topic Enforce indexing quota/limit by Host? in Getting Data In

Enforce indexing quota/limit by Host?

NK_1 — Tue, 15 Mar 2011 04:08:09 GMT

Is there a way to configure Splunk to enforce indexing quoatas by Host? e.g. Do not index more than 250MB per day for Host X. Do not index more than 100MB per day for Host Y. etc.

Helps prevent quota overuse by non-critical systems.

Re: Enforce indexing quota/limit by Host?

gkanapathy — Tue, 15 Mar 2011 07:58:42 GMT

No there is not currently such functionality.

Re: Enforce indexing quota/limit by Host?

NK_1 — Mon, 18 Jul 2011 20:25:12 GMT

I hear that in v4.2 and later, there is the notion of License Pooling... allows a Corporation with a 100GB indexing quota/license/limit to sub-divide that and maybe assign a 10GB quota to the QA Department, so that Production hosts logging is not affected if QA goes wild with indexing and exhausts their quota?

Re: Enforce indexing quota/limit by Host?

jbsplunk — Mon, 18 Jul 2011 21:50:35 GMT

You can set up license pools that will alert you if a pool goes over its allocated quota, that way you can check your volume to see where the added data is coming from with some idea about the source of the events. However, it is not going to stop indexing from that particular pool. As gkanapathy pointed out, that functionality does not exist.