---
icon: material/currency-usd
title: "Optimization"
---

How the Log10x App expands compact events at search time, search-time overhead, license-tier reduction, and what happens to the lines over a limit.

??? tenx-costopt "How does the Log10x App expand compact events"

    The Receiver compacts events losslessly, up to 256 KB per event, before they reach Splunk, so an ingest-based licence meters the compact size. The open-source [Log10x App](https://doc.log10x.com/apps/receiver/compact/splunk/){target="_blank"} expands compact events back to their original text at search time, and the record's metadata stays searchable as indexed fields.

    **How it works:**

    1. The `tx` macro, written in front of a search, runs a command that returns one row to look the search's words up in the templates and select the compact events that can match
    2. The `tenx-inflate` macro joins those events with templates from the KV Store
    3. The search after `tx` applies to the expanded lines, so results match the original data, with original field names and values
    4. Classic dashboards reach the same expansion through the app's `/tenx-search` REST endpoint

    **Storage architecture:**

    - Templates stored in the `tenx_dml` KV Store collection
    - Compact events carry sourcetype `tenx_encoded` (in your existing index)
    - Hash references link events to their templates

    **Built-in Analytics Dashboard shows:**

    - Total compact events and active templates
    - Reduction ratio and storage savings
    - Event volume trends over time
    - Top templates by usage
    - Expansion success rate

    **User experience:** Classic dashboards keep their panel SPL unchanged through the app's dashboard hook. Dashboard Studio panels and search-bar queries put the app's `tx` macro in front of their terms. Alerts created in the app's Compile Alert view are compiled once at save time into a native saved search. All of them read the original full-fidelity data.

    **Open source:** Available on [GitHub](https://github.com/log-10x/splunk-app){target="_blank"}.

??? tenx-costopt "What is the search-time overhead in Splunk"

    Once per search, a template resolution matches the search terms against the templates. Per-event expansion uses a KV Store primary-key lookup and native SPL functions. On one laptop running Splunk 10.4.3, a `tx` search over 157,228 compact events returns in about 1.5 to 4 seconds, where the same search over the raw lines takes under a second. Alerts created in the Compile Alert view resolve templates once, at save time; a search with `tx` resolves them at each run.

    The 10x Engine processes each event in under a millisecond. For resource requirements and Kubernetes resource specs, see [Node counting](https://doc.log10x.com/faq/pricing/node-counting/).

??? tenx-costopt "Can 10x reduce our Splunk license tier"

    Yes, on an ingest-based licence, which meters uncompressed ingest: compact events are metered at their compact size, and offload or drop keeps the lines over a limit off the meter. See [pricing](../../pricing/) for details.

    Splunk quotes its ingest licence per contract, so the tier boundary you cross depends on yours; measure the sustained post-optimization average before renegotiating.

    

    **Deployment sequence:**

    - **Cost analysis:** Agentless analysis via the [MCP server](https://github.com/log-10x/log10x-mcp){target="_blank"}'s SIEM-sample tool (read-only Splunk REST API query). Or deploy the [Reporter](https://doc.log10x.com/apps/reporter/){target="_blank"} DaemonSet for cost visibility before logs reach Splunk.
    - **Deploy:** Deploy the [Receiver in Compact mode](https://doc.log10x.com/apps/receiver/compact/){target="_blank"} alongside your forwarders via [Helm](https://doc.log10x.com/apps/receiver/deploy/){target="_blank"}
    - **Validate:** Measure sustained reduction, validate with Splunk license usage reports
    - **Renewal:** Deploy ahead of renewal, then negotiate the new tier on the demonstrated lower ingestion

    **Splunk Cloud:** on ingest pricing, the reduction comes off the GB ingested; on workload pricing, measured in Splunk Virtual Compute (SVC), a smaller ingest lowers the indexing and search load that SVC measures. **Splunk Enterprise:** a workload licence is measured in vCPUs, so there too the reduction shows as less indexing and search load.

??? tenx-costopt "What happens to the lines over a limit"

    The [Receiver](https://doc.log10x.com/apps/receiver/){target="_blank"} holds each service at the daily volume the team sets. Each statement over its limit takes its service's action:

    - **Offload to [S3](https://doc.log10x.com/run/input/objectStorage/){target="_blank"}/object storage:** the lines over the limit go to a bucket the team owns, off the licence meter; the Retriever fetches them back to Splunk on demand, and a fetched line meters like a new one.
    - **Compact:** the lines stay in Splunk at a fraction of their metered size, and the 10x app expands them at search time.
    - **Drop:** a lossy choice the team opts into per service, after a validation period.

    The Receiver exports [cost metrics](https://doc.log10x.com/run/output/metric/){target="_blank"} per [event type](https://doc.log10x.com/run/initialize/message/){target="_blank"} (volume filtered, spend rate, and sampling ratios), queryable via the [Prometheus Metrics API](https://doc.log10x.com/api/metrics/){target="_blank"}.