topic Re: Regarding requirement when splunk free license in Getting Data In

Regarding requirement when splunk free license

05500 — Thu, 21 May 2015 06:52:26 GMT

Q1, I know it is indexed MAX 500MB per 1 day when using splunk free license.
In this case, regargding limit, it indicates an indexed data, NOT imported data from each servers?

Q2, In the Q1, if imported data was exceeded over 500MB and indexed data is less 500MB,
Can I use Splunk free license forever? In that case, how can I filter data when I index data?

Regarding security logs for Windows, there are many logs.
I want to import all logs from each servers to Splunk server but I don't want to index only failure logs without success logs.
In this case, can I filter?

Re: Regarding requirement when splunk free license

gyslainlatsa — Thu, 21 May 2015 09:01:25 GMT

hi,
following this link:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/TypesofSplunklicenses#Free_license

Re: Regarding requirement when splunk free license

Arun_N_007 — Thu, 21 May 2015 09:09:31 GMT

Hi,

Q1 - How will you import data from other servers? Data is already indexed?

You cant store data in Splunk server without indexing.

You can filter success logs while forwarding and indexing the data using props and transforms.