topic Re: Daily indexing volume exceeded. in Monitoring Splunk

Daily indexing volume exceeded.

smolcj — Thu, 08 Nov 2012 11:23:21 GMT

Hi all, I am sorry to ask you this question, which has already answered several times before.
Do i have to remove those indexed data before midnight. i failed to do it. will it be a issue later. or the message will disappear after 14 days?
Thank you

Re: Daily indexing volume exceeded.

alacercogitatus — Thu, 08 Nov 2012 12:06:33 GMT

You should never have to remove or lose data for a violation. If you violate your license too many times, search will be disabled. The message will go away after a while, yes.

Re: Daily indexing volume exceeded.

DaveSavage — Thu, 08 Nov 2012 12:07:06 GMT

Splunk (in my experience) are not mean on this subject. If you have 3 strikes in a calendar month then it will stop searches. Spikes due to initial start up / take-on are sort of expected because it is difficult to calculate with great certainty what you need. If your problem is recurrent and persistent then talk to sales.

Re: Daily indexing volume exceeded.

DaveSavage — Thu, 08 Nov 2012 12:10:22 GMT

Check out: http://docs.splunk.com/Documentation/Splunk/4.3.4/Admin/Aboutlicenseviolations

Re: Daily indexing volume exceeded.

sowings — Thu, 08 Nov 2012 12:22:25 GMT

To be clear, it stops allowing search, except on the _internal index; it doesn't stop indexing.

Re: Daily indexing volume exceeded.

DaveSavage — Thu, 08 Nov 2012 15:13:37 GMT

@sowings - absolutely correct, a slip of imprecision on my behalf there. Amended. Thanks