County IT asks commissioners to approve annual Splunk licensing renewals
Loading...
Summary
Spokane County IT requested board approval to renew Splunk security-information-and-event-management licensing for one-year terms through 2027, citing state web‑history retention mandates and current ingestion levels.
Spokane County IT directors on Tuesday asked the Board of County Commissioners to approve annual renewals of Splunk licensing to cover 2025 through 2027.
Kevin Norris, IT director, introduced the request and said assistant IT director Sean Dimitrovich led the presentation asking for three consecutive one‑year renewals covering 2025–27 because a multi‑year renewal could not be completed under current NASPO contract language. “We are here today to request continued funding from Confinet for Splunk licensing,” Dimitrovich said, adding that the county first adopted Splunk in 2017.
Dimitrovich described Splunk as the county’s security information and event management platform that ingests firewall logs, Microsoft Defender logs, Active Directory and other sources to provide real‑time analysis, dashboards and alerts. He said the platform also retains county web history for one year to satisfy state requirements that drove the 2017 adoption.
Staff said perpetual licensing secured earlier covers 20 GB per day of ingestion; additional licensed capacity brought the county to a 120 GB/day license level. During upgrade work, peak ingestion had reached about 180 GB/day but an environment refresh reduced current ingestion to about 85 GB/day, below the 120 GB/day threshold and leaving room for growth.
Norris said the county paid about $48,000 (including tax) in 2024 and that a 2025 quote (with tax) is $58,000. Using a 7–10% annual growth assumption, staff estimated a total three‑year cost of about $192,147 on the NASPO contract.
Dimitrovich said the recurring cost has been included in the county’s 2025 and 2026 budgets and that some grant offsets may be available through the county’s emergency management office. No formal vote was recorded during the briefing; staff sought the board’s approval to place the renewal on the legislative agenda for formal action.
Staff noted that the vendor would require the county to accept separate one‑year renewals rather than a single three‑year agreement because of NASPO contract language.
