Grail DDU Consumption

[GregOReilly]

I am considering migrating to Grail soon and have an understanding that the DDU calculation methods will change from:

Log Management
Ingest and Process (number of events)
Retain (35 days)
Query(unlimited)

to

Grail
Ingest and Process (number of GB 100.00 Per GB)
Retain (0.30 DDU per retained day)
Query(1.70 DDU's per GB Read)

This is drastically different. There is no way for me to calculate how many DDU's will be needed and how much this might cost. We certainly have NO idea how many times a log is queried by our users x250. Even if I look at a single day in Log Management, I get a sense of log sources with most events, but this doesnt mean they consume the highest GB (every log event is different). 

Has anyone made the jump, do you see grature consumption? or was it drastically lower than expected? One factor we do CONTROL is Retain: This is a real multiplier. So the lower we retain data, the less we spend on DDU. 

Difficult decisions ahead.

Those that have migrated, do you get a GB per log source view in the UI to help understand the most costly logs to ingest?

[ChadTurner]

Much like the RUM/DEM usage it can vary by usage, you might be able to put in limits to control any potential for overages but your restricting the functionality. My recommendation is to leverage the licensing console and review the Forecast for DDUs or any licensing construct you are interested in. 

[Slawa]

In my experience ingest and retail are the same or lower a bit.
Query - this varibale is difficult to predict.
For us is relative not a big deal if you are not using it on dashboards but just for logs analisys or douing deep search all time