topic Re: Do multiple summary indexes affect license usage? in Installation

Do multiple summary indexes affect license usage?

Paolo_Prigione — Mon, 15 Jun 2020 18:22:21 GMT

I know that since 4.1 summary indexing does not count against license anymore. However, what if I have multiple summary indexes?

According to this answer, I'd say more indexes would not affect the license, but just looked for a confirmation...

E.g.

summary -> the defauls summary index, residing on the search head.
summary1h -> stores results of scheduled aggregations having resolution of 1 hour, data kept for 1 month
summary1d -> stores results of scheduled aggregations having resolution of 1 day, data kept for 3 months

The last two sum-indexes would reside on a dedicate job server (with forwarding license).

Would this configuration affect license usage?

Thanks

Re: Do multiple summary indexes affect license usage?

Stephen_Sorkin — Wed, 02 Mar 2011 01:08:03 GMT

Adding more summary indexes will not affect license usage. No summary indexed data will count against the license.

Re: Do multiple summary indexes affect license usage?

Paolo_Prigione — Wed, 02 Mar 2011 03:39:46 GMT

Thanks Stephen,
Paolo

Re: Do multiple summary indexes affect license usage?

aledantas2k12 — Wed, 13 Sep 2017 05:12:22 GMT

Wrong! If you overwrite the original sourcetype created by "|collect " (stash) it will count towards your licence.

Re: Do multiple summary indexes affect license usage?

ww9rivers — Tue, 04 Dec 2018 21:45:12 GMT

Can Splunk please clarify? Is it true that, if sourcetype is changed to anything other than "stash", summary indexed data would count against license usage?