topic Re: how to avoid exceeded daily indexing volume limit when adding new server? in Installation

how to avoid exceeded daily indexing volume limit when adding new server?

baalchina — Fri, 18 Jan 2013 13:26:42 GMT

hello everyone,

I am testing splunk, and add an iis server to splunk server. For this server had ran for years, about 12g logs in the it.

So I found splunk notice me

Daily indexing volume limit exceeded today.

very soon.

Beacuse this server cannot generate 500M logs in a single day, so in normal time everything will be ok, but what can I do if I add this server in the first time to avoid exceed daily limit?

Thanks.

Re: how to avoid exceeded daily indexing volume limit when adding new server?

jodros — Fri, 18 Jan 2013 13:37:53 GMT

You are allowed to burst above your daily indexing licensing limit 5 times in 30 days with an Enterprise license. A message will appear and remain for 14 days notifying you that you went above you daily licensing limit, but search will not be disabled. I usually just called into support and they can turn the warning message off. I find it is best to plan for adding servers with a large amount of backfill data, and add them all on the same day.

You can also add a limits.conf file to the IIS server Splunk config to throttle the amount of logs being indexed using the "maxKBps = integer" statement. For example maxKBps = 512 would limit the speed of logs being send to not exceed 512 KBps. Please notice that this is in Bytes, not bits as most networking notation uses.

Re: how to avoid exceeded daily indexing volume limit when adding new server?

jodros — Fri, 18 Jan 2013 22:55:20 GMT

Did this answer resolve you question? If so, please mark it as the accepted answer.

Thanks

Re: how to avoid exceeded daily indexing volume limit when adding new server?

jodros — Mon, 21 Jan 2013 14:19:53 GMT

baalchina, did the supplied answer resolve your issue? If so, please select it as the accepted answer.

Thanks

Re: how to avoid exceeded daily indexing volume limit when adding new server?

jodros — Tue, 19 Feb 2013 18:15:03 GMT

baalchina, just checking in to see if you issue is now resolved.

thanks