topic Can I decrease license usage by configuring props.conf and transforms.conf for selective indexing? in Getting Data In

Can I decrease license usage by configuring props.conf and transforms.conf for selective indexing?

ctaf — Mon, 16 Nov 2015 13:52:28 GMT

Hello,

I am trying to reduce the usage of my license and I found this post: https://answers.splunk.com/answers/42453/how-to-configure-selective-data-indexing.html

I was wondering if, by applying processing (props.conf) and transformation (transforms.conf), can I reduce the usage?

How does Splunk count the license usage? In this doc page:
http://docs.splunk.com/Documentation/Splunk/6.1/Admin/HowSplunklicensingworks
is written it takes in account "indexing", but it also says indexing is composed of data input.

Thank you,

Re: Can I decrease license usage by configuring props.conf and transforms.conf for selective indexing?

jeffland — Mon, 16 Nov 2015 14:42:34 GMT

License is used for what you write into your index from your inputs, i.e. after parsing and all that. That means you can do what is mentioned in your link and it will decrease your license usage.

Re: Can I decrease license usage by configuring props.conf and transforms.conf for selective indexing?

jlaw — Tue, 17 Nov 2015 22:43:05 GMT

See this docs topic about using props and transforms to route and filter data (it's also linked from that licensing topic you pasted):

http://docs.splunk.com/Documentation/Splunk/6.3.1/Forwarding/Routeandfilterdatad