All Apps and Add-ons

Are dbxquery results from search counted as ingested data for license purposes?

ewan000
Path Finder

If I simply run:

dbxquery connection=myConn query="select * from manyGigabytesOfDataTable"

My understanding is that the results are not indexed.

Will the returned data count towards my Licence Volume?

If not, Will it if I write it to a lookup or store it in some other way. What are the options?

Obviously this is an extreme example, but I could use the command in a dashboard or alert which will be run frequently enough for smaller result sets to make a difference.

Also, It would be good to know the answer for other commands which bring back data, such as rest

Tags (2)
0 Karma
1 Solution

damann
Communicator

This question was already discussed a few years ago: https://answers.splunk.com/answers/696613/whehter-dbxquery-search-consume-license-usage.html

dbxqueries dont consume your license, neither does storing something into a lookup or even REST calls.(https://answers.splunk.com/answers/189158/are-keyvalue-store-data-counted-as-splunk-license.html)

Only data which traverses through your indexing pipeline will count against your license.
For further information about licensing you should read this topic: https://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/HowSplunklicensingworks

View solution in original post

damann
Communicator

This question was already discussed a few years ago: https://answers.splunk.com/answers/696613/whehter-dbxquery-search-consume-license-usage.html

dbxqueries dont consume your license, neither does storing something into a lookup or even REST calls.(https://answers.splunk.com/answers/189158/are-keyvalue-store-data-counted-as-splunk-license.html)

Only data which traverses through your indexing pipeline will count against your license.
For further information about licensing you should read this topic: https://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/HowSplunklicensingworks

ewan000
Path Finder

Thanks, makes sense, although I notice it's unclear on whether metrics is just external data or not. Now I wonder whether ITSI storing its KPIs costs money.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...