All Apps and Add-ons

Are dbxquery results from search counted as ingested data for license purposes?

ewan000
Path Finder

If I simply run:

dbxquery connection=myConn query="select * from manyGigabytesOfDataTable"

My understanding is that the results are not indexed.

Will the returned data count towards my Licence Volume?

If not, Will it if I write it to a lookup or store it in some other way. What are the options?

Obviously this is an extreme example, but I could use the command in a dashboard or alert which will be run frequently enough for smaller result sets to make a difference.

Also, It would be good to know the answer for other commands which bring back data, such as rest

Tags (2)
0 Karma
1 Solution

damann
Communicator

This question was already discussed a few years ago: https://answers.splunk.com/answers/696613/whehter-dbxquery-search-consume-license-usage.html

dbxqueries dont consume your license, neither does storing something into a lookup or even REST calls.(https://answers.splunk.com/answers/189158/are-keyvalue-store-data-counted-as-splunk-license.html)

Only data which traverses through your indexing pipeline will count against your license.
For further information about licensing you should read this topic: https://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/HowSplunklicensingworks

View solution in original post

damann
Communicator

This question was already discussed a few years ago: https://answers.splunk.com/answers/696613/whehter-dbxquery-search-consume-license-usage.html

dbxqueries dont consume your license, neither does storing something into a lookup or even REST calls.(https://answers.splunk.com/answers/189158/are-keyvalue-store-data-counted-as-splunk-license.html)

Only data which traverses through your indexing pipeline will count against your license.
For further information about licensing you should read this topic: https://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/HowSplunklicensingworks

ewan000
Path Finder

Thanks, makes sense, although I notice it's unclear on whether metrics is just external data or not. Now I wonder whether ITSI storing its KPIs costs money.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...