All Apps and Add-ons

About relation of license usage and data types when input data from database.

yutaka1005
Builder

In database data size is affected by data types.

Also when inputs data from database by using DB_connect, I think splunk is understanding data types(int,char,timedata...etc) of each column.
*This is because data types are displayed when selecting columns to be used as timestamps.

So when Splunk inputs data from database by using DB_connect, is license usage affected by data types?

Or since Splunk recognizes and inputs data as a character string, does the data types not be related to license usage?

Also, if the former is correct, is it possible to set any data types to each column of data to be captured on Splunk and change the amount of license usage?

If someone knows about it and tells me, it would be greatly appreciated.

0 Karma

p_gurav
Champion

You can use this properties in props.conf along with inputs.conf:

[sourcetype_name]
INDEXED_EXTRACTIONS = CSV
FIELD_NAMES = <define your field>
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...