https://community.splunk.com/t5/Getting-Data-In/when-a-setup-a-blacklist-in-input-conf-will-it-decrease-the/m-p/473030#M87696 <P>As I asked, if I setup a blacklist to deny some logs, does the dropped logs still occupy the license quota?</P> Mon, 17 Feb 2020 09:31:37 GMT lllidan 2020-02-17T09:31:37Z https://community.splunk.com/t5/Getting-Data-In/when-a-setup-a-blacklist-in-input-conf-will-it-decrease-the/m-p/473030#M87696 <P>As I asked, if I setup a blacklist to deny some logs, does the dropped logs still occupy the license quota?</P> Mon, 17 Feb 2020 09:31:37 GMT https://community.splunk.com/t5/Getting-Data-In/when-a-setup-a-blacklist-in-input-conf-will-it-decrease-the/m-p/473030#M87696 lllidan 2020-02-17T09:31:37Z https://community.splunk.com/t5/Getting-Data-In/when-a-setup-a-blacklist-in-input-conf-will-it-decrease-the/m-p/473031#M87697 <P>Hi @lllidan,<BR /> Splunk License is counted on dayly indexed logs, this means that all the logs that you don't index (e.g. filtering) aren't added to the license consuption, but they are also non useful!<BR /> Blacklisting some logs, you don't index them so you don't use license.</P> <P>Ciao.<BR /> Giuseppe</P> Mon, 17 Feb 2020 09:36:24 GMT https://community.splunk.com/t5/Getting-Data-In/when-a-setup-a-blacklist-in-input-conf-will-it-decrease-the/m-p/473031#M87697 gcusello 2020-02-17T09:36:24Z https://community.splunk.com/t5/Getting-Data-In/when-a-setup-a-blacklist-in-input-conf-will-it-decrease-the/m-p/473032#M87698 <P>thanks a lot.</P> Mon, 17 Feb 2020 09:42:04 GMT https://community.splunk.com/t5/Getting-Data-In/when-a-setup-a-blacklist-in-input-conf-will-it-decrease-the/m-p/473032#M87698 lllidan 2020-02-17T09:42:04Z