https://community.splunk.com/t5/Getting-Data-In/How-to-avoid-blowing-the-license-at-the-first-start/m-p/91602#M19037 <P>You have 2 approaches for this problem :</P> <P>1) <STRONG>index all quickly</STRONG> and run</P> <P>You can turn on all your inputs at once, and index all the historical logs, get a warning for the first day <BR /> (it can be more than 2 day or more if the volume is too important for the indexing speed, or if new inputs/forwarders are added over several days)</P> <P>If you do not reach 5 days of warnings (3 for a free license) you are not in violation and the warning counter will reset after 30 days without new warning. This is usually a good method to index all your historical data at once. And If you reach a violation, you can always get a reset key from splunk support if you have a support contract.</P> <P>see <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Admin/Aboutlicenseviolations">http://docs.splunk.com/Documentation/Splunk/5.0.1/Admin/Aboutlicenseviolations</A></P> <P>PS : if you are using forwarders, you may want to remove the default thruput limit of 256KBps to fasten the first monitoring.<BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Admin/Limitsconf">http://docs.splunk.com/Documentation/Splunk/5.0.1/Admin/Limitsconf</A></P> <P>2) <STRONG>exclude the old events</STRONG> from the initial indexing</P> <P>You can limit the volume of the historical logs (by example if you want to save space on the indexers or if you do not need the old events)</P> <UL> <LI><P>With a monitor on files, in inputs.conf you can add a setting named <CODE>ignoreOlderThan = 7d</CODE> that will disregard logs files based on their mod time. (by example older than 7 days )<BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Inputsconf</A></P></LI> <LI><P>With the windows events logs you can exclude the old events with the option <CODE>current_only=1</CODE>.<BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Inputsconf</A></P></LI> <LI><P>monitor only the last versions of the files, and force a log rotation to roll the old events. (configure your monitor with specific path or blacklists)</P></LI> </UL> Fri, 18 Jan 2013 00:48:41 GMT yannK 2013-01-18T00:48:41Z https://community.splunk.com/t5/Getting-Data-In/How-to-avoid-blowing-the-license-at-the-first-start/m-p/91601#M19036 <P>I have 5 GB /day license, and I am setting up plenty of new forwarders with new inputs. When I will turn them on, I expect about 50 GB of historical logs to be collected.</P> <P>I have windows forwarders with WinEventLogs, I have linux /var/log/ folders etc...<BR /> Some of them goes several month in the past.</P> <P>How to avoid getting license violation ?</P> Fri, 18 Jan 2013 00:44:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-avoid-blowing-the-license-at-the-first-start/m-p/91601#M19036 mataharry 2013-01-18T00:44:57Z https://community.splunk.com/t5/Getting-Data-In/How-to-avoid-blowing-the-license-at-the-first-start/m-p/91602#M19037 <P>You have 2 approaches for this problem :</P> <P>1) <STRONG>index all quickly</STRONG> and run</P> <P>You can turn on all your inputs at once, and index all the historical logs, get a warning for the first day <BR /> (it can be more than 2 day or more if the volume is too important for the indexing speed, or if new inputs/forwarders are added over several days)</P> <P>If you do not reach 5 days of warnings (3 for a free license) you are not in violation and the warning counter will reset after 30 days without new warning. This is usually a good method to index all your historical data at once. And If you reach a violation, you can always get a reset key from splunk support if you have a support contract.</P> <P>see <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Admin/Aboutlicenseviolations">http://docs.splunk.com/Documentation/Splunk/5.0.1/Admin/Aboutlicenseviolations</A></P> <P>PS : if you are using forwarders, you may want to remove the default thruput limit of 256KBps to fasten the first monitoring.<BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Admin/Limitsconf">http://docs.splunk.com/Documentation/Splunk/5.0.1/Admin/Limitsconf</A></P> <P>2) <STRONG>exclude the old events</STRONG> from the initial indexing</P> <P>You can limit the volume of the historical logs (by example if you want to save space on the indexers or if you do not need the old events)</P> <UL> <LI><P>With a monitor on files, in inputs.conf you can add a setting named <CODE>ignoreOlderThan = 7d</CODE> that will disregard logs files based on their mod time. (by example older than 7 days )<BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Inputsconf</A></P></LI> <LI><P>With the windows events logs you can exclude the old events with the option <CODE>current_only=1</CODE>.<BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Inputsconf</A></P></LI> <LI><P>monitor only the last versions of the files, and force a log rotation to roll the old events. (configure your monitor with specific path or blacklists)</P></LI> </UL> Fri, 18 Jan 2013 00:48:41 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-avoid-blowing-the-license-at-the-first-start/m-p/91602#M19037 yannK 2013-01-18T00:48:41Z