Archive

licensing question concerning fields from HEC?

daniel333
Builder

All,

Just curious if "cool-fields" are billed against our license in the example below?

curl -k  https://hec.domain.com:8088/services/collector/event -H "Authorization: Splunk a2c4cf57-8e67-4a5a-8c72-8649004bc8cf" \
  -d '{"event": "Hello=world!","sourcetype": "cool-fields", "fields": {"device": "macbook", "users": ["joe", "bob"]}}'
0 Karma

mayurr98
SplunkTrust
SplunkTrust

Hello

As long as it is indexing in Splunk it will billed be against your license.Its straight-forward, if you are indexing raw, then it will count against your license except for the metadata fields and replicated data.

Summary indexing and metric rollup summaries do not count against your license. Internal indexes, such as _internal and _introspection, also do not count against your license.

Refer this
https://answers.splunk.com/answers/581441/how-is-the-splunk-license-measured.html
https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/HowSplunklicensingworks

0 Karma

Sukisen1981
Champion

@mayurr98 says is right. the HEC indexes event over HTTP into a index that you provide in the configuration , as such whatever data you sent across the HEC will be indexed and will be billed

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!