The journalPlaybook

Route before you index: how a pipeline cuts what Splunk indexes

Firewall allow logs are among the largest and least searched sources in most Splunk estates. Here is the pipeline architecture that sends the events your detections use to Splunk and a full copy of everything to S3 at storage prices.

Zbigniew Gajuk2026-03-282 min readFor CFO and FinOps, CISO and SOC

Three source objects, a firewall box, a server tower and an application window, merge their dotted grey streams into a dark teal pipeline stage. A thin bright teal line rises to a small analytics console, and a broad teal stream carries most of the dots down into a long layered storage slab with an open drawer. — Only the events your detections use take the thin line to Splunk. A full copy of everything goes to storage you own, at a storage price.

The Splunk cost model

Splunk bills what it indexes, by daily GB ingested, and the data grows every year. Splunk’s pricing FAQ set a 9 percent uplift on one-year renewals. Nothing in the indexing path removes duplicate events before they are counted, so repeated events are billed as often as they arrive. And much of a Splunk administrator’s week goes to parsing configuration rather than security analysis.

Where the waste lives

Firewall allow logs are one of the largest sources in most Splunk estates, and few searches ever read them. How large is a number to measure in your own license usage view, split by source type, not one to borrow. Bulk DNS queries, successful authentication events, and debug logs contribute additional volume with zero detection value. You are paying full analytics-tier pricing for data that has no analytical purpose.

The routing architecture

A Cribl pipeline routes data to multiple destinations simultaneously. High-value security events (deny actions, threat indicators, anomalies) go to Splunk. A full raw copy of everything goes to S3, where AWS lists Standard storage at about $0.023 per GB per month in US East, a storage price rather than an analytics price.

Cribl Suppress deduplicates events using configurable key fields and time windows. Cribl Pipelines replace props.conf and transforms.conf for normalization. The heavy forwarder tier becomes Cribl Stream, and the universal forwarders stay. The heaviest Splunk administration work moves to the pipeline.

The pipeline sends the events your detections use to Splunk and a full raw copy of everything to an S3 archive you own. The heaviest stroke is the one that stops paying analytics-tier prices.

What stays in Splunk

Every event that triggers alerts, populates dashboards, or supports investigation workflows stays in Splunk unchanged. Your existing SPL, saved searches, and dashboards continue to function. The data they reference is the same. What changes is that the volume nobody searches no longer costs analytics-tier pricing, and it is still there, in the S3 copy, the day an investigation needs it.

What peers measured

Cribl has published what some of its customers measured, each figure with its name. TransUnion took DNS and Sysmon from about 1 TB a day to about 150 GB, about 85 percent (Cribl case study, 29 August 2023). Yale New Haven Health cut Palo Alto log volume 40 percent, from 600 to 700 GB a day down to 400 GB (Cribl case study, 8 July 2024). Nutanix brought firewall log volume down 50 percent (Cribl customers page, read September 2026). Those are their sources on their estates. Yours is measured on your own data, in your own license usage view, before anything is cut over.

As Cribl published them: TransUnion cut DNS and Sysmon volume about 85 percent, Yale New Haven Health cut Palo Alto volume 40 percent, and Nutanix cut firewall volume 50 percent. Their estates, not yours, and yours is measured on your own data.

The Splunk cost model

Where the waste lives

The routing architecture

What stays in Splunk

What peers measured

See your architecture drawn, with the costs, before you spend anything.