topic Populating summary index using collect command is counted for license volume? in Knowledge Management

Populating summary index using collect command is counted for license volume?

melonman — Tue, 28 Oct 2014 07:35:53 GMT

I need to run a series of summary generating searches, one followed by another.
e.g.
summary search1 generates summary data from raw, and stores the summary data in summary index1
summary search2 generates summary data from summary index1, and stores the summary data in summary index2
summary search3 generates summary data from summary index2, and stores the summary data in summary index3

Normally, I could set cron schedule for search1, 2, 3 with enough time between searches.
However, it is difficult to determine how long I need to wait before starting the following searches.

And my question is
1) Can I configure a series or sequences of searches (batch search orchestration...?)
2) If I need to write a script that runs searches sequentially,
could I use collect command and still the summary index is NOT counted for daily license usage volume?

Thanks,

Re: Populating summary index using collect command is counted for license volume?

anupjishnu — Wed, 03 Dec 2014 21:11:13 GMT

I had the same exact question and what I have been told by Professional Services is that using "collect" is actually working on already indexed records and so will not be counted towards daily license usage.

Re: Populating summary index using collect command is counted for license volume?

somesoni2 — Wed, 03 Dec 2014 22:32:18 GMT

No it does not.

Documentation: (First par, Note section, OR just simple search for 'summary indexing')
http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Aboutlicenseviolations

Re: Populating summary index using collect command is counted for license volume?

DavidHourani — Wed, 08 May 2019 09:18:04 GMT

I downvoted this post because this is wrong... it depends on the sourcetype used. if the "stash" sourcetype is modified then it will count against the license