Archive

Are splunk logs counted toward our license limit?

Path Finder

Hi, looking at volume indexed I see quite few MB of indexed splunk logs, the question is are these indexing counted toward our license? below are the log files I am talking about.

/apps/tparty/splunk/var/log/splunk/web_access.log 0.256985665 
/apps/tparty/splunk/var/log/splunk/splunkd_access.log 23.090337752 
/apps/tparty/splunk/var/log/splunk/splunkd.log.1 23.761911393 
/apps/tparty/splunk/var/log/splunk/splunkd.log 101.839995384 
/apps/tparty/splunk/var/log/splunk/scheduler.log 4.307683944 
/apps/tparty/splunk/var/log/splunk/metrics.log.5 23.704051972 
/apps/tparty/splunk/var/log/splunk/metrics.log.4 23.704115867 
/apps/tparty/splunk/var/log/splunk/metrics.log.3 18.331140518 
/apps/tparty/splunk/var/log/splunk/metrics.log.2 23.706820488 
/apps/tparty/splunk/var/log/splunk/metrics.log.1 21.531718254 
/apps/tparty/splunk/var/log/splunk/metrics.log 6.729707730 
/apps/tparty/splunk/etc/apps/sample_app/logs/maillog.1 5.304664611 
/apps/tparty/splunk/etc/apps/sample_app/logs/maillog 2.542978287 

Thanks, Firas

Splunk Employee
Splunk Employee

The Splunk internal data does not count towards your license.

Path Finder

that is good to know thanks!

then what start -> index activity -> indexing volume used for? what I need to find out is how much indexing counted toward our license each source, source type or host is forwarding.

Thanks,
Firas

0 Karma

Splunk Employee
Splunk Employee

Actual licensed-counted volume is different and only reported once per day in the internal license_audit.log file. You can see it by index=_internal source=*license_audit.log | timechart span=1d sum(todaysBytesIndexed) by host. There is additional and different information in version 4.2, btw.

Splunk Employee
Splunk Employee

The dashboards will show internal and non-licensed volume, but it just isn't counted against license.

0 Karma

Path Finder

any reason why it shows on (start -> index activity -> indexing Volume) ? I thought that this view will list all indexed logs.

a related question, from other posts I know that SPLUNK will not re-index rotated log files, why do I see them in this view(start -> index activity -> indexing Volume) as a separate indexed logs?

series sum(MB)

/logs/dsngw.log.1 398.334282874
/logs/dsngw.log.3 398.013719557
/logs/dsngw.log.2 394.660317424
/logs/dsngw.log.4 354.173194881

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!