topic Re: Limit indexing per device a day in Getting Data In

Limit indexing per device a day

neelamssantosh — Fri, 27 Feb 2015 05:47:07 GMT

Is there any configuration to customise the data consumption per device per day.
Eg: 5devices sending logs to 1Indexer, restrict 5GB per device/day

Re: Limit indexing per device a day

rsennett_splunk — Fri, 27 Feb 2015 06:23:09 GMT

It's possible... but not practical as the indexed volume size is governed per index and not per device (source). So there is no magic setting unfortunately. Before I lay it all out, it would be helpful if you explained why you're trying to do this... can you elaborate on the reason you want to cut off devices? what kind of devices are you talking about?

Re: Limit indexing per device a day

NOUMSSI — Mon, 30 Mar 2015 09:58:25 GMT

Hi,

Each version of splunk comes with his own license and each license has define data volume consumption per device per day. You can't modified this file to increase the define volume.

The only ways to increase this volume are whether you buy a new license or you add more licences on the existing license,Hi,

Each version of splunk has his own license and each license has a define data volume consumption per device per day. You can't encrease this volume but you can decrease it. The only ways to encrease it are whether you buy another license or you add new licenses.

Re: Limit indexing per device a day

rsennett_splunk — Mon, 30 Mar 2015 14:51:52 GMT

The only way to stop collecting data from a monitor stanza is to change the inputs.conf and then restart Splunk. You don't want to have to do that on your indexer... But you could bounce a heavy forwarder frequently without loss of data. A heavy forwarder used as a relay, or more specifically... an instance of Splunk built to accept inputs, forward the data to your main indexer, monitor the volume and trigger an alert on your device quotas - where the result of the alert is a script that edits the stanza in inputs.conf changing disabled=true to disabled=false and then causes Splunk to restart.

This isn't an ideal set up (forcibly restarting anything with frequency), which is why if you explain your needs, neelamssantosh, we can perhaps come up with something more clear for you.