All Apps and Add-ons

Will the Splunk DB Connect app eat up my monthly index cap we have as part of our license?

ra01
Path Finder

I'm an analyst not a sysadmin, but I'm looking into proposing we use Splunk DB Connect. The one concern I'm trying to learn about is will it affect the monthly index cap limit we have as part of our license?

I couldn't find anything mentioned in the documentation.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

DB Connect won't affect your index any more than any other app. It all depends on how you use it. Just like you would be judicious about the log data you index (ignore DEBUG-level events, for example) so, too, should you be judicious about what you index using DB Connect.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ra01
Path Finder

one of our tech guys asked me "how much data will you be indexing with that app?"

Can you help me think about how to answer him?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Our admins often ask that question. We then look at the source, see how much data is there, how much of that we want to index, add it up, and that's our answer.

Use your favorite SQL client to run sample queries against your database. See how much you get back and build your index estimate from that.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...