nth degree — VAR Partner Portal

Structured technical execution delivered by an assigned Cribl RSC over a defined service period. Four tiers from a focused sprint through full enterprise capacity.

SRV-CRIBL-RES-SPRINT

Cribl RS — Sprint

Focused Cribl expertise. Structured working sessions. Fast, targeted progress.

Targeted Advisory · 24 hrs · 90 days →

SRV-CRIBL-RES-FOUNDATION

Cribl RS — Foundation

Structured Cribl expertise. Consistent working rhythm. Steady progress.

Core Advisory · 48 hrs · 6 months →

SRV-CRIBL-RES-ADVANCED

Cribl RS — Advanced

More capacity. Same discipline. Faster progress on Cribl priorities.

Expanded Advisory · 96 hrs · 6 months →

SRV-CRIBL-RES-ENTERPRISE

Cribl RS — Enterprise

Highest capacity. Same discipline. Sustained Cribl execution at scale.

Sustained Advisory · 240 hrs · 6 months →

Splunk Resident Services

Structured technical execution delivered by an assigned Splunk RSC over a defined service period. Four tiers from a focused sprint through full enterprise capacity.

SRV-SPLK-RES-SPRINT

Splunk RS — Sprint

Focused Splunk expertise. Structured working sessions. Fast, targeted progress.

Targeted Advisory · 24 hrs · 90 days →

SRV-SPLK-RES-FOUNDATION

Splunk RS — Foundation

Structured Splunk expertise. Consistent working rhythm. Steady progress.

Core Advisory · 48 hrs · 6 months →

SRV-SPLK-RES-ADVANCED

Splunk RS — Advanced

More capacity. Same discipline. Faster progress on Splunk priorities.

Expanded Advisory · 96 hrs · 6 months →

SRV-SPLK-RES-ENTERPRISE

Splunk RS — Enterprise

Highest capacity. Same discipline. Sustained Splunk execution at scale.

Sustained Advisory · 144 hrs · 6 or 12 months →

Cribl Service Outcome Packages

Cribl Activation Programs

Fixed-scope deployment programs — structured, sequenced, and outcome-defined. From a single product activation to full enterprise deployment with five use cases.

SRV-CRIBL-ACT-SEARCH

Cribl Search Activation

Deploy Cribl Search. Enable immediate data access.

Activation · 4 Weeks · Fixed Fee →

SRV-CRIBL-ACT-FOUNDATION

Cribl Foundation Activation

Deploy Cribl. Deliver two use cases. Establish a working system.

Foundation · 3 Months · Fixed Fee →

SRV-CRIBL-ACT-ADVANCED

Cribl Advanced Activation

Deploy Cribl. Deliver three use cases. Expand capability with structured execution.

Advanced · 3 Months · Fixed Fee →

SRV-CRIBL-ACT-ENTERPRISE

Cribl Enterprise Activation

Deploy Cribl. Deliver five use cases. Establish enterprise-scale capability.

Enterprise · 3 Months · Fixed Fee →

Cribl Activation + Resident Services Bundles

Deployment plus sustained execution — activation followed by embedded Resident Services to ensure continued progress after go-live.

SRV-CRIBL-BND-FOUNDATION-6M

Cribl Foundation Bundle

Foundation Activation + 24 hrs Resident Services over 6 months.

Bundle · 6 Months →

SRV-CRIBL-BND-ADVANCED-9M

Cribl Advanced Bundle

Advanced Activation + 48 hrs Resident Services over 9 months.

Bundle · 9 Months →

SRV-CRIBL-BND-ENTERPRISE-9M

Cribl Enterprise Bundle

Enterprise Activation + 48 hrs Resident Services over 9 months.

Bundle · 9 Months →

Cribl Migration & Modernization

Structured programs to migrate, modernize, or replace legacy infrastructure with Cribl.

SRV-CRIBL-MIG-CLOUD

Cribl Cloud Migration

Migrate to cloud. Preserve integrity. Optimize for scale.

Migration · 4 Weeks · Fixed Fee →

SRV-CRIBL-SYSLOG-REPL

Cribl Syslog Replacement

Replace legacy syslog. Improve reliability. Modernize data intake.

Modernization · 2 Weeks · Fixed Fee →

Cribl Platform Health Check

Structured assessment of existing Cribl deployments — identify gaps, validate configuration, and define the optimization path forward.

SRV-CRIBL-HC-DEPLOY

Cribl Health Check — Deployment

Assess deployment. Validate configuration. Identify optimization opportunities.

Health Check · 1 Week · Fixed Fee →

Splunk Platform Health Checks

Splunk Health Checks

Structured assessments of Splunk environments — establish a baseline, validate architecture, and define the optimization path. Three tiers aligned to Land, Govern, and Accelerate motions.

SOL-SPLK-HEALTH-FND

Splunk Health Check — Foundational

Establish baseline. Identify gaps. Define the path forward.

Land Motion · 2 Days · Fixed Fee →

SOL-SPLK-HEALTH-STR

Splunk Health Check — Strategic

Validate performance. Align architecture. Enable optimization.

Govern Motion · 3 Days · Fixed Fee →

SOL-SPLK-HEALTH-ENT

Splunk Health Check — Enterprise

Assess at scale. Identify risk. Design for performance and growth.

Accelerate Motion · 5 Days · Fixed Fee →

Splunk Detection Engineering

Build, tune, and operationalize detections within Splunk ES. Three tiers from a fast-turn Top 10 deployment through enterprise-scale detection program development.

SOL-SPLK-DET-10

Detection Engineering — Top 10

Ten high-value detections. Fast deployment. Immediate security improvement.

Productized Pack · 3–5 Days · Fixed Fee →

SOL-SPLK-DET-FND

Detection Engineering — Foundational

Build detections. Improve signal. Establish baseline coverage.

Land Motion · 3 Days · Fixed Fee →

SOL-SPLK-DET-ENT

Detection Engineering — Enterprise

Expand coverage. Standardize structure. Operationalize detection at scale.

Accelerate Motion · 10 Days · Fixed Fee →

Splunk Data Engineering Packages

Splunk Data Engineering

Structure, optimize, and scale Splunk data pipelines — from foundational onboarding through enterprise-scale data architecture. Three tiers aligned to Land, Govern, and Accelerate motions.

SOL-SPLK-DATA-FND

Data Engineering — Foundational

Structure Data. Improve Efficiency. Establish Control.

Land Motion · 3 Days · Fixed Fee →

SOL-SPLK-DATA-STR

Data Engineering — Strategic

Optimize Data Pipelines. Reduce Cost. Align Data to Value.

Govern Motion · 5 Days · Fixed Fee →

SOL-SPLK-DATA-ENT

Data Engineering — Enterprise

Scale Data Architecture. Control Cost. Design for Long-Term Efficiency.

Accelerate Motion · 10 Days · Fixed Fee →

Splunk Visualization Engineering Packages

Splunk Visualization Engineering

Transform Splunk data into clear, decision-ready insight — from foundational dashboard development through enterprise-wide reporting standardization. Three tiers aligned to Land, Govern, and Accelerate motions.

SOL-SPLK-VIZ-FND

Visualization — Foundational

Turn Data into Insight. Deliver Clarity. Enable Better Decisions.

Land Motion · 3 Days · Fixed Fee →

SOL-SPLK-VIZ-STR

Visualization — Strategic

Align Metrics. Standardize Reporting. Enable Better Decisions.

Govern Motion · 5 Days · Fixed Fee →

SOL-SPLK-VIZ-ENT

Visualization — Enterprise

Scale Reporting. Standardize Insight. Enable Enterprise Decision-Making.

Accelerate Motion · 10 Days · Fixed Fee →

Splunk Asset & Identity Packages

Splunk Asset & Identity

Enrich Splunk detections and reporting with structured asset and identity context — from targeted enrichment through enterprise-scale context architecture. Two tiers aligned to Govern and Accelerate motions.

SOL-SPLK-ASSET-ID-STR

Asset & Identity — Strategic

Add Context. Improve Accuracy. Strengthen Detection and Insight.

Govern Motion · 5 Days · Fixed Fee →

SOL-SPLK-ASSET-ID-ENT

Asset & Identity — Enterprise

Scale Context. Improve Precision. Enable Enterprise-Wide Visibility.

Accelerate Motion · 10 Days · Fixed Fee →

Block Time Services

Fractional Block Time

Focused, time-bound expert execution for defined Cribl and Splunk projects. No subscription required — purchase a block, define the objective, get it done.

SRV-CRIBL-BT-FRAC

Cribl Fractional Block Time

Expert Cribl execution against a defined objective — no subscription required.

Block Time · Cribl →

SRV-SPLK-BT-FRAC

Splunk Fractional Block Time

Expert Splunk execution against a defined objective — no subscription required.

Block Time · Splunk →

← Back to Services Overview Ideal For Scope What You Get Commercial

SRV-CRIBL-ACT-SEARCH

Cribl Search Activation

Deploy Cribl Search. Enable Immediate Data Access.

● FIXED-SCOPE ACTIVATION

nth → VAR

$5,760

Wholesale price to VAR

VAR → Client

$7,200

Suggested resale (~20% margin)

nth MSRP

$8,000

4 Weeks · Fixed Scope

Search infrastructure must be structured at deployment to be usable — this engagement ensures Cribl Search is deployed correctly from the start.

Ideal For

🟢

Greenfield Deployments

Organizations deploying Cribl Search for the first time who need a structured, use-case-aligned implementation.

📂

Distributed Data Access

Teams enabling search across distributed data sources who need storage tiers and retrieval strategy configured correctly.

⚡

Performance Consistency

Environments where inconsistent query performance indicates gaps in indexing patterns and access configuration.

🔧

Workflow Operationalization

Teams lacking clarity on how to operationalize search workflows post-deployment.

Activation Scope

✓ Included

Cribl Search deployment and configuration
Data source connectivity and access setup
Storage tier and retrieval strategy configuration
Query performance and workflow validation
Deployment documentation and handoff

✗ Out of Scope

Ongoing pipeline management or optimization
Additional use case implementation beyond search
Post-deployment operational support
Custom integrations not defined at engagement start

What You Get

Deployed Search Environment

Fully deployed Cribl Search environment aligned to defined use cases and data access requirements.

Configured Data Access

Data source connectivity, storage tiers, and retrieval strategy configured and validated.

Validated Search Workflows

Search workflows validated for performance and correctness against defined use cases.

Documentation & Handoff

Deployment documentation and structured handoff to ensure teams can operate the environment.

Knowledge Transfer

Embedded knowledge transfer during working sessions so teams can execute search workflows effectively.

Fixed-Scope Delivery

Defined scope, defined outcome, defined timeline — no scope creep, no open-ended billing.

Deliverables & Commercial

Deliverables

Fully deployed Cribl Search environment
Configured data access and storage strategy
Validated search workflows
Deployment documentation and handoff

What Success Looks Like

Search environment deployed and operational
Data accessible and queryable as expected
Performance aligned to defined use cases
Team able to execute search workflows effectively

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Cribl Outcome Package — Activation
Tier	Foundation
Pricing Model	Fixed Fee (Scoped Outcome)
Term	4 Weeks Typical
nth → VAR Price	$5,760
VAR → Client Price	$7,200
nth degree MSRP	$8,000
VAR Margin Target	~20%

← Back to Services Overview Ideal For Scope What You Get Commercial

SRV-CRIBL-ACT-FOUNDATION

Cribl Foundation Activation

Deploy Cribl. Deliver Two Use Cases. Establish a Working System.

● FIXED-SCOPE ACTIVATION PROGRAM

nth → VAR

$9,600

Wholesale price to VAR

VAR → Client

$12,000

Suggested resale (~20% margin)

nth MSRP

$13,000

3 Months · ~20 Sessions

Cribl Activation is a structured program, not open-ended deployment — this engagement delivers a working system with two validated use cases in 90 days.

Ideal For

🟢

Net-New Deployments

Organizations starting fresh with Cribl who need structured deployment, not open-ended implementation.

🎯

Defined Initial Use Cases

Teams with two priority use cases ready to implement and validate during the activation program.

📘

Guided Implementation

Teams requiring Cribl-certified guidance through deployment, configuration, and enablement.

⏱

90-Day Delivery Window

Organizations needing a working Cribl system with validated use cases within a 90-day structured program.

Activation Scope

✓ Base Activation Included

Architecture design and dependency planning
Use Case Planning Workshop
Deployment of Cribl (Leader + Worker Groups)
Source and destination configuration
Deployment validation
Two (2) customer-selected use cases
Architecture and As-Built documentation

✗ Out of Scope

More than two use cases
Post-activation operational support
Custom integrations not defined at start
Ongoing pipeline management

Delivery model: ~20 guided sessions over a 90-day activation window. Remote delivery with Cribl-certified consultant. Active customer participation required.

What You Get

Deployed Cribl Environment

Cribl deployed and aligned to defined architecture with Leader + Worker Groups configured.

Two Production Use Cases

Two customer-selected use cases implemented, validated, and production-ready at engagement close.

Validated Data Routing

Data routing, filtering, and destinations validated and operating as designed.

Architecture Documentation

Architecture and As-Built documentation delivered at program completion.

Knowledge Transfer

Embedded knowledge transfer across ~20 guided sessions so teams can operate and extend the platform.

90-Day Delivery

Structured program with defined sequence — working system delivered within 90 days.

Deliverables & Commercial

Deliverables

Deployed Cribl environment aligned to defined architecture
Two (2) production-ready use cases
Validated data routing, filtering, and destinations
Architecture and As-Built documentation

What Success Looks Like

Cribl deployed and operational within 90 days
Two use cases implemented and validated
Data flowing correctly to defined destinations
Team able to operate and extend the platform

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Cribl Outcome Package — Activation
Tier	Foundation
Pricing Model	Fixed Fee
Term	3 Months (~20 sessions)
Use Cases	2 (customer-selected)
nth → VAR Price	$9,600
VAR → Client Price	$12,000
nth degree MSRP	$13,000
VAR Margin Target	~20%

← Back to Services Overview Ideal For Scope What You Get Commercial

SRV-CRIBL-ACT-ADVANCED

Cribl Advanced Activation

Deploy Cribl. Deliver Three Use Cases. Expand Capability with Structured Execution.

● FIXED-SCOPE ACTIVATION PROGRAM

nth → VAR

$19,200

Wholesale price to VAR

VAR → Client

$24,000

Suggested resale (~20% margin)

nth MSRP

$27,500

3 Months · ~30 Sessions

Cribl Activation scales through structured execution — not incremental build. Three validated use cases delivered in 90 days.

Ideal For

📈

Expanding Beyond Initial Deployment

Organizations moving past initial Cribl use cases who need structured execution across multiple priorities.

🔀

Coordinated Multi-Use Case Build

Environments where multiple use cases require coordinated implementation to avoid inconsistent builds.

⚙

Scaling Data Onboarding

Teams where data onboarding, routing, and reduction must scale together with structured guidance.

🏗

Architecture-First Expansion

Organizations where early architecture decisions impact downstream efficiency across multiple use cases.

Activation Scope

✓ Base Activation Included

Architecture design and dependency planning
Use Case Planning Workshop
Deployment of Cribl (Leader + Worker Groups)
Source and destination configuration
Deployment validation
Three (3) customer-selected use cases
Architecture and As-Built documentation

✗ Out of Scope

More than three use cases
Post-activation operational support
Custom integrations not defined at start
Ongoing pipeline management

Delivery model: ~30 guided sessions (typically 2 hours each) over a 90-day activation window. Remote delivery with Cribl-certified consultant.

What You Get

Deployed Cribl Environment

Cribl deployed and aligned to defined architecture with Leader + Worker Groups configured.

Three Production Use Cases

Three customer-selected use cases implemented, validated, and production-ready.

Validated Data Routing

Data routing, filtering, and destinations validated across all three use cases.

Architecture Documentation

Architecture and As-Built documentation delivered at program completion.

Knowledge Transfer

Embedded knowledge transfer across ~30 guided sessions so teams can extend and scale with confidence.

90-Day Delivery

Working system with three validated use cases delivered within 90 days.

Deliverables & Commercial

Deliverables

Deployed Cribl environment aligned to defined architecture
Three (3) production-ready use cases
Validated data routing, filtering, and destinations
Architecture and As-Built documentation

What Success Looks Like

Cribl deployed and operational within 90 days
Three use cases implemented and validated
Data flowing correctly across defined pipelines
Team able to extend and scale with confidence

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Cribl Outcome Package — Activation
Tier	Advanced
Pricing Model	Fixed Fee
Term	3 Months (~30 sessions)
Use Cases	3 (customer-selected)
nth → VAR Price	$19,200
VAR → Client Price	$24,000
nth degree MSRP	$27,500
VAR Margin Target	~20%

← Back to Services Overview Ideal For Scope What You Get Commercial

SRV-CRIBL-ACT-ENTERPRISE

Cribl Enterprise Activation

Deploy Cribl. Deliver Five Use Cases. Establish Enterprise-Scale Capability.

● FIXED-SCOPE ACTIVATION PROGRAM

nth → VAR

$28,800

Wholesale price to VAR

VAR → Client

$36,000

Suggested resale (~20% margin)

nth MSRP

$40,000

3 Months · ~40 Sessions

Enterprise-scale activation requires structured execution — a standardized system with five validated use cases delivered in 90 days.

Ideal For

🏢

Enterprise-Scale Deployments

Organizations deploying Cribl across multiple data domains requiring coordinated onboarding and routing.

📐

Standardized Pipeline Architecture

Teams where pipeline standardization is critical for long-term scalability and maintainability.

🔀

Parallel Use Case Implementation

Environments implementing multiple use cases in parallel across different teams or data domains.

⚠

High-Stakes Architecture Decisions

Organizations where early design decisions will impact cost, performance, and maintainability at scale.

Activation Scope

✓ Base Activation Included

Architecture design and dependency planning
Use Case Planning Workshop
Deployment of Cribl (Leader + Worker Groups)
Source and destination configuration
Deployment validation
Five (5) customer-selected use cases
Standardized pipeline architecture
Architecture and As-Built documentation

✗ Out of Scope

More than five use cases
Post-activation operational support
Custom integrations not defined at start
Ongoing pipeline management

Delivery model: ~40 guided sessions (typically 2 hours each) over a 90-day activation window. Remote delivery with Cribl-certified consultant.

What You Get

Enterprise Cribl Deployment

Cribl deployed and aligned to enterprise architecture across multiple data domains.

Five Production Use Cases

Five customer-selected use cases implemented, validated, and production-ready.

Standardized Pipeline Architecture

Standardized routing, filtering, and pipeline structure across domains for long-term scalability.

Architecture Documentation

Architecture and As-Built documentation delivered at program completion.

Knowledge Transfer

Embedded knowledge transfer across ~40 guided sessions so teams can scale and extend confidently.

90-Day Delivery

Enterprise-grade structured program — standardized system with five validated use cases in 90 days.

Deliverables & Commercial

Deliverables

Deployed Cribl environment aligned to enterprise architecture
Five (5) production-ready use cases
Standardized data routing, filtering, and pipeline structure
Architecture and As-Built documentation

What Success Looks Like

Cribl deployed and operational within 90 days
Five use cases implemented and validated
Standardized pipeline architecture across domains
Team able to scale and extend the platform confidently

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Cribl Outcome Package — Activation
Tier	Enterprise
Pricing Model	Fixed Fee
Term	3 Months (~40 sessions)
Use Cases	5 (customer-selected)
nth → VAR Price	$28,800
VAR → Client Price	$36,000
nth degree MSRP	$40,000
VAR Margin Target	~20%

← Back to Services Overview Activation + RS Scope What You Get Commercial

SRV-CRIBL-BND-FOUNDATION-6M

Cribl Foundation Bundle

Deploy Cribl. Deliver Two Use Cases. Sustain Progress with Embedded Support.

● BUNDLED PROGRAM · 6 MONTHS

nth → VAR

$17,600

Wholesale price to VAR

VAR → Client

$22,000

Suggested resale (~20% margin)

nth MSRP

$24,000

Foundation Activation + 24 hrs RS

Activation delivers the system. Resident Services ensure progress continues — structured deployment with embedded follow-on support over 6 months.

Bundle Scope

✓ Activation (Months 1–3)

Architecture design and dependency planning
Use Case Planning Workshop
Deployment of Cribl (Leader + Worker Groups)
Two (2) customer-selected use cases
Architecture and As-Built documentation
~20 guided sessions over 90 days

+ Resident Services (Months 4–6)

24 hours of Resident Services
~8 hours per month over 3 months
2-hour minimum sessions, scheduled in advance
Pipeline expansion and optimization
Additional use case development
Knowledge transfer and enablement

What You Get

Deployed Cribl System

Cribl deployed and operational within 90 days with two validated use cases.

Sustained Execution

24 hours of Resident Services post-activation to maintain and extend execution momentum.

Continued Pipeline Growth

Resident sessions focused on expanding data onboarding, pipelines, and use cases.

Increased Team Capability

Hands-on knowledge transfer throughout both activation and resident phases.

Architecture Documentation

As-Built documentation delivered at activation completion.

6-Month Engagement

Structured program spanning deployment through sustained post-activation support.

Deliverables & Commercial

Bundle Components

Foundation Activation: 2 use cases, 90-day window
Resident Services: 24 hours over months 4–6
~8 hours/month Resident cadence
Architecture and As-Built documentation

What Success Looks Like

Cribl deployed and operational within 90 days
Two use cases delivered and validated
Continued expansion of pipelines and use cases
Sustained execution momentum beyond activation

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Cribl Bundled Program
Tier	Foundation
Pricing Model	Bundled Capacity + Fixed Scope
Total Term	6 Months
Scope	Foundation Activation + 8 hrs/mo (3 months)
nth → VAR Price	$17,600
VAR → Client Price	$22,000
nth degree MSRP	$24,000
VAR Margin Target	~20%

← Back to Services Overview Activation + RS Scope What You Get Commercial

SRV-CRIBL-BND-ADVANCED-9M

Cribl Advanced Bundle

Deploy Cribl. Deliver Three Use Cases. Sustain and Expand with Structured Execution.

● BUNDLED PROGRAM · 9 MONTHS

nth → VAR

$33,600

Wholesale price to VAR

VAR → Client

$42,000

Suggested resale (~20% margin)

nth MSRP

$45,000

Advanced Activation + 48 hrs RS

Activation delivers the system. Resident Services ensure continued expansion and optimization over 9 months.

Bundle Scope

✓ Activation (Months 1–3)

Architecture design and dependency planning
Use Case Planning Workshop
Deployment of Cribl (Leader + Worker Groups)
Three (3) customer-selected use cases
Architecture and As-Built documentation
~30 guided sessions over 90 days

+ Resident Services (Months 4–9)

48 hours of Resident Services
~8 hours per month over 6 months
2-hour minimum sessions, scheduled in advance
Pipeline expansion and optimization
Additional use case development
Knowledge transfer and enablement

What You Get

Deployed Cribl System

Cribl deployed and operational within 90 days with three validated use cases.

Sustained Execution

48 hours of Resident Services post-activation to maintain and extend execution momentum.

Continued Expansion

Resident sessions focused on expanding use cases, pipelines, and optimization over 6 months.

Increased Team Capability

Hands-on knowledge transfer throughout both activation and resident phases.

Architecture Documentation

As-Built documentation delivered at activation, maintained through resident phase.

9-Month Engagement

Structured program spanning initial deployment through sustained long-term execution.

Deliverables & Commercial

Bundle Components

Advanced Activation: 3 use cases, 90-day window
Resident Services: 48 hours over months 4–9
~8 hours/month Resident cadence
Architecture and As-Built documentation

What Success Looks Like

Cribl deployed and operational within 90 days
Three use cases delivered and validated
Continued expansion of pipelines and use cases
Sustained execution momentum over 9 months

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Cribl Bundled Program
Tier	Advanced
Pricing Model	Bundled Capacity + Fixed Scope
Total Term	9 Months
Scope	Advanced Activation + 8 hrs/mo (6 months)
nth → VAR Price	$33,600
VAR → Client Price	$42,000
nth degree MSRP	$45,000
VAR Margin Target	~20%

← Back to Services Overview Activation + RS Scope What You Get Commercial

SRV-CRIBL-BND-ENTERPRISE-9M

Cribl Enterprise Bundle

Deploy Cribl. Deliver Five Use Cases. Sustain Execution at Scale.

● BUNDLED PROGRAM · 9 MONTHS

nth → VAR

$42,000

Wholesale price to VAR

VAR → Client

$52,500

Suggested resale (~20% margin)

nth MSRP

$55,000

Enterprise Activation + 48 hrs RS

Activation establishes the enterprise foundation. Resident Services ensure it scales and continues to deliver value over time.

Bundle Scope

✓ Activation (Months 1–3)

Architecture design and dependency planning
Use Case Planning Workshop
Deployment of Cribl (Leader + Worker Groups)
Five (5) customer-selected use cases
Standardized pipeline architecture
Architecture and As-Built documentation
~40 guided sessions over 90 days

+ Resident Services (Months 4–9)

48 hours of Resident Services
~8 hours per month over 6 months
2-hour minimum sessions, scheduled in advance
Enterprise expansion and standardization
Performance and cost optimization at scale
Knowledge transfer and enablement

What You Get

Enterprise Cribl Deployment

Cribl deployed and operational within 90 days with five validated use cases at enterprise scale.

Sustained Enterprise Execution

48 hours of Resident Services to ensure the platform scales and continues to deliver value.

Standardization & Expansion

Resident sessions focused on expanding pipelines, standardizing architecture, and scaling use cases.

Increased Team Capability

Hands-on knowledge transfer throughout both activation and resident phases at enterprise scale.

Architecture Documentation

Comprehensive As-Built documentation delivered at activation, maintained through resident phase.

9-Month Engagement

Full enterprise lifecycle — deployment through sustained, structured execution at scale.

Deliverables & Commercial

Bundle Components

Enterprise Activation: 5 use cases, 90-day window
Resident Services: 48 hours over months 4–9
~8 hours/month Resident cadence
Architecture and As-Built documentation

What Success Looks Like

Cribl deployed and operational within 90 days
Five use cases delivered and validated
Continued expansion and standardization across pipelines
Sustained execution momentum across teams and domains

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Cribl Bundled Program
Tier	Enterprise
Pricing Model	Bundled Capacity + Fixed Scope
Total Term	9 Months
Scope	Enterprise Activation + 8 hrs/mo (6 months)
nth → VAR Price	$42,000
VAR → Client Price	$52,500
nth degree MSRP	$55,000
VAR Margin Target	~20%

← Back to Services Overview Ideal For Scope What You Get Commercial

SRV-CRIBL-MIG-CLOUD

Cribl Cloud Migration

Migrate to Cloud. Preserve Integrity. Optimize for Scale.

● FIXED-SCOPE MIGRATION PROGRAM

nth → VAR

$8,800

Wholesale price to VAR

VAR → Client

$11,000

Suggested resale (~20% margin)

nth MSRP

$12,000

4 Weeks · Fixed Scope

Cloud migration requires structure to avoid disruption — Cribl migrated, validated, and optimized for cloud performance and cost.

Ideal For

☁

Cloud Migration Projects

Organizations moving Cribl from on-premises or legacy infrastructure to cloud environments.

🔄

Infrastructure Modernization

Teams modernizing data routing where cloud optimization and cost profiling must be validated.

🛡

Minimal Disruption Required

Environments where pipeline continuity and downstream system stability are critical during migration.

⚡

Performance & Cost Optimization

Organizations where cloud performance and cost profiles need to be validated and optimized post-migration.

Migration Scope

✓ Included

Current state architecture review
Migration planning and dependency mapping
Cloud environment configuration
Pipeline migration and validation
Source and destination reconfiguration
Performance and cost validation
Architecture and As-Built documentation

✗ Out of Scope

New pipeline builds beyond existing scope
New use case implementation
Post-migration operational support
Cloud infrastructure provisioning

What You Get

Migrated Cloud Environment

Cribl fully migrated and operational in the target cloud environment.

Validated Pipelines

All pipelines and data routing validated post-migration to ensure no disruption to downstream systems.

Cloud Optimization

Configuration optimized for cloud performance and cost aligned to defined expectations.

Architecture Documentation

Updated architecture and As-Built documentation reflecting the migrated cloud environment.

Knowledge Transfer

Embedded knowledge transfer so teams can operate and maintain Cribl in the cloud environment.

Dependency Mapping

Documented migration plan and dependency map produced before migration execution begins.

Deliverables & Commercial

Deliverables

Migrated Cribl environment to cloud infrastructure
Validated pipelines and data routing
Optimized configuration for cloud performance and cost
Architecture and As-Built documentation

What Success Looks Like

Cribl successfully operating in cloud environment
Data flowing correctly across all pipelines and destinations
Performance and cost aligned to expectations
No disruption to downstream systems

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Cribl Outcome Package — Migration
Tier	Enterprise
Pricing Model	Fixed Fee (Scoped Outcome)
Term	4 Weeks
nth → VAR Price	$8,800
VAR → Client Price	$11,000
nth degree MSRP	$12,000
VAR Margin Target	~20%

← Back to Services Overview Ideal For Scope What You Get Commercial

SRV-CRIBL-SYSLOG-REPL

Cribl Syslog Replacement

Replace Legacy Syslog. Improve Reliability. Modernize Data Intake.

● FIXED-SCOPE REPLACEMENT PROGRAM

nth → VAR

$11,000

Wholesale price to VAR

VAR → Client

$13,750

Suggested resale (~20% margin)

nth MSRP

$15,000

2 Weeks · Fixed Scope

Replacing syslog infrastructure requires controlled execution to avoid disruption — this engagement transitions legacy syslog functions into Cribl with structured implementation and validation.

Ideal For

🔁

Legacy Syslog Replacement

Organizations where existing syslog platforms are difficult to maintain, expand, or provide consistent data forwarding across sources and destinations.

📡

Data Intake Modernization

Teams modernizing data intake and routing controls where legacy syslog visibility and performance have degraded over time.

⚡

Reliability & Visibility Improvement

Environments where routing and filtering controls are limited or brittle and improved observability of data intake is required.

📐

Improved Routing Flexibility

Organizations requiring greater control over syslog routing, filtering, and forwarding behavior across sources and destinations.

Replacement Scope

✓ Base Replacement Included

Current state syslog architecture review
Replacement planning and dependency mapping
Cribl configuration for syslog intake and routing
Source migration and destination validation
Testing of routing, filtering, and forwarding behavior
Documentation of replacement architecture and configuration

✗ Out of Scope

Non-syslog data source onboarding
Broader platform deployment or activation
Post-engagement operational support
Infrastructure provisioning

Delivery model: Structured working sessions (typically 2 hours each). Remote delivery with Cribl-certified consultant. Active customer participation required.

What You Get

Transitioned Syslog Functions

Legacy syslog functions structured replaced by Cribl with controlled implementation and validation throughout.

Validated Routing & Forwarding

Routing, filtering, and forwarding behavior tested and validated — data flowing correctly to intended destinations.

Improved Reliability & Visibility

Improved reliability and observability of data intake replacing brittle legacy syslog controls.

Dependency Mapping

Replacement plan and dependency map produced before migration execution begins — no surprises.

Architecture Documentation

Replacement architecture and configuration documentation delivered at engagement close.

Knowledge Transfer

Guided sessions with embedded knowledge transfer so teams can manage and extend the new intake layer.

Deliverables & Commercial

Deliverables

Structured replacement of legacy syslog functions with Cribl
Validated routing, filtering, and destination behavior
Improved reliability and visibility into data intake
Architecture and As-Built documentation

What Success Looks Like

Legacy syslog functions successfully transitioned to Cribl
Data routed correctly to intended destinations
Improved reliability, flexibility, and observability of data intake
Reduced operational friction in managing syslog flows

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Cribl Outcome Package — Modernization
Tier	Strategic
Pricing Model	Fixed Fee (Scoped Outcome)
Term	2 Weeks
nth → VAR Price	$11,000
VAR → Client Price	$13,750
nth degree MSRP	$15,000
VAR Margin Target	~20%

This service can be enhanced through Activation, Resident Services, or mesh™ subscription models for broader modernization, optimization, or governance.

← Back to Services Overview Ideal For Assessment Scope What You Get Commercial

SRV-CRIBL-HC-DEPLOY

Cribl Health Check — Deployment

Assess Deployment. Validate Configuration. Identify Optimization Opportunities.

● FIXED-SCOPE HEALTH CHECK

nth → VAR

$2,000

Wholesale price to VAR

VAR → Client

$2,500

Suggested resale (~20% margin)

nth MSRP

$2,995

1 Week · Fixed Scope

You cannot optimize what you cannot clearly assess — a structured evaluation of Cribl deployment health with actionable, prioritized recommendations.

Ideal For

🔍

Production Deployments

Organizations with Cribl in production who need a structured review to identify configuration drift and performance gaps.

⚠

Performance Concerns

Environments experiencing performance bottlenecks, cost inefficiencies, or inconsistent data routing.

📐

Pre-Expansion Assessment

Teams preparing to expand, migrate, or optimize their Cribl deployment who need a clear current-state baseline.

🛣

Roadmap Definition

Organizations needing a structured, prioritized remediation roadmap before committing to the next phase.

Assessment Scope

✓ Included

Current state architecture review
Pipeline and configuration analysis
Data routing and destination validation
Performance and throughput evaluation
Cost and data reduction assessment
Identification of optimization opportunities
Findings documentation and recommendations

✗ Out of Scope

Remediation or implementation work
New pipeline builds or use cases
Post-assessment ongoing support
Architecture redesign or migration planning

Follow-on: Findings from this Health Check can be executed through Activation, Resident Services, or mesh™ subscription models.

What You Get

Deployment Health Assessment

Comprehensive evaluation of current Cribl deployment health across pipeline, configuration, and performance dimensions.

Identified Gaps

Performance, configuration, and efficiency gaps identified and documented with clear context.

Prioritized Recommendations

Structured, prioritized recommendations for improvement — not a generic checklist.

Architecture Review

Architecture and configuration review documentation delivered as part of the assessment output.

Optimization Roadmap

Clear path forward for remediation and optimization, structured for action.

Pipeline Visibility

Improved visibility into pipeline performance, cost, and efficiency as a direct output of the assessment.

Deliverables & Commercial

Deliverables

Comprehensive Cribl deployment health assessment
Identified and prioritized optimization opportunities
Architecture and configuration review documentation
Defined path forward for remediation and improvement

What Success Looks Like

Clear understanding of current system health
Identified and prioritized optimization opportunities
Improved visibility into pipeline performance and efficiency
Defined path forward for remediation and improvement

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Cribl Platform Health Check
Tier	Foundation
Pricing Model	Fixed Fee (Scoped Outcome)
Term	1 Week
nth → VAR Price	$2,000
VAR → Client Price	$2,500
nth degree MSRP	$2,995
VAR Margin Target	~20%

← Back to Services Overview Ideal For Scope What You Get Commercial

SOL-SPLK-HEALTH-FND

Splunk Health Check — Foundational

Establish Baseline. Identify Gaps. Define the Path Forward.

● LAND MOTION · FIXED-SCOPE ASSESSMENT

nth → VAR

$2,500

Wholesale price to VAR

VAR → Client

$3,125

Suggested resale (~20% margin)

nth MSRP

$3,495

2 Days · Fixed Scope

You cannot improve what you have not clearly assessed — this engagement establishes the baseline required for meaningful progress across performance, data, and configuration.

Ideal For

🟢

New Client Onboarding

New clients onboarding to nth degree services who need a structured baseline before any optimization or execution work begins.

❓

Unclear Performance Issues

Existing environments with performance degradation, resource utilization concerns, or search issues without clear root cause visibility.

📐

Pre-Optimization Assessment

Organizations preparing for any optimization, expansion, or investment initiative who require a clear current-state baseline first.

📋

Baseline Requirement

Teams where stakeholder alignment on next steps requires a structured, evidenced assessment of the current environment.

Engagement Scope

✓ Included (2 Days)

Splunk environment assessment and analysis
Architecture and configuration review
Data onboarding and pipeline validation
Search performance and resource utilization review
Identification of optimization opportunities
Health Check report with findings and recommendations
Executive readout with recommended next steps

✗ Out of Scope

Remediation or implementation work
Deep architectural analysis (see Strategic tier)
Post-assessment ongoing support
Custom integrations or configuration changes

Positioning: This is the Land motion for Splunk Health — it establishes clarity before execution. Not a generic review. A structured baseline for action.

What You Get

Health Check Report

Comprehensive findings and recommendations covering architecture, configuration, data, and performance.

Identified Risks & Gaps

Performance gaps, data onboarding issues, and configuration risks identified and documented with context.

Prioritized Opportunities

Optimization opportunities prioritized by impact — structured for action, not a generic checklist.

Architecture Review

Review of Splunk architecture, configuration, and data pipeline against current operational and security use cases.

Executive Readout

Executive-level summary of findings with recommended next steps — ready for stakeholder presentation.

Clear Path Forward

Stakeholder alignment on current state and a defined improvement roadmap as a direct output of the assessment.

Deliverables & Commercial

Deliverables

Health Check report with findings and recommendations
Identified risks and performance gaps
Prioritized improvement opportunities
Executive readout with recommended next steps

What Success Looks Like

Clear understanding of current Splunk environment state
Identified gaps across performance, data, and configuration
Prioritized roadmap for improvement
Alignment between stakeholders on next steps

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Splunk Health Check
Tier	Foundation — Land Motion
Pricing Model	Fixed Fee (Scoped Outcome)
Term	2 Days
nth → VAR Price	$2,500
VAR → Client Price	$3,125
nth degree MSRP	$3,495
VAR Margin Target	~20%

When combined with a mesh™ subscription, organizations benefit from ongoing prioritization, governance, and sustained execution against identified improvement areas.

← Back to Services Overview Ideal For Scope What You Get Commercial

SOL-SPLK-HEALTH-STR

Splunk Health Check — Strategic

Validate Performance. Align Architecture. Enable Optimization.

● GOVERN MOTION · FIXED-SCOPE ASSESSMENT

nth → VAR

$4,150

Wholesale price to VAR

VAR → Client

$5,187.50

Suggested resale (~20% margin)

nth MSRP

$5,995

3 Days · Fixed Scope

Optimization requires more than visibility — this engagement provides the structure and insight needed to improve performance and scale effectively.

Ideal For

📈

Performance & Scaling Challenges

Environments experiencing performance degradation across search, indexing, and data pipelines as the platform grows.

🏗

Architecture Alignment

Organizations where misalignment between architecture and evolving use cases is limiting efficiency and scalability.

💰

Cost & Utilization Concerns

Teams identifying resource utilization inefficiencies and cost drivers that require deeper analysis than a baseline review.

🔍

Beyond Baseline Assessment

Organizations that have completed a Foundational Health Check and require deeper architectural and performance insight.

Engagement Scope

✓ Included (3 Days)

Detailed architecture and deployment analysis
Indexing, data flow, and pipeline evaluation
Search performance and resource utilization assessment
Identification of bottlenecks and inefficiencies
Optimization opportunity mapping
Strategic Health Check report with detailed findings
Prioritized optimization roadmap
Executive readout with actionable recommendations

✗ Out of Scope

Remediation or implementation work
Enterprise-scale cross-environment analysis (see Enterprise tier)
Post-assessment ongoing support
Custom configuration changes

Positioning: This is the Govern motion for Splunk Health — it aligns architecture and performance to enable optimization. Not a surface-level review. A structured evaluation designed to enable meaningful improvement.

What You Get

Strategic Health Check Report

Detailed findings covering architecture, indexing strategy, data flow, pipeline efficiency, and search performance.

Performance & Architectural Gaps

Identified performance and architectural gaps documented with context — not a generic list of observations.

Optimization Roadmap

Prioritized optimization roadmap structured for action across performance, cost, and architecture improvement.

Bottleneck Identification

Search and ingestion bottlenecks identified and mapped to architectural root causes.

Executive Readout

Executive-level summary with actionable recommendations — ready for stakeholder and leadership presentation.

Scalability Alignment

Validation of alignment between platform design and operational needs with a defined path toward improved efficiency.

Deliverables & Commercial

Deliverables

Strategic Health Check report with detailed findings
Identified performance and architectural gaps
Prioritized optimization roadmap
Executive readout with actionable recommendations

What Success Looks Like

Clear understanding of performance and architectural constraints
Identified and prioritized optimization opportunities
Alignment between platform design and operational needs
Defined path toward improved efficiency and scalability

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Splunk Health Check
Tier	Strategic — Govern Motion
Pricing Model	Fixed Fee (Scoped Outcome)
Term	3 Days
nth → VAR Price	$4,150
VAR → Client Price	$5,187.50
nth degree MSRP	$5,995
VAR Margin Target	~20%

When combined with a mesh™ subscription, organizations benefit from ongoing governance, continuous optimization, and sustained execution against identified improvement initiatives.

← Back to Services Overview Ideal For Scope What You Get Commercial

SOL-SPLK-HEALTH-ENT

Splunk Health Check — Enterprise

Assess at Scale. Identify Risk. Design for Performance and Growth.

● ACCELERATE MOTION · FIXED-SCOPE ASSESSMENT

nth → VAR

$6,650

Wholesale price to VAR

VAR → Client

$8,312.50

Suggested resale (~20% margin)

nth MSRP

$9,495

5 Days · Fixed Scope

At enterprise scale, performance and risk are interconnected — this engagement ensures your Splunk environment is designed to scale efficiently, perform reliably, and support long-term growth.

Ideal For

🏢

Large-Scale Deployments

Large-scale or multi-environment Splunk deployments where performance degradation, inconsistent architecture, and data growth present systemic challenges.

⚠

Cost & Risk at Scale

Organizations where data growth is outpacing cost control and infrastructure design, creating risk that is difficult to isolate and resolve.

🚀

Pre-Growth or Transformation

Teams preparing for significant growth, expansion, or platform transformation who require enterprise-level architectural alignment first.

🔀

Cross-Environment Visibility

Environments with fragmented onboarding, indexing, and retention strategies across business units requiring end-to-end evaluation.

Engagement Scope

✓ Included (5 Days)

Enterprise architecture and deployment analysis
Data growth, indexing, and retention strategy evaluation
Cross-environment performance and scalability assessment
Identification of systemic risks and inefficiencies
Assessment of cost drivers and efficiency opportunities
Optimization and future-state design recommendations
Enterprise Health Check report with comprehensive findings
Executive readout with strategic recommendations

✗ Out of Scope

Remediation or implementation work
Post-assessment ongoing support
Custom configuration changes
Infrastructure provisioning or migration

Positioning: This is the Accelerate motion for Splunk Health — it enables enterprise optimization, scalability, and risk mitigation. Not an isolated assessment. A system-level evaluation of performance, risk, and scalability.

What You Get

Enterprise Health Check Report

Comprehensive findings covering enterprise architecture, data growth, indexing strategy, retention, and cross-environment performance.

Systemic Risk Identification

Identified risks, constraints, and performance gaps documented at the system level — not isolated observations.

Scalability Roadmap

Prioritized optimization and scalability roadmap designed for enterprise-scale action and long-term planning.

Cost & Efficiency Analysis

Assessment of cost drivers and efficiency opportunities across the enterprise deployment.

Future-State Design

Structured recommendations for optimization, scalability, and future-state architecture design.

Executive Readout

Strategic recommendations presented in an executive-ready format — aligned to business objectives, not just technical findings.

Deliverables & Commercial

Deliverables

Enterprise Health Check report with comprehensive findings
Identified risks, constraints, and performance gaps
Prioritized optimization and scalability roadmap
Executive readout with strategic recommendations

What Success Looks Like

Clear understanding of enterprise-wide performance and risk
Identified and prioritized scalability and optimization opportunities
Alignment between platform architecture and business objectives
Defined path toward sustainable performance and growth

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Splunk Health Check
Tier	Enterprise — Accelerate Motion
Pricing Model	Fixed Fee (Scoped Outcome)
Term	5 Days
nth → VAR Price	$6,650
VAR → Client Price	$8,312.50
nth degree MSRP	$9,495
VAR Margin Target	~20%

When combined with a mesh™ subscription, organizations benefit from ongoing governance, continuous refinement of data and performance strategies, and sustained execution against strategic optimization initiatives.

← Back to Services Overview Ideal For How It Works What You Get Scope Deliverables Commercial

SRV-CRIBL-BT-FRAC

Cribl Fractional Block Time

Expert Cribl execution against a defined objective — no subscription required.

● TIME-BASED EXECUTION MODEL

Standard Block

20 or 40 hrs

3 Month Delivery Window

Extended Block

60 or 120 hrs

6 Month Delivery Window

Block Time puts expert Cribl execution against a defined objective — with a fixed hour allocation, a clear delivery window, and a consultant assigned to your work.

Ideal For

🎯

Bounded Cribl Projects

Organizations with a specific, scoped Cribl objective that needs focused execution without a long-term commitment.

⚡

Targeted Progress

Teams that need fast, targeted progress on a defined Cribl pipeline, routing, or data reduction objective.

💰

Fixed-Budget Engagements

Leaders who want a fixed-price, scoped block of Cribl expertise without variable billing or open-ended SOWs.

🔍

Capability Evaluation

Buyers evaluating nth degree's Cribl capabilities before committing to a longer-term mesh™ subscription engagement.

How It Works

Define the Objective

Client and VAR align on a specific, bounded Cribl project objective before the engagement begins.

Purchase Hours

A Block Time allocation is agreed and purchased — 20 or 40 hrs (3-month) or 60 or 120 hrs (6-month).

Schedule Sessions

Sessions are pre-scheduled at the start of the delivery window. 48-hour advance notice required to cancel or reschedule.

Execute & Deliver

The assigned Consultant works against the defined objective. Close-out summary delivered at completion.

What You Get

Custom Hour Allocation

A defined block of Cribl Consultant hours — 20, 40, 60, or 120 — matched to your project scope and delivery window.

Assigned Cribl Consultant

A dedicated nth degree Cribl specialist assigned to your project for the full duration of the engagement.

Scheduled Working Sessions

Pre-scheduled sessions in structured increments — typically 2-hour minimum blocks, scheduled in advance.

Technical Execution & Outputs

Hands-on Cribl work across pipelines, routing, data reduction, integrations, and performance tuning.

Session Documentation

Notes, configuration changes, and recommendations captured and delivered after each working session.

Close-Out Summary

End-of-engagement summary of work completed, outcomes achieved, and recommended next steps.

Scope Boundaries

✓ In Scope

Technical execution related to the client's Cribl environment within the defined project objective
Pipeline configuration, data routing, source and destination setup
Data reduction strategies and destination cost optimization
Performance tuning, bottleneck identification, and configuration improvements
Migration support, syslog replacement, or cloud transition work related to the defined objective
Documentation of configurations, architecture, and completed work

✗ Out of Scope

Work outside the defined project objective without a written amendment
Additional hours beyond the purchased Block Time Allocation without a new SOW
Ongoing operations, managed services, or continuous advisory
Modification, installation, or maintenance of non-Cribl products
Weekend or holiday availability
Onsite visits

Deliverables & Commercial

Deliverables

Technical execution outputs aligned to the defined project objective
Configuration updates, pipeline changes, or documentation as applicable to the project scope
Session notes and progress documentation
Close-out summary with outcomes and recommended next steps

Block Time Terms

Sessions must be scheduled in advance — at least 48 hours' notice required to cancel or reschedule
Unused hours expire at the end of the Delivery Window and are non-refundable
Additional hours beyond the purchased allocation require a new SOW or written amendment
Onsite visits and weekend availability are out of scope by default

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Model	Fractional Block Time
Hour Packages	20, 40, 60, or 120 hrs
Delivery Window	3 months (20/40 hr) · 6 months (60/120 hr)
Session Format	2-hour minimum increments
Governance	Not included
nth → VAR Rate	$230 / hr
VAR → Client Rate	$288 / hr
nth degree MSRP	$300 / hr
VAR Margin Target	~20%

Not the right fit?

When continuous execution is needed — mesh™ is the answer.

Block Time is designed for focused, one-time projects. When your client needs ongoing execution, structured governance, and outcome-aligned delivery, mesh™ subscription services are the right model.

Explore mesh™ Subscription Services →

← Back to Services Overview Ideal For How It Works What You Get Scope Deliverables Commercial

SRV-SPLK-BT-FRAC

Splunk Fractional Block Time

Expert Splunk execution against a defined objective — no subscription required.

● TIME-BASED EXECUTION MODEL

Standard Block

20 or 40 hrs

3 Month Delivery Window

Extended Block

60 or 120 hrs

6 Month Delivery Window

Block Time puts expert Splunk execution against a defined objective — with a fixed hour allocation, a clear delivery window, and a consultant assigned to your work.

Ideal For

🎯

Bounded Splunk Projects

Organizations with a specific, scoped Splunk objective that needs focused execution without a long-term commitment.

⚡

Targeted Progress

Teams that need fast, targeted progress on a defined Splunk search optimization, data onboarding, or detection objective.

💰

Fixed-Budget Engagements

Leaders who want a fixed-price, scoped block of Splunk expertise without variable billing or open-ended SOWs.

🔍

Capability Evaluation

Buyers evaluating nth degree's Splunk capabilities before committing to a longer-term mesh™ subscription engagement.

How It Works

Define the Objective

Client and VAR align on a specific, bounded Splunk project objective before the engagement begins.

Purchase Hours

A Block Time allocation is agreed and purchased — 20 or 40 hrs (3-month) or 60 or 120 hrs (6-month).

Schedule Sessions

Sessions are pre-scheduled at the start of the delivery window. 48-hour advance notice required to cancel or reschedule.

Execute & Deliver

The assigned Consultant works against the defined objective. Close-out summary delivered at completion.

What You Get

Custom Hour Allocation

A defined block of Splunk Consultant hours — 20, 40, 60, or 120 — matched to your project scope and delivery window.

Assigned Splunk Consultant

A dedicated nth degree Splunk specialist assigned to your project for the full duration of the engagement.

Scheduled Working Sessions

Pre-scheduled sessions in structured increments — typically 2-hour minimum blocks, scheduled in advance.

Technical Execution & Outputs

Hands-on Splunk work across search optimization, data onboarding, detection development, and index configuration.

Session Documentation

Notes, configuration changes, and recommendations captured and delivered after each working session.

Close-Out Summary

End-of-engagement summary of work completed, outcomes achieved, and recommended next steps.

Scope Boundaries

✓ In Scope

Technical execution related to the client's Splunk environment within the defined project objective
Search and dashboard optimization, data onboarding, pipeline improvements
Detection development, tuning, and Splunk ES configuration
Index configuration, data model review, and retention policy work
Integration support and upgrade planning related to the defined objective
Documentation of configurations, architecture, and completed work

✗ Out of Scope

Work outside the defined project objective without a written amendment
Additional hours beyond the purchased Block Time Allocation without a new SOW
Ongoing operations, managed services, or continuous advisory
Modification, installation, or maintenance of non-Splunk products
Weekend or holiday availability
Onsite visits

Deliverables & Commercial

Deliverables

Technical execution outputs aligned to the defined project objective
Configuration updates, optimizations, or documentation as applicable to the project scope
Session notes and progress documentation
Close-out summary with outcomes and recommended next steps

Block Time Terms

Sessions must be scheduled in advance — at least 48 hours' notice required to cancel or reschedule
Unused hours expire at the end of the Delivery Window and are non-refundable
Additional hours beyond the purchased allocation require a new SOW or written amendment
Onsite visits and weekend availability are out of scope by default

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Model	Fractional Block Time
Hour Packages	20, 40, 60, or 120 hrs
Delivery Window	3 months (20/40 hr) · 6 months (60/120 hr)
Session Format	2-hour minimum increments
Governance	Not included
nth → VAR Rate	$230 / hr
VAR → Client Rate	$288 / hr
nth degree MSRP	$300 / hr
VAR Margin Target	~20%

Not the right fit?

When continuous execution is needed — mesh™ is the answer.

Explore mesh™ Subscription Services →

← Back to Services Overview Challenges Ideal For How It Works What You Get Scope Deliverables & Commercial

MESH-INTRO-xH-3M

mesh™ Introduction

Prove Execution. Establish Momentum. Validate the Model.

● Execution Proof Point — Land Motion

Term

Months

Capacity Range

20–40

Hours / Month

Execution Challenges

Organizations exploring new execution models face early uncertainty:

The Challenge

Traditional consulting models fail to sustain momentum
Outcomes are unclear despite significant spend
Work is reactive, not continuously aligned to outcomes
No structured way to validate a new delivery model

Without a controlled entry point, adoption risk remains high.

What mesh™ Changes

We provide a structured proof point for governed execution:

Capacity-based execution instead of hourly consumption
Ongoing prioritization aligned to business outcomes
Embedded execution with clear ownership and flexible access to capacity
Measurable output within a defined engagement window

Unlike traditional service engagements, mesh™ is not constrained by fixed working sessions — execution can be engaged in flexible increments, from quick alignment discussions to deep working sessions, enabling progress at the pace of business.

Ideal For

🎯

New Clients Evaluating mesh™

Organizations that want to validate the mesh™ execution model before committing to a longer-term subscription.

⚡

Immediate Momentum Needed

Teams frustrated with traditional consulting models that need fast, structured execution against defined outcomes.

💰

Rapid Proof of Value

Leaders who need measurable output within 30–60 days to build internal confidence before expanding scope.

🔍

Controlled Entry Point

Buyers who want a structured, low-risk way to experience the mesh™ model and validate fit before scaling.

How It Works

Define Priorities

Client and VAR align on objectives and build the initial Client Success Plan before the engagement begins.

Assign PSA

A dedicated Principal Solutions Architect is assigned and execution begins against prioritized outcomes.

Execute Continuously

Work is performed continuously in flexible increments — aligned to need, not a fixed session format.

Review & Calibrate

Monthly Reviews track progress. Quarterly Calibrations re-align the CSP to evolving business priorities.

What You Get

Assigned Principal Solutions Architect

A dedicated PSA operates as an embedded execution partner — not a vendor. Aligned to your outcomes, not a statement of work.

Client Success Plan (CSP)

A living document capturing prioritized objectives, active work, and execution outcomes. Updated continuously throughout the engagement.

Flexible Execution Model

Work delivered in sessions or independently. Sessions from 15 minutes to multi-hour — no rigid format, aligned to need.

Monthly Review Meetings

Structured monthly check-ins covering progress toward objectives, completed work, upcoming priorities, and adjustments as needed.

Quarterly Calibrations

Results validated against the CSP every 90 days. Priorities re-aligned to evolving business objectives. Capacity adjusted as needed.

Execution Reporting

Transparent reporting on completed work, work in progress, and outcomes — keeping all stakeholders aligned throughout the engagement.

Scope Boundaries

✓ In Scope

Execution governed by ongoing prioritization aligned to defined outcomes
Work performed in flexible increments aligned to the Client Success Plan
Monthly Review Meeting cadence (×2 over 3-month term)
Quarterly Calibration at Day 60
Transparent execution reporting and recommended next-step roadmap

✗ Out of Scope

Unlimited execution capacity
Fixed project-based deliverables outside the CSP framework
Long-term embedded governance (covered in extended tiers)

Operating Rhythm

Meeting	Cadence	Purpose
Monthly Review Meeting	Monthly (×2)	Progress toward objectives · Completed work · Work in progress · Upcoming priorities · Adjustments as needed
Quarterly Calibration	Once (Day 60)	Validation of results against CSP (prior 90 days) · Alignment of CSP (next 90 days) · Adjustment of priorities · Alignment of capacity to outcomes

Deliverables & Commercial

Deliverables

Completed work aligned to defined outcomes
Transparent execution reporting
Measurable output within first 90 days
Clear roadmap for continued engagement

When to Use

New clients evaluating mesh™
Organizations frustrated with traditional consulting models
Teams needing immediate execution momentum
Situations requiring rapid proof of value

What Success Looks Like

Measurable output within first 30–60 days
Clear alignment between execution and outcomes
Reduced friction in delivery and prioritization
Confidence to scale into longer-term engagement

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Pricing Model	Capacity-Based Subscription
Term	3 Months
Capacity Range	20–40 hrs / month
Governance	Full model included
OKR Alignment	Included
Portal Access	Included
nth → VAR Rate	$250 / hr
VAR → Client Rate	$312.50 / hr
MSRP	$330 / hr
VAR Margin Target	~20%

Ready to scale?

Proven value. Ready to grow.

A successful Introduction engagement is the starting point — not the destination. Clients who validate the mesh™ model here typically progress to Foundational or Strategic tier to sustain and scale their execution momentum.

Explore the full mesh™ Tier Guide →

← Back to Services Overview Challenges Ideal For How It Works What You Get Scope Deliverables & Commercial

MESH-FND-xH-6M

mesh™ Foundational

Establish Execution Stability. Maintain Momentum. Deliver Consistent Outcomes.

● Operational Stability — Govern Motion

Term

6 or 12

Months

Capacity Range

20–40

Hours / Month

Execution Challenges

After initial success, organizations struggle to maintain consistent execution without a structured system to sustain it.

The Challenge

Priorities shift without structured alignment
Execution becomes inconsistent across teams
Progress slows without continuous oversight
Outcomes are difficult to sustain over time

Without structure, early gains erode.

What mesh™ Changes

We provide a structured system for sustained execution:

Capacity-based execution instead of hourly consumption
Ongoing prioritization aligned to business outcomes
Embedded execution with clear ownership and flexible access to capacity
Measurable output aligned to defined objectives

Ideal For

📈

Sustaining Early Momentum

Organizations that have validated mesh™ and are ready to sustain execution momentum beyond the initial engagement.

🔄

Consistent Progress Needed

Teams that need structured prioritization and consistent progress against evolving business objectives.

🏗️

Execution Stability Critical

Environments where losing execution continuity would erode early wins or delay key outcomes.

👁️

Visibility Into Execution

Leaders who need clear, ongoing visibility into what is being worked on and how it aligns to outcomes.

How It Works

Define Priorities

Client and VAR align on objectives and build the initial Client Success Plan before the engagement begins.

Assign PSA

A dedicated Principal Solutions Architect is assigned and execution begins against prioritized outcomes.

Execute Continuously

Work is performed continuously in flexible increments — aligned to need, not a fixed session format.

Review & Calibrate

Monthly Reviews track progress. Quarterly Calibrations re-align the CSP to evolving business priorities.

What You Get

Assigned Principal Solutions Architect

A dedicated PSA operates as an embedded execution partner — not a vendor. Aligned to your outcomes, not a statement of work.

Client Success Plan (CSP)

A living document capturing prioritized objectives, active work, and execution outcomes. Updated continuously throughout the engagement.

Flexible Execution Model

Work delivered in sessions or independently. Sessions from 15 minutes to multi-hour — no rigid format, aligned to need.

Monthly Review Meetings

Structured monthly check-ins covering progress toward objectives, completed work, upcoming priorities, and adjustments as needed.

Quarterly Calibrations

Results validated against the CSP every 90 days. Priorities re-aligned to evolving business objectives. Capacity adjusted as needed.

Execution Reporting

Transparent reporting on completed work, work in progress, and outcomes — keeping all stakeholders aligned throughout the engagement.

Scope Boundaries

✓ In Scope

Execution governed by ongoing prioritization aligned to defined outcomes
Work performed in flexible increments aligned to the Client Success Plan
Monthly Review Meeting cadence (×6 or ×12 over term)
Quarterly Calibrations (×2 or ×4 over term)
Transparent execution reporting and roadmap alignment

✗ Out of Scope

Unlimited execution capacity
Fixed project-based deliverables outside the CSP framework
Long-term embedded governance (covered in extended tiers)

Operating Rhythm

Meeting	Cadence	Purpose
Monthly Review Meeting	Monthly (×6 or ×12)	Progress toward objectives · Completed work · Work in progress · Upcoming priorities · Adjustments as needed
Quarterly Calibration	Every 90 days (×2 or ×4)	Validation of results against CSP (prior 90 days) · Alignment of CSP (next 90 days) · Adjustment of priorities · Alignment of capacity to outcomes

Deliverables & Commercial

Deliverables

Completed work aligned to defined outcomes
Transparent execution reporting
Measurable progress over time
Clear roadmap for continued engagement

When to Use

Organizations requiring sustained execution beyond initial proof point
Teams needing structured prioritization and consistent progress
Environments where execution stability is critical

What Success Looks Like

Consistent execution against defined priorities
Sustained progress over time
Alignment between execution and outcomes
Reduced delivery friction across teams

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Pricing Model	Capacity-Based Subscription
Term	6 or 12 Months
Capacity Range	20–40 hrs / month
Governance	Full model included
OKR Alignment	Included
Portal Access	Included
nth → VAR Rate	$250 / hr
VAR → Client Rate	$312.50 / hr
MSRP	$330 / hr
VAR Margin Target	~20%

Ready to scale?

Stability achieved. Ready to accelerate.

Foundational clients who need deeper execution capacity or multi-workstream coordination should consider upgrading to mesh™ Strategic or mesh™ Enterprise.

Explore the full mesh™ Tier Guide →

← Back to Services Overview Challenges Ideal For How It Works What You Get Scope Deliverables & Commercial

MESH-STR-xH-6M

mesh™ Strategic

Drive Targeted Improvement. Align Execution. Deliver Measurable Gains.

● Outcome Accountability — Govern Motion

Term

6 or 12

Months

Capacity Range

40–80

Hours / Month

Execution Challenges

As organizations scale execution, misalignment and inefficiency emerge across teams and workstreams.

The Challenge

Priorities compete without structured alignment to outcomes
Execution efforts lack coordination across teams
Improvements are inconsistent and difficult to sustain
Outcomes are not clearly tied to execution effort

Without governance, execution becomes fragmented and impact is diluted.

What mesh™ Changes

We provide a structured system for targeted improvement:

Capacity-based execution instead of hourly consumption
Ongoing prioritization aligned to business outcomes
Embedded execution with clear ownership and flexible access to capacity
Measurable output aligned to defined improvement objectives

Ideal For

🎯

Multi-Workstream Execution

Organizations that need structured execution coordination across multiple priority areas simultaneously.

📊

Measurable Improvement Required

Teams where specific, named improvements are required and outcomes must be clearly tied to execution effort.

⚙️

Stronger Alignment Needed

Leaders who need tighter alignment between execution activity and measurable business outcomes across their org.

🚀

Strategic-Level Partnership

Buyers ready to invest in a strategic execution partner — not just consulting hours — driving real improvement.

How It Works

Define Priorities

Client and VAR align on objectives and build the initial Client Success Plan before the engagement begins.

Assign PSA

A dedicated Principal Solutions Architect is assigned and execution begins against prioritized outcomes.

Execute Continuously

Work is performed continuously in flexible increments — aligned to need, not a fixed session format.

Review & Calibrate

Monthly Reviews track progress. Quarterly Calibrations re-align the CSP to evolving business priorities.

What You Get

Assigned Principal Solutions Architect

A dedicated PSA operates as an embedded execution partner — not a vendor. Aligned to your outcomes, not a statement of work.

Client Success Plan (CSP)

A living document capturing prioritized objectives, active work, and execution outcomes. Updated continuously throughout the engagement.

Flexible Execution Model

Work delivered in sessions or independently. Sessions from 15 minutes to multi-hour — no rigid format, aligned to need.

Monthly Review Meetings

Structured monthly check-ins covering progress toward objectives, completed work, upcoming priorities, and adjustments as needed.

Quarterly Calibrations

Results validated against the CSP every 90 days. Priorities re-aligned to evolving business objectives. Capacity adjusted as needed.

Execution Reporting

Transparent reporting on completed work, work in progress, and outcomes — keeping all stakeholders aligned throughout the engagement.

Scope Boundaries

✓ In Scope

Execution governed by ongoing prioritization across multiple defined workstreams
Work performed in sessions or independently per the agreed execution model
Multi-objective Client Success Plan development, maintenance, and review
Monthly Review Meetings (×6 or ×12) and Quarterly Calibrations (×2 or ×4)

✗ Out of Scope

Unlimited execution capacity — mesh™ delivers fixed monthly capacity per the purchased tier
Fixed project-based deliverables outside the Client Success Plan framework
Work outside agreed priority areas without a CSP update

Operating Rhythm

Meeting	Cadence	Purpose
Monthly Review Meeting	Monthly (×6 or ×12)	Cross-workstream progress review · Completed work · Upcoming priorities · Adjustments as needed
Quarterly Calibration	Every 90 days (×2 or ×4)	Results validation across all objectives · CSP re-alignment · Capacity adjustment for next period

Deliverables & Commercial

Deliverables

Completed work aligned to defined improvement objectives
Transparent execution reporting
Measurable gains across targeted areas
Clear roadmap for continued optimization

When to Use

Organizations targeting specific areas for improvement
Teams needing stronger alignment between execution and outcomes
Environments where measurable gains are required

What Success Looks Like

Measurable improvement across defined priority areas
Clear linkage between execution and outcomes
Increased efficiency and alignment across teams
Sustained progress through structured governance

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Pricing Model	Capacity-Based Subscription
Term	6 or 12 Months
Capacity Range	40–80 hrs / month
Governance	Full model included
OKR Alignment	Included
Portal Access	Included
nth → VAR Rate	$240 / hr
VAR → Client Rate	$300 / hr
MSRP	$312.50 / hr
VAR Margin Target	~20%

Ready to scale?

Improvement achieved. Ready for enterprise scale.

Strategic clients operating across multiple business units or requiring executive-level execution governance should consider mesh™ Enterprise for sustained, enterprise-scale delivery.

Explore the full mesh™ Tier Guide →

← Back to Services Overview Challenges Ideal For How It Works What You Get Scope Deliverables & Commercial

MESH-ENT-xH-12M

mesh™ Enterprise

Scale Execution. Optimize Performance. Deliver Enterprise Outcomes.

● Embedded Leadership — Accelerate Motion

Term

12 / 24 / 36

Months

Capacity Range

80–120

Hours / Month

Execution Challenges

At enterprise scale, execution complexity increases significantly — coordination across business units, leadership alignment, and sustained performance all become harder to maintain.

The Challenge

Multiple priorities compete across business units
Execution lacks alignment at the leadership level
Optimization efforts are inconsistent across environments
Outcomes are difficult to measure across large-scale initiatives

Without structured governance and execution alignment, enterprise performance suffers.

What mesh™ Changes

We provide a structured system for enterprise optimization:

Capacity-based execution instead of hourly consumption
Ongoing prioritization aligned to business outcomes
Embedded execution with clear ownership and flexible access to capacity
Measurable output aligned to enterprise objectives

Ideal For

🏢

Enterprise Coordination

Large-scale environments requiring structured execution coordination across multiple business units and workstreams.

📈

Performance at Scale

Organizations optimizing performance across multiple teams, environments, or platforms simultaneously.

👔

Executive Alignment

Teams that need executive-level alignment woven into the execution model — not just consultant-level delivery.

🔭

12-Month Transformation

Leaders committed to sustained, governed execution over a full year with measurable performance outcomes at scale.

How It Works

Define Priorities

Client and VAR align on objectives and build the initial Client Success Plan before the engagement begins.

Assign PSA

A dedicated Principal Solutions Architect is assigned and execution begins against prioritized outcomes.

Execute Continuously

Work is performed continuously in flexible increments — aligned to need, not a fixed session format.

Review & Calibrate

Monthly Reviews track progress. Quarterly Calibrations re-align the CSP to evolving business priorities.

What You Get

Assigned Principal Solutions Architect

A dedicated PSA operates as an embedded execution partner — not a vendor. Aligned to your outcomes, not a statement of work.

Client Success Plan (CSP)

A living document capturing prioritized objectives, active work, and execution outcomes. Updated continuously throughout the engagement.

Flexible Execution Model

Work delivered in sessions or independently. Sessions from 15 minutes to multi-hour — no rigid format, aligned to need.

Monthly Review Meetings

Structured monthly check-ins covering progress toward objectives, completed work, upcoming priorities, and adjustments as needed.

Quarterly Calibrations

Results validated against the CSP every 90 days. Priorities re-aligned to evolving business objectives. Capacity adjusted as needed.

Execution Reporting

Transparent reporting on completed work, work in progress, and outcomes — keeping all stakeholders aligned throughout the engagement.

Scope Boundaries

✓ In Scope

Execution governed by ongoing prioritization across multiple business units or workstreams
Work performed in sessions or independently per the agreed enterprise execution model
Multi-track Client Success Plan with BU-level objectives and key results
Monthly Review Meetings (×12) and Quarterly Calibrations (×4)
Embedded execution with executive-level alignment

✗ Out of Scope

Unlimited execution capacity — mesh™ delivers fixed monthly capacity per the purchased tier
Fixed project-based deliverables outside the Client Success Plan framework
Work outside agreed priority areas without a CSP update

Operating Rhythm

Meeting	Cadence	Purpose
Monthly Review Meeting	Monthly (×12)	Enterprise-level progress review · Cross-BU execution status · Upcoming priorities · Adjustments as needed
Quarterly Calibration	Quarterly (×4)	Enterprise results validation · Cross-BU re-prioritization · CSP realignment · Capacity adjustment

Deliverables & Commercial

Deliverables

Completed work aligned to enterprise objectives across all in-scope business units
Transparent execution reporting with enterprise-level and BU-level visibility
Measurable performance improvements at scale across all active tracks
Strategic roadmap for continued optimization and sustained enterprise execution

When to Use

Enterprise environments requiring large-scale coordination
Organizations optimizing across multiple business units
Teams needing executive-level alignment and execution

What Success Looks Like

Enterprise-wide alignment between execution and outcomes
Measurable performance improvements at scale
Increased efficiency across teams and environments
Sustained execution through structured governance

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Pricing Model	Capacity-Based Subscription
Term	12, 24, or 36 Months
Capacity Range	80–120 hrs / month
Governance	Full model included
OKR Alignment	Included
Portal Access	Included
nth → VAR Rate	$230 / hr
VAR → Client Rate	$287.50 / hr
MSRP	$300 / hr
VAR Margin Target	~20%

Ready to scale?

The highest tier of mesh™ execution.

mesh™ Enterprise is designed for organizations ready to commit to sustained, governed execution at scale. Engagements are built for multi-year renewal as outcomes compound over time.

Explore the full mesh™ Tier Guide →

← Back to Services Overview Objectives Scope Ideal For What You Get Operating Rhythm Commercial

SRV-CRIBL-RES-SPRINT

Cribl Resident Services — Sprint

Focused Cribl expertise. Structured working sessions. Fast, targeted progress.

● Targeted Advisory — Embedded Advisory

Hours Included

RSC Execution Hours

Service Period

90 Days

~30 day sprint target

Overview & Objectives

This engagement delivers a focused Cribl Resident Services sprint to provide structured technical execution and enablement against defined priorities.

Engagement Objectives

Accelerate progress on defined Cribl priorities
Provide hands-on technical execution and guidance
Improve performance, configuration quality, and operational efficiency
Enable the client team through direct working sessions

Service Structure

Resident Services are delivered by an assigned Cribl Resident Services Consultant (RSC) through scheduled working sessions. Work may also be performed independently when appropriate access is provided.

Sessions scheduled in advance at the start of the Service Period
48-hour notice required to cancel or reschedule sessions
Unused hours expire at end of Service Period — non-refundable
Remote delivery; onsite visits out of scope by default

Scope of Services

✓ In Scope — Supported Activities

Documenting system architecture and configurations
Analyzing and optimizing system performance and bottlenecks
Evaluating and recommending hardware adjustments for efficiency and optimization
Reviewing and planning software upgrades and rollback strategies
Streamlining and optimizing data pipelines and configurations
Implementing data reduction strategies for destination efficiency
Developing custom reporting and dashboards for data analysis
Developing and implementing data lake storage solutions and replay strategies

✗ Out of Scope

Modification, installation, or maintenance of customer hardware or network equipment
Modification, installation, or maintenance of non-platform products or services
Weekend or holiday availability
Onsite visits
Any services or activities not expressly included in the applicable scope

Ideal For

Organizations with a specific, near-term Cribl challenge that needs focused execution now — not a 6-month engagement.

Teams that need fast, targeted progress on a defined priority within a concentrated timeframe.

Leaders who need a focused Cribl resource applied to one high-priority area with a fixed, predictable cost.

Buyers who want expert execution now with a clear, scoped outcome.

What You Get

24 Hours of RSC Execution

24 hours of dedicated Cribl Resident Services Consultant time applied against your defined sprint priority.

90-Day Service Period

Sprint delivery is typically expected to conclude within 30 days based on scheduling cadence and defined priority.

Scheduled Working Sessions

Pre-scheduled sessions established at the start of the sprint. 2-hour minimum increments. 48-hour cancellation notice required.

Technical Execution & Guidance

Hands-on Cribl work and direct technical guidance delivered against the sprint objective.

Operating Rhythm

Meeting	Cadence	Purpose
Kickoff Session	Once (sprint start)	Define sprint objective, confirm scope, establish working cadence and session schedule
Working Sessions	Per agreed schedule	Hands-on technical execution against the defined sprint priority
Close-Out Review	Once (sprint end)	Review completed work, document outcomes, confirm next steps

Monthly cadence: Sprint delivery is typically expected to conclude within 30 days based on scheduling cadence and focus area. Sessions are delivered in 2-hour increments.

Deliverables & Commercial

Deliverables

Resident Services execution outputs aligned to defined priorities
Recommendations, configuration updates, or optimization outputs as applicable
Session-based progress against agreed technical objectives

What Success Looks Like

The defined sprint objective is addressed with measurable, documented outcomes
All 24 hours are scheduled and utilized within the sprint window
Clear documentation of work completed and recommended next steps

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Embedded Advisory — Resident Services
Tier	Sprint
Hours Included	24 RSC hours
Service Period	90 Days (Sprint)
Session Format	2-hour minimum increments
Governance	None (session-based delivery)
nth → VAR Price	$5,520
VAR → Client Price	$6,900
nth degree MSRP	$8,000
VAR Margin Target	~20%

Pricing is per engagement (fixed package), not per hour. nth → VAR Price represents wholesale price to VAR. VAR → Client Price represents suggested resale targeting ~20% margin.

Need continuous execution instead?

When outcome alignment matters — mesh™ is the answer.

Resident Services deliver structured advisory time. When clients need continuous, outcome-aligned execution governed by a Client Success Plan, mesh™ subscription services are the right model.

Explore mesh™ Subscription Services →

← Back to Services Overview Objectives Scope Ideal For What You Get Operating Rhythm Commercial

SRV-CRIBL-RES-FOUNDATION

Cribl Resident Services — Foundation

Structured Cribl expertise. Consistent working rhythm. Steady progress.

● Core Advisory — Embedded Advisory

Hours Included

RSC Execution Hours

Service Period

6 Months

180-day service period

Overview & Objectives

This engagement delivers Cribl Resident Services in a Foundation model to provide structured technical execution and enablement over a 6-month service period.

Engagement Objectives

Maintain steady progress on defined Cribl priorities
Provide hands-on technical execution and guidance
Improve system performance, efficiency, and configuration quality
Enable the client team through ongoing working sessions

Service Structure

Sessions scheduled in advance at the start of the Service Period
48-hour notice required to cancel or reschedule sessions
Unused hours expire at end of Service Period — non-refundable
Remote delivery; onsite visits out of scope by default

Scope of Services

✓ In Scope — Supported Activities

Documenting system architecture and configurations
Analyzing and optimizing system performance and bottlenecks
Evaluating and recommending hardware adjustments for efficiency and optimization
Reviewing and planning software upgrades and rollback strategies
Streamlining and optimizing data pipelines and configurations
Implementing data reduction strategies for destination efficiency
Developing custom reporting and dashboards for data analysis
Developing and implementing data lake storage solutions and replay strategies

✗ Out of Scope

Modification, installation, or maintenance of customer hardware or network equipment
Modification, installation, or maintenance of non-platform products or services
Weekend or holiday availability
Onsite visits
Any services or activities not expressly included in the applicable scope

Ideal For

Organizations that need reliable, recurring Cribl expertise without the overhead of a full-time resource.

Teams that benefit from a consistent, low-volume RSC cadence applied to ongoing Cribl priorities.

Leaders who want structured, accountable execution at a foundation level of investment.

Buyers seeking a predictable foundation of Cribl expertise over a 6-month period.

What You Get

48 Hours of RSC Execution

48 hours of dedicated Cribl Resident Services Consultant time distributed over the 6-month service period.

180-Day Service Period

Six months to utilize the full hour allocation with a consistent working rhythm.

Scheduled Working Sessions

Pre-scheduled sessions established at engagement start. ~4 sessions per month at 2-hour increments.

Technical Execution & Enablement

Hands-on Cribl work and knowledge transfer delivered in a consistent cadence throughout the service period.

Operating Rhythm

Meeting	Cadence	Purpose
Kickoff Session	Once (engagement start)	Define priorities, establish session cadence, confirm access and participation requirements
Working Sessions	~2 sessions per month	Hands-on technical execution against defined Cribl priorities

Monthly cadence: Approximately 8 hours per month — typically ~4 two-hour working sessions per month delivered consistently throughout the 6-month service period.

Deliverables & Commercial

Deliverables

Resident Services execution outputs aligned to defined priorities
Recommendations, configuration updates, or optimization outputs as applicable
Session-based progress against agreed technical objectives

What Success Looks Like

Defined Cribl priorities receive consistent, structured attention throughout the service period
Steady technical progress documented across sessions
All 48 hours scheduled and utilized within the 6-month window

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Embedded Advisory — Resident Services
Tier	Foundation
Hours Included	48 RSC hours
Service Period	6 Months (180 Days)
Session Format	2-hour minimum increments
Governance	None (session-based delivery)
nth → VAR Price	$10,800
VAR → Client Price	$13,500
nth degree MSRP	$15,000
VAR Margin Target	~20%

Pricing is per engagement (fixed package), not per hour. nth → VAR Price represents wholesale price to VAR. VAR → Client Price represents suggested resale targeting ~20% margin.

Need continuous execution instead?

When outcome alignment matters — mesh™ is the answer.

Resident Services deliver structured advisory time. When clients need continuous, outcome-aligned execution governed by a Client Success Plan, mesh™ subscription services are the right model.

Explore mesh™ Subscription Services →

← Back to Services Overview Objectives Scope Ideal For What You Get Operating Rhythm Commercial

SRV-CRIBL-RES-ADVANCED

Cribl Resident Services — Advanced

More capacity. Same discipline. Faster progress on Cribl priorities.

● Expanded Advisory — Embedded Advisory

Hours Included

RSC Execution Hours

Service Period

6 Months

180-day service period

Overview & Objectives

This engagement delivers Cribl Resident Services in an Advanced model to provide structured technical execution and enablement over a 6-month service period.

Engagement Objectives

Accelerate progress on defined Cribl priorities
Provide hands-on technical execution and guidance
Improve system performance, efficiency, and configuration quality
Enable the client team through ongoing working sessions

Service Structure

Sessions scheduled in advance at the start of the Service Period
48-hour notice required to cancel or reschedule sessions
Unused hours expire at end of Service Period — non-refundable
Remote delivery; onsite visits out of scope by default

Scope of Services

✓ In Scope — Supported Activities

Documenting system architecture and configurations
Analyzing and optimizing system performance and bottlenecks
Evaluating and recommending hardware adjustments for efficiency and optimization
Reviewing and planning software upgrades and rollback strategies
Streamlining and optimizing data pipelines and configurations
Implementing data reduction strategies for destination efficiency
Developing custom reporting and dashboards for data analysis
Developing and implementing data lake storage solutions and replay strategies

✗ Out of Scope

Modification, installation, or maintenance of customer hardware or network equipment
Modification, installation, or maintenance of non-platform products or services
Weekend or holiday availability
Onsite visits
Any services or activities not expressly included in the applicable scope

Ideal For

Organizations with active Cribl environments and a meaningful backlog of technical work requiring consistent, higher-frequency execution.

Teams that need more than Foundation-level capacity — with multiple concurrent priorities and faster desired progress.

Leaders who want consistent, high-frequency RSC engagement without the cost of full-time staffing.

Buyers who need faster Cribl progress over 6 months and can commit to a regular, structured session cadence.

What You Get

96 Hours of RSC Execution

96 hours of dedicated Cribl Resident Services Consultant time — double the Foundation tier — over the 6-month service period.

180-Day Service Period

Six months to utilize the full hour allocation with a higher-frequency working rhythm.

Scheduled Working Sessions

Pre-scheduled sessions at ~8 per month. 2-hour minimum increments. 48-hour cancellation notice required.

Technical Execution & Enablement

Higher-frequency hands-on Cribl work enabling parallel progress across multiple defined priorities.

Mid-Period Check

Progress review at approximately 90 days to re-prioritize remaining hours and identify any blockers.

Operating Rhythm

Meeting	Cadence	Purpose
Kickoff Session	Once (engagement start)	Define priorities, establish session cadence, confirm access and participation requirements
Working Sessions	~4 sessions per month	Hands-on technical execution against defined Cribl priorities
Mid-Period Check	~90 days in	Review progress, re-prioritize remaining hours, identify blockers

Monthly cadence: Approximately 16 hours per month — typically ~8 two-hour working sessions per month, enabling higher-frequency engagement and parallel progress across multiple priorities.

Deliverables & Commercial

Deliverables

Resident Services execution outputs aligned to defined priorities
Recommendations, configuration updates, or optimization outputs as applicable
Session-based progress against agreed technical objectives

What Success Looks Like

Multiple Cribl priorities receive consistent, structured attention throughout the period
Higher-frequency engagement drives faster technical progress
All 96 hours scheduled and utilized within the 6-month window

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Embedded Advisory — Resident Services
Tier	Advanced
Hours Included	96 RSC hours
Service Period	6 Months (180 Days)
Session Format	2-hour minimum increments
Governance	None (session-based delivery)
nth → VAR Price	$21,120
VAR → Client Price	$26,400
nth degree MSRP	$30,000
VAR Margin Target	~20%

Pricing is per engagement (fixed package), not per hour. nth → VAR Price represents wholesale price to VAR. VAR → Client Price represents suggested resale targeting ~20% margin.

Need continuous execution instead?

When outcome alignment matters — mesh™ is the answer.

Resident Services deliver structured advisory time. When clients need continuous, outcome-aligned execution governed by a Client Success Plan, mesh™ subscription services are the right model.

Explore mesh™ Subscription Services →

← Back to Services Overview Objectives Scope Ideal For What You Get Operating Rhythm Commercial

SRV-CRIBL-RES-ENTERPRISE

Cribl Resident Services — Enterprise

Highest capacity. Same discipline. Sustained Cribl execution at scale.

● Sustained Advisory — Embedded Advisory

Hours Included

240

RSC Execution Hours

Service Period

6 Months

180-day service period

Overview & Objectives

This engagement delivers Cribl Resident Services in an Enterprise model to provide structured technical execution and enablement over a 6-month service period.

Engagement Objectives

Sustain progress on complex Cribl priorities
Provide hands-on technical execution and guidance
Improve system performance, efficiency, and configuration quality
Enable the client team through ongoing working sessions

Service Structure

Sessions scheduled in advance at the start of the Service Period
48-hour notice required to cancel or reschedule sessions
Unused hours expire at end of Service Period — non-refundable
Remote delivery; onsite visits out of scope by default

Scope of Services

✓ In Scope — Supported Activities

Documenting system architecture and configurations
Analyzing and optimizing system performance and bottlenecks
Evaluating and recommending hardware adjustments for efficiency and optimization
Reviewing and planning software upgrades and rollback strategies
Streamlining and optimizing data pipelines and configurations
Implementing data reduction strategies for destination efficiency
Developing custom reporting and dashboards for data analysis
Developing and implementing data lake storage solutions and replay strategies

✗ Out of Scope

Modification, installation, or maintenance of customer hardware or network equipment
Modification, installation, or maintenance of non-platform products or services
Weekend or holiday availability
Onsite visits
Any services or activities not expressly included in the applicable scope

Ideal For

Enterprise organizations running complex, large-scale Cribl environments requiring sustained, high-frequency technical execution.

Teams with broad, ongoing Cribl work across multiple concurrent workstreams requiring the highest available RSC capacity.

Leaders who need a structured, accountable execution partner at enterprise scale without the overhead of full-time staffing.

Buyers committing to a 6-month engagement and needing the highest available RSC cadence.

What You Get

240 Hours of RSC Execution

240 hours of dedicated Cribl Resident Services Consultant time — the highest available tier — over the 6-month service period.

180-Day Service Period

Six months at the highest available RSC cadence for sustained, enterprise-scale execution.

Scheduled Working Sessions

High-frequency pre-scheduled sessions throughout the service period. 2-hour minimum increments.

Enterprise-Depth Execution

Sustained, high-frequency hands-on Cribl work enabling parallel progress across complex, multi-workstream environments.

Mid-Period Check

Progress review at approximately 90 days to re-prioritize remaining hours and confirm priorities.

Operating Rhythm

Meeting	Cadence	Purpose
Kickoff Session	Once (engagement start)	Define priorities, establish session cadence, confirm access and participation requirements
Working Sessions	High-frequency per agreed schedule	Sustained hands-on technical execution across all in-scope Cribl priorities
Mid-Period Check	~90 days in	Review progress, re-prioritize remaining hours, identify blockers

Monthly cadence: Approximately 40 hours per month — the highest available RSC cadence — enabling sustained, high-frequency execution across complex and parallel Cribl workstreams.

Deliverables & Commercial

Deliverables

Resident Services execution outputs aligned to defined priorities
Recommendations, configuration updates, or optimization outputs as applicable
Session-based progress against agreed technical objectives

What Success Looks Like

Complex Cribl priorities receive sustained, high-frequency attention throughout the period
Enterprise-scale technical progress documented across all active workstreams
All 240 hours scheduled and utilized within the 6-month window

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Embedded Advisory — Resident Services
Tier	Enterprise
Hours Included	240 RSC hours
Service Period	6 Months (180 Days)
Session Format	2-hour minimum increments
Governance	None (session-based delivery)
nth → VAR Price	$50,400
VAR → Client Price	$63,000
nth degree MSRP	$75,000
VAR Margin Target	~20%

Pricing is per engagement (fixed package), not per hour. nth → VAR Price represents wholesale price to VAR. VAR → Client Price represents suggested resale targeting ~20% margin.

Need continuous execution instead?

When outcome alignment matters — mesh™ is the answer.

Resident Services deliver structured advisory time. When clients need continuous, outcome-aligned execution governed by a Client Success Plan, mesh™ subscription services are the right model.

Explore mesh™ Subscription Services →

← Back to Services Overview Objectives Scope Ideal For What You Get Operating Rhythm Commercial

SRV-SPLK-RES-SPRINT

Splunk Resident Services — Sprint

Focused Splunk expertise. Structured working sessions. Fast, targeted progress.

● Targeted Advisory — Embedded Advisory

Hours Included

RSC Execution Hours

Service Period

90 Days

~30 day sprint target

Overview & Objectives

This engagement delivers a focused Splunk Resident Services sprint to provide structured technical execution and enablement against a specific, high-priority Splunk objective.

Engagement Objectives

Accelerate progress on a defined, high-priority Splunk objective
Provide hands-on technical execution and guidance within a concentrated timeframe
Improve search performance, data quality, configuration accuracy, or operational efficiency
Enable the client team through focused, structured working sessions

Service Structure

Resident Services are delivered by an assigned Splunk Resident Services Consultant (RSC) through scheduled working sessions. Work may also be performed independently when appropriate access is provided.

Sessions scheduled in advance at the start of the Service Period
48-hour notice required to cancel or reschedule sessions
Unused hours expire at end of Service Period — non-refundable
Remote delivery; onsite visits out of scope by default

Scope of Services

✓ In Scope — Supported Activities

Optimizing searches, dashboards, and reports for performance and accuracy
Troubleshooting performance issues across search heads, indexers, and forwarders
Reviewing and improving data onboarding, parsing, and field normalization
Implementing data retention policies and cost optimization strategies
Supporting upgrade planning, execution readiness, and post-upgrade validation
Developing or tuning detections, correlation searches, and alerts
Improving alerting strategies and reducing noise and false positives
Supporting Splunk Enterprise Security (ES) administration and use case development
Reviewing and improving index configurations, data models, and acceleration
Supporting integration with external systems, APIs, and data sources

✗ Out of Scope

Modification, installation, or maintenance of customer hardware or network equipment
Modification, installation, or maintenance of non-platform products or services
Weekend or holiday availability
Onsite visits
Any services or activities not expressly included in the applicable scope

Ideal For

Organizations with a specific, near-term Splunk challenge that needs focused execution now — not a 6-month engagement.

Teams that need fast, targeted progress on a defined Splunk priority within a concentrated timeframe.

Leaders who need a focused Splunk resource applied to one high-priority area with a fixed, predictable cost.

Buyers who want expert execution now with a clear, scoped outcome and a fixed engagement.

What You Get

24 Hours of RSC Execution

24 hours of dedicated Splunk Resident Services Consultant time applied against your defined sprint priority.

90-Day Service Period

Sprint delivery is typically expected to conclude within 30 days based on scheduling cadence and defined priority.

Scheduled Working Sessions

Pre-scheduled sessions established at the start of the sprint. 2-hour minimum increments. 48-hour cancellation notice required.

Technical Execution & Guidance

Hands-on Splunk work and direct technical guidance delivered against the defined sprint objective.

Operating Rhythm

Meeting	Cadence	Purpose
Kickoff Session	Once (sprint start)	Define sprint objective, confirm scope, establish working cadence and session schedule
Working Sessions	Per agreed schedule	Hands-on technical execution against the defined Splunk sprint priority
Close-Out Review	Once (sprint end)	Review completed work, document outcomes, confirm next steps

Monthly cadence: Sprint delivery is typically expected to conclude within 30 days based on scheduling cadence and defined priority. Sessions are delivered in 2-hour increments.

Deliverables & Commercial

Deliverables

Resident Services execution outputs aligned to defined priorities
Recommendations, configuration updates, or optimization outputs as applicable
Session-based progress against agreed technical objectives

What Success Looks Like

The defined sprint objective is addressed with measurable, documented outcomes
All 24 hours are scheduled and utilized within the sprint window
Clear documentation of work completed and recommended next steps

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Embedded Advisory — Resident Services
Tier	Sprint
Hours Included	24 RSC hours
Service Period	90 Days (Sprint)
Session Format	2-hour minimum increments
Governance	None (session-based delivery)
nth → VAR Price	$5,520
VAR → Client Price	$6,900
nth degree MSRP	$8,000
VAR Margin Target	~20%

Pricing is per engagement (fixed package), not per hour. nth → VAR Price represents wholesale price to VAR. VAR → Client Price represents suggested resale targeting ~20% margin.

Need continuous execution instead?

When outcome alignment matters — mesh™ is the answer.

Resident Services deliver structured advisory time. When clients need continuous, outcome-aligned execution governed by a Client Success Plan, mesh™ subscription services are the right model.

Explore mesh™ Subscription Services →

← Back to Services Overview Objectives Scope Ideal For What You Get Operating Rhythm Commercial

SRV-SPLK-RES-FOUNDATION

Splunk Resident Services — Foundation

Structured Splunk expertise. Consistent working rhythm. Steady progress.

● Core Advisory — Embedded Advisory

Hours Included

RSC Execution Hours

Service Period

6 Months

180-day service period

Overview & Objectives

This engagement delivers Splunk Resident Services in a Foundation model to provide structured technical execution and enablement over a 6-month service period.

Engagement Objectives

Maintain steady progress on defined Splunk priorities over the service period
Provide hands-on technical execution and guidance in a consistent working rhythm
Improve platform effectiveness, data quality, and operational efficiency over time
Enable the client team through ongoing structured working sessions

Service Structure

Sessions scheduled in advance at the start of the Service Period
48-hour notice required to cancel or reschedule sessions
Unused hours expire at end of Service Period — non-refundable
Remote delivery; onsite visits out of scope by default

Scope of Services

✓ In Scope — Supported Activities

Optimizing searches, dashboards, and reports for performance and accuracy
Troubleshooting performance issues across search heads, indexers, and forwarders
Reviewing and improving data onboarding, parsing, and field normalization
Implementing data retention policies and cost optimization strategies
Supporting upgrade planning, execution readiness, and post-upgrade validation
Developing or tuning detections, correlation searches, and alerts
Improving alerting strategies and reducing noise and false positives
Supporting Splunk Enterprise Security (ES) administration and use case development
Reviewing and improving index configurations, data models, and acceleration
Supporting integration with external systems, APIs, and data sources

✗ Out of Scope

Modification, installation, or maintenance of customer hardware or network equipment
Modification, installation, or maintenance of non-platform products or services
Weekend or holiday availability
Onsite visits
Any services or activities not expressly included in the applicable scope

Ideal For

Organizations with deployed Splunk environments that need recurring, structured expertise without the overhead of a full-time resource.

Teams that benefit from a consistent, low-volume RSC cadence applied to ongoing Splunk priorities.

Leaders who want structured, accountable execution without the cost of higher-tier engagement.

Buyers seeking a predictable foundation of Splunk expertise over a 6-month period.

What You Get

48 Hours of RSC Execution

48 hours of dedicated Splunk Resident Services Consultant time distributed over the 6-month service period.

180-Day Service Period

Six months to utilize the full hour allocation with a consistent, structured working rhythm.

Scheduled Working Sessions

Pre-scheduled sessions established at engagement start. ~2 sessions per month at 2-hour increments.

Technical Execution & Enablement

Hands-on Splunk work and knowledge transfer delivered in a consistent cadence throughout the service period.

Operating Rhythm

Meeting	Cadence	Purpose
Kickoff Session	Once (engagement start)	Define priorities, establish session cadence, confirm access and participation requirements
Working Sessions	~2 sessions per month	Hands-on technical execution against defined Splunk priorities

Monthly cadence: Approximately 8 hours per month — typically ~4 two-hour working sessions per month. A consistent, low-volume cadence applied to ongoing Splunk priorities throughout the 6-month period.

Deliverables & Commercial

Deliverables

Resident Services execution outputs aligned to defined priorities
Recommendations, configuration updates, or optimization outputs as applicable
Session-based progress against agreed technical objectives

What Success Looks Like

Defined Splunk priorities receive consistent, structured attention throughout the service period
Steady technical progress documented across sessions
All 48 hours scheduled and utilized within the 6-month window

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Embedded Advisory — Resident Services
Tier	Foundation
Hours Included	48 RSC hours
Service Period	6 Months (180 Days)
Session Format	2-hour minimum increments
Governance	None (session-based delivery)
nth → VAR Price	$10,800
VAR → Client Price	$13,500
nth degree MSRP	$15,000
VAR Margin Target	~20%

Pricing is per engagement (fixed package), not per hour. nth → VAR Price represents wholesale price to VAR. VAR → Client Price represents suggested resale targeting ~20% margin.

Need continuous execution instead?

When outcome alignment matters — mesh™ is the answer.

Resident Services deliver structured advisory time. When clients need continuous, outcome-aligned execution governed by a Client Success Plan, mesh™ subscription services are the right model.

Explore mesh™ Subscription Services →

← Back to Services Overview Objectives Scope Ideal For What You Get Operating Rhythm Commercial

SRV-SPLK-RES-ADVANCED

Splunk Resident Services — Advanced

More capacity. Same discipline. Faster progress on Splunk priorities.

● Expanded Advisory — Embedded Advisory

Hours Included

RSC Execution Hours

Service Period

6 Months

180-day service period

Overview & Objectives

This engagement delivers Splunk Resident Services in an Advanced model to provide structured technical execution and enablement with a higher execution cadence over a 6-month service period.

Engagement Objectives

Accelerate progress on defined Splunk priorities with a higher execution cadence
Provide hands-on technical execution and guidance across multiple concurrent priorities
Improve platform performance, data quality, and operational efficiency at a faster pace
Enable the client team through more frequent structured working sessions

Service Structure

Sessions scheduled in advance at the start of the Service Period
48-hour notice required to cancel or reschedule sessions
Unused hours expire at end of Service Period — non-refundable
Remote delivery; onsite visits out of scope by default

Scope of Services

✓ In Scope — Supported Activities

Optimizing searches, dashboards, and reports for performance and accuracy
Troubleshooting performance issues across search heads, indexers, and forwarders
Reviewing and improving data onboarding, parsing, and field normalization
Implementing data retention policies and cost optimization strategies
Supporting upgrade planning, execution readiness, and post-upgrade validation
Developing or tuning detections, correlation searches, and alerts
Improving alerting strategies and reducing noise and false positives
Supporting Splunk Enterprise Security (ES) administration and use case development
Reviewing and improving index configurations, data models, and acceleration
Supporting integration with external systems, APIs, and data sources

✗ Out of Scope

Modification, installation, or maintenance of customer hardware or network equipment
Modification, installation, or maintenance of non-platform products or services
Weekend or holiday availability
Onsite visits
Any services or activities not expressly included in the applicable scope

Ideal For

Organizations with active Splunk environments and a meaningful backlog of technical work requiring consistent, higher-frequency execution.

Teams that need more than Foundation-level capacity — with multiple concurrent priorities and faster desired progress.

Leaders who want consistent, high-frequency RSC engagement driving measurable Splunk improvement over 6 months.

Buyers who need faster Splunk progress and can commit to a regular, structured session cadence.

What You Get

96 Hours of RSC Execution

96 hours of dedicated Splunk RSC time — double the Foundation tier — over the 6-month service period.

180-Day Service Period

Six months to utilize the full hour allocation with a higher-frequency working rhythm.

Scheduled Working Sessions

Pre-scheduled sessions at ~4 per month. 2-hour minimum increments. 48-hour cancellation notice required.

Technical Execution & Enablement

Deeper, higher-frequency hands-on Splunk work enabling parallel progress across multiple defined priorities.

Mid-Period Check

Progress review at approximately 90 days to re-prioritize remaining hours and identify any blockers.

Operating Rhythm

Meeting	Cadence	Purpose
Kickoff Session	Once (engagement start)	Define priorities, establish session cadence, confirm access and participation requirements
Working Sessions	~4 sessions per month	Hands-on technical execution against defined Splunk priorities
Mid-Period Check	~90 days in	Review progress, re-prioritize remaining hours, identify blockers

Monthly cadence: Approximately 16 hours per month — typically ~8 two-hour working sessions per month. Higher-frequency engagement enabling parallel progress across multiple concurrent Splunk priorities.

Deliverables & Commercial

Deliverables

Resident Services execution outputs aligned to defined priorities
Recommendations, configuration updates, or optimization outputs as applicable
Session-based progress against agreed technical objectives

What Success Looks Like

Multiple Splunk priorities receive consistent, structured attention throughout the period
Higher-frequency engagement drives faster technical progress
All 96 hours scheduled and utilized within the 6-month window

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Embedded Advisory — Resident Services
Tier	Advanced
Hours Included	96 RSC hours
Service Period	6 Months (180 Days)
Session Format	2-hour minimum increments
Governance	None (session-based delivery)
nth → VAR Price	$21,120
VAR → Client Price	$26,400
nth degree MSRP	$30,000
VAR Margin Target	~20%

Pricing is per engagement (fixed package), not per hour. nth → VAR Price represents wholesale price to VAR. VAR → Client Price represents suggested resale targeting ~20% margin.

Need continuous execution instead?

When outcome alignment matters — mesh™ is the answer.

Resident Services deliver structured advisory time. When clients need continuous, outcome-aligned execution governed by a Client Success Plan, mesh™ subscription services are the right model.

Explore mesh™ Subscription Services →

← Back to Services Overview Objectives Scope Ideal For What You Get Operating Rhythm Commercial

SRV-SPLK-RES-ENTERPRISE

Splunk Resident Services — Enterprise

Highest capacity. Same discipline. Sustained Splunk execution at scale.

● Sustained Advisory — Embedded Advisory

Hours Included

144

RSC Execution Hours

Service Period

6 or 12 Months

180 or 365-day service period

Overview & Objectives

This engagement delivers Splunk Resident Services in an Enterprise model to provide structured technical execution and enablement at the highest available capacity over a 6 or 12-month service period.

Engagement Objectives

Sustain progress on complex Splunk priorities with the highest available execution capacity
Provide hands-on technical execution and guidance across multiple concurrent workstreams
Drive enterprise-scale improvements in platform performance, data quality, and operational efficiency
Enable the client team through high-frequency structured working sessions

Service Structure

Sessions scheduled in advance at the start of the Service Period
48-hour notice required to cancel or reschedule sessions
Unused hours expire at end of Service Period — non-refundable
Remote delivery; onsite visits out of scope by default

Scope of Services

✓ In Scope — Supported Activities

Optimizing searches, dashboards, and reports for performance and accuracy
Troubleshooting performance issues across search heads, indexers, and forwarders
Reviewing and improving data onboarding, parsing, and field normalization
Implementing data retention policies and cost optimization strategies
Supporting upgrade planning, execution readiness, and post-upgrade validation
Developing or tuning detections, correlation searches, and alerts
Improving alerting strategies and reducing noise and false positives
Supporting Splunk Enterprise Security (ES) administration and use case development
Reviewing and improving index configurations, data models, and acceleration
Supporting integration with external systems, APIs, and data sources

✗ Out of Scope

Modification, installation, or maintenance of customer hardware or network equipment
Modification, installation, or maintenance of non-platform products or services
Weekend or holiday availability
Onsite visits
Any services or activities not expressly included in the applicable scope

Ideal For

Enterprise organizations running complex, large-scale Splunk environments requiring sustained, high-frequency technical execution.

Teams with broad, ongoing Splunk work across performance, data quality, detection, and integration workstreams.

Leaders who need a structured, accountable execution partner at enterprise scale over 6 or 12 months.

Buyers committing to a 6 or 12-month engagement who need the highest available RSC capacity.

What You Get

144 Hours of RSC Execution

144 hours of dedicated Splunk RSC time — the highest available Splunk tier — over the defined service period.

Flexible Term: 6 or 12 Months

6-month term: ~24 hrs/month (~12 sessions). 12-month term: ~12 hrs/month (~6 sessions). Choose the cadence that fits your environment.

Scheduled Working Sessions

High-frequency pre-scheduled sessions throughout the service period. 2-hour minimum increments.

Enterprise-Depth Execution

Sustained, high-frequency hands-on Splunk work across multiple defined priorities and workstreams.

Mid-Period Check-In

Progress review at ~90 days (and ~180 days for 12-month term) to re-prioritize and confirm remaining objectives.

Operating Rhythm

Meeting	Cadence	Purpose
Kickoff Session	Once (engagement start)	Define priorities, establish session cadence, confirm access and participation requirements
Working Sessions	~6–12 sessions/month (per term)	Hands-on technical execution across defined priorities and workstreams
Mid-Period Check-In	~90 days in (and ~180 days for 12M)	Review progress, re-prioritize remaining hours, identify blockers

Monthly cadence: 6-month term: approximately 24 hours/month (~12 two-hour sessions/month). 12-month term: approximately 12 hours/month (~6 two-hour sessions/month). Highest available Splunk RSC cadence.

Deliverables & Commercial

Deliverables

Resident Services execution outputs aligned to defined priorities
Recommendations, configuration updates, or optimization outputs as applicable
Session-based progress against agreed technical objectives

What Success Looks Like

Enterprise Splunk priorities receive sustained, high-frequency structured attention throughout the period
Enterprise-scale technical progress across all active workstreams
All 144 hours scheduled and utilized within the defined service period

VAR Commercial Model

CONFIDENTIAL — VAR USE ONLY

Service Type	Embedded Advisory — Resident Services
Tier	Enterprise
Hours Included	144 RSC hours
Service Period	6 Months (180 Days) or 12 Months (365 Days)
Session Format	2-hour minimum increments
Governance	None (session-based delivery)
nth → VAR Price	$30,960
VAR → Client Price	$38,700
nth degree MSRP	$45,000
VAR Margin Target	~20%

Pricing is per engagement (fixed package), not per hour. nth → VAR Price represents wholesale price to VAR. VAR → Client Price represents suggested resale targeting ~20% margin.

Need continuous execution instead?

When outcome alignment matters — mesh™ is the answer.

Resident Services deliver structured advisory time. When clients need continuous, outcome-aligned execution governed by a Client Success Plan, mesh™ subscription services are the right model.

Explore mesh™ Subscription Services →