topic Re: Indexed Data in Getting Data In

Indexed Data

harshavrath — Mon, 14 Apr 2014 09:54:58 GMT

HI,

I have so far indexed 38,442 of data into Splunk, how much is it when converted to MB & what will happen when i cross my 500MB limit.?

Any Help is Appreciated,

Thanks.

Re: Indexed Data

harshavrath — Mon, 14 Apr 2014 10:30:27 GMT

The License usage states that 500MB/perDay so can i index 400MB of data today & 400MB of Data tomorrow.

Re: Indexed Data

rje — Mon, 14 Apr 2014 10:55:02 GMT

How much data an event takes up depends on how much data is associated with the event.

You can index 500MB/day on the free and trial licence. When you exceed this limit you are given a warning that you have exeeded your limit. You can get 5 of these warnings each month. After the fifth warning Splunk will stop indexing new data for the rest of the month. You can still search in the data you already have indexed, by no new data will be indexed into splunk until you either purchase a licence or a new month comes along.

So to answer the question in your comment, yes, you can index 400MB today and 400MB tomorrow without getting a licence warning. There is no limit on the amount of data indexed into Splunk other that the size of your HDD.

Re: Indexed Data

harshavrath — Mon, 14 Apr 2014 10:57:04 GMT

thanks for the info rje.