Log Spend Auditor is a local-first CLI for understanding where Splunk ingest volume is going and which datasets may deserve review. Run a free Community Quickscan using read-only Splunk metadata or CSV exports. Pro adds full evidence, explanations, recommendations, risk context, and HTML/Markdown reports. Your raw Splunk events stay in your environment.