https://community.splunk.com/t5/Knowledge-Management/How-does-Splunk-determine-data-is-being-summarized-and-thus-not/m-p/71603#M671 <P>In the latest versions of Splunk, summary indexing does not deduct from the licensed indexing capacity. How does Splunk determine if data is summary data? Is it through use of the summary search commands (e.g. sistats, sichart, collect)? Does it exclude indexes prefaced with 'summary?' Do you have to check the "Enable Summary Indexing" box when scheduling the summary search?</P> Sat, 16 Oct 2010 03:14:25 GMT hulahoop 2010-10-16T03:14:25Z https://community.splunk.com/t5/Knowledge-Management/How-does-Splunk-determine-data-is-being-summarized-and-thus-not/m-p/71603#M671 <P>In the latest versions of Splunk, summary indexing does not deduct from the licensed indexing capacity. How does Splunk determine if data is summary data? Is it through use of the summary search commands (e.g. sistats, sichart, collect)? Does it exclude indexes prefaced with 'summary?' Do you have to check the "Enable Summary Indexing" box when scheduling the summary search?</P> Sat, 16 Oct 2010 03:14:25 GMT https://community.splunk.com/t5/Knowledge-Management/How-does-Splunk-determine-data-is-being-summarized-and-thus-not/m-p/71603#M671 hulahoop 2010-10-16T03:14:25Z https://community.splunk.com/t5/Knowledge-Management/How-does-Splunk-determine-data-is-being-summarized-and-thus-not/m-p/71604#M672 <P>Only data that is populated through a summary search command is exempt from the daily licensing volume.</P> Sat, 16 Oct 2010 05:08:46 GMT https://community.splunk.com/t5/Knowledge-Management/How-does-Splunk-determine-data-is-being-summarized-and-thus-not/m-p/71604#M672 matt 2010-10-16T05:08:46Z https://community.splunk.com/t5/Knowledge-Management/How-does-Splunk-determine-data-is-being-summarized-and-thus-not/m-p/71605#M673 <P>For clarity the search commands are sitop, sirare, sistats, sichart, sitimechart and collect.</P> Sat, 16 Oct 2010 05:16:29 GMT https://community.splunk.com/t5/Knowledge-Management/How-does-Splunk-determine-data-is-being-summarized-and-thus-not/m-p/71605#M673 hulahoop 2010-10-16T05:16:29Z https://community.splunk.com/t5/Knowledge-Management/How-does-Splunk-determine-data-is-being-summarized-and-thus-not/m-p/71606#M674 <P>Also, this is only true for versions 4.0.10 / 4.1 and later. In earlier versions, summary indexing counted towards your license just like any other input.</P> Sat, 16 Oct 2010 08:05:16 GMT https://community.splunk.com/t5/Knowledge-Management/How-does-Splunk-determine-data-is-being-summarized-and-thus-not/m-p/71606#M674 Lowell 2010-10-16T08:05:16Z https://community.splunk.com/t5/Knowledge-Management/How-does-Splunk-determine-data-is-being-summarized-and-thus-not/m-p/71607#M675 <P>Generally, summary index data is not counted against license volume. More specifically, the summary indexing command <CODE>collect</CODE> generates data with the SI <CODE>stash</CODE> sourcetype and this is not counted against license. Using the <CODE>si-</CODE> commands in other ways, or using <CODE>collect</CODE> and overriding the sourcetype <EM>will</EM> count against your license.</P> Wed, 08 Dec 2010 08:50:25 GMT https://community.splunk.com/t5/Knowledge-Management/How-does-Splunk-determine-data-is-being-summarized-and-thus-not/m-p/71607#M675 gkanapathy 2010-12-08T08:50:25Z