topic Re: How much license value is utilized while indexing a file of 100Gb once it is in compressed format in indexer? in Getting Data In

How much license value is utilized while indexing a file of 100Gb once it is in compressed format in indexer?

vikram_m — Thu, 06 Oct 2016 06:40:47 GMT

When a log file is brought inside the Splunk indexer after input phase it is compressed to almost 10% of its value. So if a 100Gb file is put onto indexer cluster say it gets compressed to 15 Gb, so how much indexer license will be used for the file to extract indexes from the raw data file indexer gets from forwarders? Is it 15Gb or 100Gb? Please suggest.

Re: How much license value is utilized while indexing a file of 100Gb once it is in compressed format in indexer?

lguinn2 — Thu, 06 Oct 2016 21:51:52 GMT

The data passes through the license meter before it is compressed and before the index files are created (which can be quite large).

So a 100Gb input source would use 100Gb of splunk license.

Re: How much license value is utilized while indexing a file of 100Gb once it is in compressed format in indexer?

ddrillic — Thu, 06 Oct 2016 23:10:09 GMT

Please note that data that is eliminated during the parsing process doesn't count against the daily quota.

About the parsing phase at How to Filter Unwanted Data without adding to Splunk Daily Indexing Volume

It says -

Re: How much license value is utilized while indexing a file of 100Gb once it is in compressed format in indexer?

vikram_m — Fri, 07 Oct 2016 08:14:39 GMT

Thanks lguinn this was helpful.

Re: How much license value is utilized while indexing a file of 100Gb once it is in compressed format in indexer?

vikram_m — Fri, 07 Oct 2016 08:15:05 GMT

Thank ddrillic this was helpful. 🙂

Re: How much license value is utilized while indexing a file of 100Gb once it is in compressed format in indexer?

aaraneta_splunk — Sat, 08 Oct 2016 00:35:11 GMT

Hi @vikram_m - Glad to hear that lguinn and ddrillic were able to provide helpful feedback. Please don't forget to resolve this post by clicking "Accept" below the best answer 🙂 Thanks!