All Apps and Add-ons

Is it possible to set any data types to each column of data to be captured on Splunk and change the amount of license usage?

yutaka1005
Builder

In database, data size is affected by data types.

Also when inputs data from database by using DB_connect, I think Splunk is understanding data types(int,char,timedata...etc) of each column.
*This is because data types are displayed when selecting columns to be used as timestamps.

So when Splunk inputs data from database by using DB_connect, is license usage affected by data types?

Or since Splunk recognizes and inputs data as a character string, the data types not be related to license usage?

Also, if the former is correct, is it possible to set any data types to each column of data to be captured on Splunk and change the amount of license usage?

If someone knows about it and tells me, it would be greatly appreciated.

0 Karma
1 Solution

xpac
SplunkTrust
SplunkTrust

DB Connect recognizes data types in the columns, however data in Splunk is always indexed as a string, therefore the original data type doesn't matter. The string "123" uses as much space/license as the integer 123.
Only when data is ingested into one of the new metrics indexes, it's saved as a numeric value, as metrics indexes only allow for numbers. The license usage on metrics indexes however is fixed on 150 bytes per event, therefore the stored data size doesn't matter for license usage.

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

View solution in original post

xpac
SplunkTrust
SplunkTrust

DB Connect recognizes data types in the columns, however data in Splunk is always indexed as a string, therefore the original data type doesn't matter. The string "123" uses as much space/license as the integer 123.
Only when data is ingested into one of the new metrics indexes, it's saved as a numeric value, as metrics indexes only allow for numbers. The license usage on metrics indexes however is fixed on 150 bytes per event, therefore the stored data size doesn't matter for license usage.

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

yutaka1005
Builder

Thank you for answer!

It is very helpful!

By the way, the amount of license usage of metric data is 150 bytes per event.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/HowSplunklicensingworks

0 Karma

xpac
SplunkTrust
SplunkTrust

Yeah, my brain is already asleep. Thanks, I updated my answer 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...