- Service Type:
- Security & Identity
- General Availability
- Eligible Subscribers:
- Internet2 Member
- Baylor University, California Polytechnic State University - San Luis Obispo, Indiana University, University of Illinois - Urbana-Champaign, University of Washington
- Nick Lewis
The NET+ Splunk offering provides Internet2 member schools with the opportunity to buy on-premise Splunk Enterprise software on a discounted, 3-year term basis. This Splunk offering is the on premise Enterprise version of Splunk. If you are interested in the Splunk Cloud offering, please email email@example.com to express interest.
Today’s educational institutions face challenges that place ever-increasing demands on their technology infrastructure. The network, infrastructure and applications that form the backbone of educational enterprises have become mission-critical in delivering more robust services under severe resource constraints. At present, machine data represents a largely untapped opportunity for delivering just these types of results. A majority of the Fortune 100 and more than 6,000 enterprises, service providers and government organizations in more than 90 countries use Splunk software to leverage machine data across the enterprise to troubleshoot application problems and investigate security incidents in minutes instead of hours or days, monitor and alert to avoid service degradation or outages and deliver compliance at lower cost.
Splunk Enterprise is the platform for machine data. It's the easy, fast and resilient way to collect, analyze and secure the massive streams of machine data generated by all your IT systems and technology infrastructure.
And now, Internet2 members can add this valuable Internet2 NET+ offering to their membership for an additional fee. Other institutions of higher education (.edu) headquartered in the United States are also eligible to participate at a higher fee. In addition, there is the “waterfall” pricing model, meaning as more Internet2 Member institutions increase their usage of Splunk through the NET+ program the pricing will be reduced further from the already substantially discounted prices.
Splunk Enterprise is a fully featured platform that collects and indexes any machine data from virtually any source in real time. Search, monitor, analyze and visualize your data to gain new visibility, insight and intelligence. Index everything for deep visibility, forensics and troubleshooting. Create ad hoc reports to identify trends or prove compliance controls. Create interactive dashboards to monitor for security incidents, service levels and other KPIs. Analyze student transactions, user behavior, machine behavior, security threats and fraudulent activity, all in real time.
Index Any Data
Index any machine data regardless of format or location—logs, clickstream data, configurations, traps and alerts, change events, the output of diagnostic commands, data from APIs and message queues and even multi-line logs from custom applications. With no predefined schema, data can be indexed from virtually any source, format or location. Then it's available for troubleshooting, security incident investigations, network monitoring, compliance reporting, business analytics and other valuables uses.
Search and Investigate
Search real-time and historical data using the same search interface. Use familiar search commands to define, limit or widen your search. Search doesn't stop there. Use statistical reporting commands, update transaction counts and calculate metrics and even look for specific conditions within a rolling time window. The search assistant offers type-ahead suggestions and contextual help so that you can leverage the full power of the search processing language.
Interact with Search Results
Interact with your search results in real time. Zoom in and out on a timeline of your results to quickly reveal trends, spikes and anomalies. Click to drill down immediately into your results and eliminate noise to get to the needle in the haystack. Whether you're troubleshooting a ticket, investigating a security alert, or simply discovering your data, you'll get to the answer in minutes rather than hours or days. And avoid the need to escalate to other groups to get the data you need.
Splunk automatically extracts knowledge from your machine data at search time. You can add more knowledge and meaning by identifying, naming and tagging fields and data points. You can even add information from external asset management databases, configuration management systems and user directories.
Correlate Complex Events
Splunk search makes it easy to establish or find relationships between seemingly unrelated events or activity. Use Splunk to correlate based on time, external data, sub-searches or joins. Identify related events as a transaction or session. Visualize trends and characteristics in reports and dashboards.
Monitor and Alert
Turn searches into real-time alerts and automatically trigger notifications via email or RSS, execute remedial actions, send an SNMP trap to your system management console or generate a ticket at a service desk. Alerts can trigger based on a variety of threshold, trend-based conditions and other complex searches.
Report and Analyze
Use the integrated report builder to quickly build advanced graphs and charts to visualize important trends, see highs and lows, create sparklines, summarize top values or the frequency of conditions. Create robust, information-rich reports from scratch without any advanced knowledge of search commands. Save reports, integrate them into dashboards and share them with management or other colleagues via PDF. Built-in acceleration technology delivers your mission-critical insights when it's needed.
Custom Dashboards and Views
Create live dashboards in a few clicks with the dashboard editor. Dashboards integrate multiple charts and views of your real-time data for the needs of different users—technical and non-technical. You can personalize dashboards for anyone and share them via PDF. Or view and edit them on tablets, smartphones and non-Flash browsers.
Do more by taking advantage of hundreds of apps and other content that run on top of the Splunk platform. These apps deliver a targeted user experience for different roles and use cases. There are a growing number of apps, built by our community, partners and Splunk—browse what's out there or even create and post your own, all through the Splunk Apps website (apps.splunk.com).
The price of the Internet2 NET+ Splunk offering is based upon the amount of data indexed PER DAY; there are no charges for number of users, number of CPUs/cores/nodes, data sources or data types, number of searches or volume of data searched. And there is no charge for the total amount of data you store in your Splunk instance. Once you have licensed your Splunk offering, you can have as many people as you want use the software and create as many searches, alerts, correlations, reports, dashboards and automated remedial actions as you need, at no additional cost. To receive this pricing, schools must commit to three years of the Splunk offering, paid annually. To help universities with predicting demand for data indexing needs, onboarding licenses for evaluating the Splunk offering are available. Please see the FAQ or email firstname.lastname@example.org if you have additional questions on pricing.
Internet2 Member - Fees for Software and Support - 3 Year Term License
|Tier (GB)||Fees for Software and Support
(total amount, payable over three years in annual installments)
|Example Annual Payment||$/GB/YR|
Non-Internet2 Member - Fees for Software and Support - 3 Year Term License
|Tier (GB)||Fees for Software and Support
(total amount, payable over three years in annual installments)
|Example Annual Payment||$/GB/YR|
One-time Startup Cost
Internet2 Member Universities wishing to purchase any tier of the NET+ Splunk offering must also pay a one-time education fee of $8,000, which buys 16 training credits to be used on WebEx classes led by NET+ Splunk instructors. 16 credits is enough to train one contact as a Splunk Architect, but the credits may be used however each campus feels is most appropriate for their Splunk training needs. Non-Internet2 Member Universities must pay a service fee of $8,800. These training credits will expire after one (1) year of the purchase date.
As more Internet2 Member institutions increase their usage of Splunk through the NET+ program the pricing will be reduced further from the already substantially discounted prices.
Universities that purchase the Splunk offering at the 20GB or 50GB tiers will be allowed three named support contacts. Those who purchase the Splunk offering at the 100gb tier or higher will be allowed five named contacts.
Even in the best run environments, there may be unanticipated spikes in the daily data volume. Users of the Splunk offering can currently exceed the daily indexing amount specified in their license up to 5 times within a rolling 30-day window. While users will receive a warning each time, the data will continued to be indexed and all functionality will remain. If the user exceeds the daily licensing limit more than 5 times within that rolling window, then all data continues to be collected and indexed but the user must contact Internet2 for additional license capacity in order to access Splunk's search capability and other features.
The 3-year subscription term is based on the effective date of your service. The initial invoice will include the one-time mandatory education service fee and one-third of the total cost of the license, with invoices for years 2 and 3 covering the licensing cost.
Internet2 Membership Participation Status Changes
If your institution is currently not an Internet2 member, but subsequently joins, your institution will be afforded the appropriate discounts upon the next Splunk offering renewal.
If your institution is currently an Internet2 member, but subsequently drops membership (your membership period might not coincide with your Splunk offering subscription) it will necessitate an increase in Splunk pricing. The service functions and special pricing are dependent upon active and continued membership in Internet2. The pricing provided for Internet2 members is due to the administrative efficiencies that are gained as a result.
If I have already purchased the NET+ Splunk Offering, can I upgrade?
Yes. You can purchase additional Splunk capacity at any time after your initial purchase, up to two times per calendar year.
How do I calculate my upgrade costs?
First, find the full three year cost of moving from your current tier to the desired tier, using the table below:
Upgrade Fees for Increased Peak Daily Volume
Internet2 Member Schools
|Upgrade Path||3 Year Upgrade Fee||Annual Upgrade Fee
(pro-rate for year 1)
|3 Year Upgrade Fee||Annual Upgrade Fee
(pro-rate for year 1)
20GB to 50GB
50GB to 100GB
100GB to 150GB
150GB to 200GB
200GB to 250GB
500GB to 550GB
Then, calculate the pro-rated cost of the co-termed upgrade. “Co-term” means that the start date will be determined by when you place the order for the upgrade, but the end date will be the same as your original purchase. To calculate co-termed upgrade fees, then, find out how many days are left in the current year of your contract, take that and divide by the number of days in that year, and multiply that % amount by the annual incremental upgrade cost.
Big University purchases their first NET+ Splunk Offering on January 1, 2015. They purchase a 50GB Daily Indexing Volume for $69,150 (payable over three years). Their invoice will show that the Year 1 payment is $31,050 ($23,050 plus the $8,000 training fee), the Year 2 payment is $23,050, and the Year 3 Payment is $23,050.
After five months, they realize that they actually need 200GB of Daily Indexing Volume, and have to purchase it by the end of June 2015.
The full three year cost of moving from 50GB to 200GB is ($40,050 + $47,400 + $47,400), or $134,850. This is an annual incremental cost of $44,950. Since they are already well into Year 1 of the contract, the Year 1 cost is (185 days left in year)/(365 total days in 2015) times $44,950, or $22,782.88. Year 2 and Year 3 incremental costs would be $44,950 per year. Adding up the three years of incremental costs would be ($22,782.88 + $44,950 + $44,950), or $112,682.88 as the incremental cost for the entire three years of upgrading from 50gb to 200gb.
Note: 2016 is a Leap Year, and will have an extra day.
Have a question about the Internet2 NET+ Splunk offering that wasn't answered through our menu options? Take a few moments to browse through our frequently asked questions. Click Show all to view all the answers at once. Feel free to email us if you have a question that's not answered here.
Internet2 NET+ Splunk - General
Who is Splunk?
What is the NET+ Splunk offering?
What is the relationship between Splunk and Internet2?
If I already have an existing Splunk perpetual license over 20GB, can I switch this license to an annual subscription license with Internet2?
The NET+ Splunk offering gives me a way to buy Core Splunk only; can I purchase Splunk classes, professional services, or applications like Enterprise Security, PCI Compliance, and Splunk for VMware through this offering?
Eligibility and Enrollment
Do I have to be a direct Internet2 member to get the Net+ Splunk offering?
When will the Splunk offering be available to higher education members?
How does my institution sign up for the offering?
Can a portion of my institution sign up (for example, a business school, medical school, or even a single department)?
For questions regarding cost, upgrade, terms of agreement, and billing, please see our FEES tab.
Cost and Terms
Thank you for your interest in Internet2 NET+ Splunk. Please check NET+ Splunk home for updates as they become available. CheckInternet2 NET+ Services for news and updates on all Internet2 NET+ service offerings. Have a question not answered here? Email: email@example.com.
One-Time Education Fee
What do I get for the one-time Education Fee?
How do I claim the education credits and register for training after signing up for NET+ Splunk?
How could I become a certified Splunk Architect with the NET+ Splunk program education credits?
Using Splunk 6 Video Tutorial (eLearning)
Searching and Reporting (2 credits)
Creating Splunk Knowledge Objects (1 credit)
Splunk Administration (5 credits)
Developing Apps with Splunk (3 credits)
Architecting and Deploying Splunk (3 credits)
Splunk Architect Certification Lab (2 credits)
What other free online learning does Splunk offer?
Ready to subscribe and get all the great features of the Internet2 NET+ Splunk offering for your organization? You'll need to get some information together, as outlined in the following steps, before you can fill out the online application.
Also, you may want to review the Customer Agreement to understand some of the information we need in the application process.
 Determine your eligibility
Not-for-profit institutions of higher education headquartered in the United States are eligible to sign up for the NET+ Splunk offering. Internet2 members receive special pricing, but membership in Internet2 is not required.
You'll need to indicate whether you're an Internet2 member on the form.
For more information on becoming an Internet2 member, see "Internet2 Membership."
 Determine your pricing tier
The annual price of the Internet2 NET+ Splunk service is based on the total amount of data your institution would like to index per day; six tiers are offered.
You'll need to select your desired tier on the form. See the FEES tab to learn more about your pricing options.
NOTE: You have an option for an up-front payment. You will be able to decide if you want this option when completing the application [see # 5]. Please note that if the service is paid for up-front, then all future upgrades must also be paid for up front.
 Are any special considerations required?
Does your institution require special considerations due to state law or regulation? Are there any mandated limitations on renewal periods? You'll need to indicate this on the form.
 Gather contact information for the required Net+ Splunk offering service roles
You'll have to enter the name, address, phone and email information for each of these service roles on your application.
- CIO/Senior information technology officer – This is your organization's senior information technology officer, typically the CIO
- Application submitter – The submitter of the application form will receive the submission confirmation email and will be the point of contact for confirmation of details or clarification
- Technical contact – The technical contact is the individual with responsibility for the deployment of the NET+ Splunk offering at your organization
- Customer support contact – The Customer Support contact is the individual who will receive correspondence from Splunk about updates, outages, and other issues related to customer support; Tier 1 and Tier 2 customer support is the responsibility of the subscribing institution Note: You'll need to include the Web address for this role as well
- Administrative contact – The administrative contact is the individual with the power to authorize the service contract and fees
- Billing contact – The billing contact is the individual to whom invoices should be addressed
- Primary legal contact (Campus Address for Legal Notices) – The primary legal contact is the individual who serves as contact point and/or legal resource, to whom legal inquiries and concerns should be addressed
- Secondary legal contact – The secondary legal contact is the individual who serves as a backup for the primary legal contact
 Fill out and submit the application
Fill out and submit the application. The submitter will be contacted within three (3) business days for confirmation of details or clarification.
NOTE: Internet2 requires the use of ELECTRONIC SIGNATURES via Docusign for the Customer Agreement and Order Document, unless state law mandates otherwise.