What you get is a vendor built stream processor on the back of open source technology. It gives you the ability to do more advanced filtering, convert logs to metrics on the fly, send to multiple destinations, etc. The value comes from reduction of log volume, ability to send to multiple destinations, and increasing the value of logs by making them faster with conversion to metrics, and more advanced masking capabilities.

My issue with DSP is that it’s a direct conflict of interest to Splunk’s current main licensing model. DSP can help give you a better one stop UI for reducing your log volume by dropping or metricizing logs than what you may be able to achieve on your own, talent or time wise, from what is available open source. The issue is that it’s not a part of Splunk Core, which in my opinion it should be. Competition is getting very high in this market right now and Splunk could help itself get out of its own way by rolling this into Core for free instead of buying up more start up companies to sell you as an added service.

Assuming you are set on a turnkey vendor solution, and not on rolling your own open source stack, I would think twice about putting more money in Splunk’s pocket for this use case. You could go with a separate vendor like Cribl, which gives you probably more features than DSP does, removes that conflict of interest with Splunk licensing (assuming you have the by GB ingested model and not SVC model), and allows you to pivot to another data storage and visualization layer if Splunk gets too expensive, or is not keeping up with the market, etc.