Are dbxquery results from search counted as ingested data for license purposes?

[ewan000]

If I simply run:

dbxquery connection=myConn query="select * from manyGigabytesOfDataTable"

My understanding is that the results are not indexed.

Will the returned data count towards my Licence Volume?

If not, Will it if I write it to a lookup or store it in some other way. What are the options?

Obviously this is an extreme example, but I could use the command in a dashboard or alert which will be run frequently enough for smaller result sets to make a difference.

Also, It would be good to know the answer for other commands which bring back data, such as rest

[damann · Accepted solution]

This question was already discussed a few years ago: https://answers.splunk.com/answers/696613/whehter-dbxquery-search-consume-license-usage.html

dbxqueries dont consume your license, neither does storing something into a lookup or even REST calls.(https://answers.splunk.com/answers/189158/are-keyvalue-store-data-counted-as-splunk-license.html)

Only data which traverses through your indexing pipeline will count against your license.
For further information about licensing you should read this topic: https://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/HowSplunklicensingworks

[ewan000]

Thanks, makes sense, although I notice it's unclear on whether metrics is just external data or not. Now I wonder whether ITSI storing its KPIs costs money.