institution require special considerations due to state law or regulation? Are there any mandated limitations on renewal periods? You'll need to indicate this on the form.

[4] Gather contact information for the required Net+ Splunk offering service roles

You'll have to enter the name, address, phone and email information for each of these service roles on your application.

  • CIO/Senior information technology officer – This is your organization's senior information technology officer, typically the CIO
  • Application submitter – The submitter of the application form will receive the submission confirmation email and will be the point of contact for confirmation of details or clarification
  • Technical contact – The technical contact is the individual with responsibility for the deployment of the NET+ Splunk offering at your organization
  • Customer support contact – The Customer Support contact is the individual who will receive correspondence from Splunk about updates, outages, and other issues related to customer support; Tier 1 and Tier 2 customer support is the responsibility of the subscribing institution  Note: You'll need to include the Web address for this role as well
  • Administrative contact – The administrative contact is the individual with the power to authorize the service contract and fees
  • Billing contact – The billing contact is the individual to whom invoices should be addressed
  • Primary legal contact (Campus Address for Legal Notices) – The primary legal contact is the individual who serves as contact point and/or legal resource, to whom legal inquiries and concerns should be addressed
  • Secondary legal contact – The secondary legal contact is the individual who serves as a backup for the primary legal contact

[5] Fill out and submit the application

Complete the application. The submitter will be contacted within three (3) business days for confirmation of details or clarification.

If you would like to upgrade your current NET+ Splunk environment, click here to complete the UPGRADE Application.


NOTE:  Completing the application is NOT the same as signing the agreement.  

Also, Internet2 uses electronic signatures with Docusign for the Customer Agreement and/or Customer Order Document.