topic Re: SPLUNK index main logs in Getting Data In

SPLUNK index main logs

jviteka — Mon, 21 Oct 2013 20:35:31 GMT

My Splunk License Usage app is showing that my SPLUNK server is using 26% of my license(From "main"). Is there any way to make this smaller?

Re: SPLUNK index main logs

jviteka — Mon, 21 Oct 2013 20:38:39 GMT

I know that I can remove the monitor from /opt/splunk/var/log/splunk/*.log but would that be a good idea?

Re: SPLUNK index main logs

Ayn — Mon, 21 Oct 2013 20:42:08 GMT

It would make no difference. These logs go to the _internal index and do not count against your license.

Re: SPLUNK index main logs

jviteka — Mon, 21 Oct 2013 20:51:15 GMT

So when i look at my domain host "SPLUNK01.My.Domain" and "main" they dont count against my license? Why does the "License Usage" app on the matrix they show?

Re: SPLUNK index main logs

emiller42 — Mon, 21 Oct 2013 21:02:54 GMT

Internal Splunk logs aren't sent to 'Main'. they're sent to '_internal' and aren't applied to your license. If you have data going into Main, it's because of inputs you may have set up.

Recommend looking at the data in your main index and making determinations from there.

Re: SPLUNK index main logs

lguinn2 — Mon, 21 Oct 2013 21:03:34 GMT

Splunk indexes its internal logs (for example, splunkd.log) into an index named _internal. This index does not count as part of your Splunk license. Splunk does not add any data to the main index. So disabling Splunk's logs will not save you anything - as Ayn points out.

Everything in the main index came from either (1) inputs that you defined or (2) inputs defined by apps that you installed.

If you are monitoring the Linux or Windows system where Splunk is running - which is probably what SPLUNK01.My.Domain is - these are not Splunk internal logs. These are just regular system logs. These logs could be indexed in the main index or the os index or whatever - but these logs do count against your license. While it is a good idea to monitor the systems where Splunk is running, you can change or disable these inputs. Limiting these inputs will decrease your Splunk license usage.

People often install the Linux or Windows apps on their Splunk servers. This is most likely the origin of these inputs. If you have these apps, I suggest that you check the configurations.

Re: SPLUNK index main logs

jviteka — Mon, 21 Oct 2013 21:27:35 GMT

Thank you!!!