topic Re: How does Splunk calculate daily indexing limit in Getting Data In

How does Splunk calculate daily indexing limit

malukisses — Tue, 22 Oct 2013 14:50:50 GMT

Hello,

We've been downloading between 200 and 250 MB of logs and adding them to Splunk every day.
Yesterday we downloaded 218MB, and this morning when I came in, I had a "indexing volume exceeded" warning.

Now my free license says I can index up to 500MB a day.

The only explanation for the warning would be if 500MB "indexed" doesn't necessarily mean 500MB of logs.

How does Splunk calculate the "indexing volume" and what would that translate in terms of log size?

Re: How does Splunk calculate daily indexing limit

lukejadamec — Tue, 22 Oct 2013 15:05:22 GMT

Indexing volume is the uncompressed log volume, and it does not include Splunk internal logging.
The index volume is measured from midnight to midnight.
You can use Deployment Monitor to see who indexed what and how much for the day the volume was exceeded. If you don't have Deployment Monitor installed, then you can use the searches I posted in this answer to see who was indexing what and how much:

http://answers.splunk.com/answers/107385/splunk-internal-fields-on-reports

Re: How does Splunk calculate daily indexing limit

yannK — Tue, 22 Oct 2013 15:12:14 GMT

for questions about what is my volume, details of searches are here
http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume