Optimization

How the Log10x App expands compact events at search time, search-time overhead, potential license-tier reduction, and what happens to events the Receiver filters out.

How does the Log10x App expand optimized events

On Splunk and self-hosted Elasticsearch or OpenSearch, the Receiver compacts events losslessly before they hit Splunk (on Splunk, up to 256 KB per event), so on an ingest-based licence the saving lands on the bill. The open-source Log10x App expands compact events back to their original text at search time, and the record's metadata stays searchable as indexed fields.

How it works:

  1. A dedicated /tenx-search REST endpoint accepts a normal search
  2. The handler rewrites the search to include the tenx-inflate macro and creates a Splunk search job
  3. The macro joins compact events with templates from the KV Store
  4. Full-fidelity events returned with original field names and values

Storage architecture:

  • Templates stored in the tenx_dml KV Store collection
  • Compact events carry sourcetype tenx_encoded (in your existing index)
  • Hash references link events to their templates

Built-in Analytics Dashboard shows:

  • Total compact events and active templates
  • Reduction ratio and storage savings
  • Event volume trends over time
  • Top templates by usage
  • Expansion success rate

User experience: Classic dashboards keep their panel SPL unchanged through the app's dashboard hook. Dashboard Studio panels and search-bar queries start with the app's | tx command, since neither loads app JavaScript. Alerts created in the app's Compile Alert view are compiled once at save time into a native saved search. All of them read the original full-fidelity data.

Open source: Available on GitHub.

What is the search-time overhead in Splunk

A one-time template resolution matches search terms against the templates. Per-event expansion uses a KV Store primary-key lookup and native SPL functions. On Splunk 10.4.3, 20,000 expanded events return in about 3 seconds through a dashboard and about 21 seconds through tx, which writes every event out itself. Classic dashboard panels keep their SPL; Dashboard Studio panels and search-bar queries start with | tx; alerts created in the Compile Alert view are compiled once at save time.

The 10x Engine processes events at sub-millisecond per event. For resource requirements and Kubernetes resource specs, see Node counting.

Can 10x reduce our Splunk license tier

Yes, on an ingest-based licence, which meters uncompressed ingest: compact events are metered at their compact size, and filtering keeps capped events off the meter. See pricing for details.

Splunk quotes its ingest licence per contract, so the tier boundary you cross depends on yours; measure the sustained post-optimization average before renegotiating.

License renewal strategy: Deploy 10x ahead of renewal to demonstrate sustained reduction, then negotiate the new tier based on the post-optimization average.

Deployment sequence:

  • Cost analysis: Agentless analysis via the MCP server's SIEM-sample tool (read-only Splunk REST API query). Or deploy the Reporter DaemonSet for cost visibility before logs reach Splunk.
  • Deploy: Deploy the Receiver in Compact mode alongside your forwarders via Helm
  • Validate: Measure sustained reduction, validate with Splunk license usage reports
  • Renewal: Negotiate new tier based on demonstrated lower ingestion

Splunk Cloud: on ingest pricing, the reduction comes off the GB ingested; on workload pricing, measured in Splunk Virtual Compute (SVC), a smaller ingest lowers indexing and search load rather than a per-GB charge. Splunk Enterprise: a workload licence is measured in vCPUs, so there too the reduction shows as less indexing and search load.

What happens to logs filtered by the Receiver

The Receiver in Filter mode identifies low-priority logs (excessive debug, health checks, noise) based on your configured budget and severity thresholds. You control what happens to the filtered logs:

  • Offload to S3/object storage: Route to low-cost storage for compliance. Query via Athena or fetch back to Splunk on demand.
  • Route to different Splunk index: Send to a cheaper "cold" index with longer retention but lower priority.
  • Drop completely: Eliminate entirely after a validation period.

The Receiver exports cost metrics per event type (volume filtered, spend rate, and sampling ratios), queryable via the Prometheus Metrics API.