https://community.splunk.com/t5/Splunk-Search/Question-about-the-PCI-Application/m-p/79903#M181776 <P>Note that this is only true from 4.0.10 onward. Older versions did count summary indexing against your license.</P> Fri, 29 Oct 2010 03:21:31 GMT southeringtonp 2010-10-29T03:21:31Z https://community.splunk.com/t5/Splunk-Search/Question-about-the-PCI-Application/m-p/79901#M181774 <P>What is the "stash" sourcetype used for in the application? We're getting two huge spikes of events from that sourcetype every day at 10 pm and 7 am. They are consuming a significant amount of our license. The messages look like the following:</P> <PRE><CODE>51 10/28/10 7:59:00.000 AM 10/28/2010 07:59:00, search_name="PCI 7.1 - Successful Access by Target - Summary Gen", search_now=1288278900.000, info_min_time=1288277700.000, info_max_time=1288278600.000, info_search_time=1288278935.693, dest_bestmatch=0741BOH, psrsvd_gc=2, psrsvd_v=1 host=semvsplunkprd Options| sourcetype=stash Options| source=PCI 7.1 - Successful Access by Target - Summary Gen Options 52 10/28/10 7:59:00.000 AM 10/28/2010 07:59:00, search_name="PCI 7.1 - Successful Access by Target - Summary Gen", search_now=1288278900.000, info_min_time=1288277700.000, info_max_time=1288278600.000, info_search_time=1288278935.693, dest_bestmatch=0706BOH, psrsvd_gc=1, psrsvd_v=1 host=semvsplunkprd Options| sourcetype=stash Options| source=PCI 7.1 - Successful Access by Target - Summary Gen Options 53 10/28/10 7:59:00.000 AM 10/28/2010 07:59:00, search_name="PCI 7.1 - Successful Access by Target - Summary Gen", search_now=1288278900.000, info_min_time=1288277700.000, info_max_time=1288278600.000, info_search_time=1288278935.693, dest_bestmatch=0661BOH, psrsvd_gc=2, psrsvd_v=1 host=semvsplunkprd Options| sourcetype=stash Options| source=PCI 7.1 - Successful Access by Target - Summary Gen Options </CODE></PRE> Fri, 29 Oct 2010 02:59:58 GMT https://community.splunk.com/t5/Splunk-Search/Question-about-the-PCI-Application/m-p/79901#M181774 jambajuice 2010-10-29T02:59:58Z https://community.splunk.com/t5/Splunk-Search/Question-about-the-PCI-Application/m-p/79902#M181775 <P>The "stash" sourcetype is used for summary indexing. The Summary Gen in the search names is a good clue. Are the results with sourcetype="stash" showing up outside of index=summary? If properly configured, summary indexing should not count against your indexing volume.</P> Fri, 29 Oct 2010 03:10:35 GMT https://community.splunk.com/t5/Splunk-Search/Question-about-the-PCI-Application/m-p/79902#M181775 araitz 2010-10-29T03:10:35Z https://community.splunk.com/t5/Splunk-Search/Question-about-the-PCI-Application/m-p/79903#M181776 <P>Note that this is only true from 4.0.10 onward. Older versions did count summary indexing against your license.</P> Fri, 29 Oct 2010 03:21:31 GMT https://community.splunk.com/t5/Splunk-Search/Question-about-the-PCI-Application/m-p/79903#M181776 southeringtonp 2010-10-29T03:21:31Z https://community.splunk.com/t5/Splunk-Search/Question-about-the-PCI-Application/m-p/79904#M181777 <P>Isn't everyone using the latest/greatest??? <span class="lia-unicode-emoji" title=":face_with_tongue:">😛</span></P> Fri, 29 Oct 2010 05:06:11 GMT https://community.splunk.com/t5/Splunk-Search/Question-about-the-PCI-Application/m-p/79904#M181777 araitz 2010-10-29T05:06:11Z