All Apps and Add-ons

Are dbxquery results from search counted as ingested data for license purposes?

ewan000
Path Finder

If I simply run:

dbxquery connection=myConn query="select * from manyGigabytesOfDataTable"

My understanding is that the results are not indexed.

Will the returned data count towards my Licence Volume?

If not, Will it if I write it to a lookup or store it in some other way. What are the options?

Obviously this is an extreme example, but I could use the command in a dashboard or alert which will be run frequently enough for smaller result sets to make a difference.

Also, It would be good to know the answer for other commands which bring back data, such as rest

Tags (2)
0 Karma
1 Solution

damann
Communicator

This question was already discussed a few years ago: https://answers.splunk.com/answers/696613/whehter-dbxquery-search-consume-license-usage.html

dbxqueries dont consume your license, neither does storing something into a lookup or even REST calls.(https://answers.splunk.com/answers/189158/are-keyvalue-store-data-counted-as-splunk-license.html)

Only data which traverses through your indexing pipeline will count against your license.
For further information about licensing you should read this topic: https://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/HowSplunklicensingworks

View solution in original post

damann
Communicator

This question was already discussed a few years ago: https://answers.splunk.com/answers/696613/whehter-dbxquery-search-consume-license-usage.html

dbxqueries dont consume your license, neither does storing something into a lookup or even REST calls.(https://answers.splunk.com/answers/189158/are-keyvalue-store-data-counted-as-splunk-license.html)

Only data which traverses through your indexing pipeline will count against your license.
For further information about licensing you should read this topic: https://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/HowSplunklicensingworks

ewan000
Path Finder

Thanks, makes sense, although I notice it's unclear on whether metrics is just external data or not. Now I wonder whether ITSI storing its KPIs costs money.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...