Archive
Highlighted

double indexing, does it count towards your license limit

New Member

if i send all syslog data to one splunk enterprise instance to be indexed and then it is forwarded onto another splunk enterprise instance.

Is the second splunk instance smart enough to know this data has already been indexed and doesnt count towards your daily license quota?

Thanks

Tags (1)
0 Karma
Highlighted

Re: double indexing, does it count towards your license limit

Champion

It will absolutely hit your index volume a second time, assuming you are forwarding via syslog or splunk output.

You can make use of summary indexing or collect to search and index the results of said search, which won't hit your license cost again, but you don't want to do this for large amounts of data as a means to have two copies of all your data.

0 Karma
Highlighted

Re: double indexing, does it count towards your license limit

SplunkTrust
SplunkTrust
0 Karma