All Apps and Add-ons

Are dbxquery results from search counted as ingested data for license purposes?

ewan000
Path Finder

If I simply run:

dbxquery connection=myConn query="select * from manyGigabytesOfDataTable"

My understanding is that the results are not indexed.

Will the returned data count towards my Licence Volume?

If not, Will it if I write it to a lookup or store it in some other way. What are the options?

Obviously this is an extreme example, but I could use the command in a dashboard or alert which will be run frequently enough for smaller result sets to make a difference.

Also, It would be good to know the answer for other commands which bring back data, such as rest

Tags (2)
0 Karma
1 Solution

damann
Communicator

This question was already discussed a few years ago: https://answers.splunk.com/answers/696613/whehter-dbxquery-search-consume-license-usage.html

dbxqueries dont consume your license, neither does storing something into a lookup or even REST calls.(https://answers.splunk.com/answers/189158/are-keyvalue-store-data-counted-as-splunk-license.html)

Only data which traverses through your indexing pipeline will count against your license.
For further information about licensing you should read this topic: https://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/HowSplunklicensingworks

View solution in original post

damann
Communicator

This question was already discussed a few years ago: https://answers.splunk.com/answers/696613/whehter-dbxquery-search-consume-license-usage.html

dbxqueries dont consume your license, neither does storing something into a lookup or even REST calls.(https://answers.splunk.com/answers/189158/are-keyvalue-store-data-counted-as-splunk-license.html)

Only data which traverses through your indexing pipeline will count against your license.
For further information about licensing you should read this topic: https://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/HowSplunklicensingworks

ewan000
Path Finder

Thanks, makes sense, although I notice it's unclear on whether metrics is just external data or not. Now I wonder whether ITSI storing its KPIs costs money.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...