Splunkit and indexing

[louieb3]

I installed Splunkit to help with troubleshooting slow searches. One of the items in the instructions say to index the generated 50 GB data. Will this step use up my license allocation?

Thanks in advance.

[aelliott · Accepted solution]

According to the Install instructions:
(2) What did SplunkIt do to my Splunk server?

SplunkIt should be run on a clean Splunk instance, and after the test,
this Splunk instance can be deleted.

In other words, do not use a Splunk instance in-use to run SplunkIt if you
expect it restored to its previous state.

So per the above text, it will use whatever splunk license it is indexing on.

[aelliott]

you get so many warnings on your account, if this is just a one time thing then you would spike it for one day, it will not stop once hitting your indexing threshold. Then after 30 days the warning will go away. So if you want to use it once on one day, i don't see how that could hurt. As long as the instance you are using it on is a Dev or QA instance. I would not recommend using it on an instance that is in use by others for reporting etc.

[louieb3]

Thank you for the response. So I guess that means splunkit will not work for me.