topic Re: Are Splunk licenses based on compressed or uncompressed data? in Installation

Are Splunk licenses based on compressed or uncompressed data?

msrkr — Mon, 15 Jun 2020 23:09:44 GMT

We are in the process of getting Splunk licenses and just want to know whether Splunk licenses are based on compressed or uncompressed data.
Is there any place where I can look for this information?

Re: Are Splunk licenses based on compressed or uncompressed data?

cpetterborg — Tue, 24 Oct 2017 21:05:56 GMT

It is based on uncompressed data. If you bring in a byte of uncompressed data and it is indexed, that byte counts against your license.

I don't know where that is spelled out specifically, but that is the way it works.

Re: Are Splunk licenses based on compressed or uncompressed data?

richgalloway — Tue, 24 Oct 2017 21:09:56 GMT

License volume is measured before compression.

Re: Are Splunk licenses based on compressed or uncompressed data?

msrkr — Tue, 24 Oct 2017 21:12:47 GMT

Is there any place i can look for evidence.

Re: Are Splunk licenses based on compressed or uncompressed data?

cpetterborg — Tue, 24 Oct 2017 21:14:14 GMT

Evidence? Do you mean verification? See this for additional comments about this:

https://answers.splunk.com/answers/481410/does-splunk-count-the-incoming-uncompressed-data-o.html

@richgalloway has also given you his answer here, which is the same. I don't know where you can find the exact explanation, except maybe in the license agreement that you sign, and I'm not sure if it is there, though I suspect it is.

Re: Are Splunk licenses based on compressed or uncompressed data?

msrkr — Tue, 24 Oct 2017 21:16:18 GMT

Evidence that splunk license is based on uncompressed data.

Re: Are Splunk licenses based on compressed or uncompressed data?

mattymo — Tue, 24 Oct 2017 21:18:26 GMT

https://www.splunk.com/en_us/products/pricing.html?utm_expid=.OPF1ZinsTb2yA-taml2MNw.0&utm_referrer=https%3A%2F%2Fwww.google.ca%2F

Re: Are Splunk licenses based on compressed or uncompressed data?

MuS — Tue, 24 Oct 2017 21:34:07 GMT

How about the docs page http://docs.splunk.com/Documentation/Splunk/latest/Admin/HowSplunklicensingworks on licensing

cheers, MuS

Re: Are Splunk licenses based on compressed or uncompressed data?

s2_splunk — Tue, 24 Oct 2017 23:34:37 GMT

How Splunk Licensing works.

Splunk Enterprise licenses specify how much data you can index per calendar day.

Note it doesn't say it specifies how much disk space your data equates to once indexed.
Compression is a network and storage optimization we do to save on transmission bandwidth and storage footprint and is unrelated to indexing volume metering.
Hopefully, this is the evidence you are looking for.

Re: Are Splunk licenses based on compressed or uncompressed data?

richgalloway — Wed, 25 Oct 2017 18:00:03 GMT

This section from http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/WhatSplunkdoeswithyourdata should be the evidence you need. It says that compression happens after indexing, which implies after license volume computation.

In the indexing pipeline, Splunk software performs additional processing, including:

Breaking all events into segments that can then be searched. You can determine the level of segmentation, which affects indexing and searching speed, search capability, and efficiency of disk compression. Building the index data structures. Writing the raw data and index files to disk, **where post-indexing compression occurs**.

[emphasis added]

Re: Are Splunk licenses based on compressed or uncompressed data?

s2_splunk — Wed, 25 Oct 2017 18:04:22 GMT

FYI, I have initiated a doc update to make that more explicit in the docs on how licensing works. Not the first time this question comes up.