splunk license usage question



I have a question about forwarder and log indexing.

How often forwarder pushes the data to Indexer? How do I modify the time?

How do I know what are the events and logs are taking affect on licence usage?

Are these splunk log files push to indexer? And does it affect on licence usage?
$ sudo ls /opt/splunk/var/log/splunk
audit.log firstinstall.log metrics.log.5 splunkdstderr.log
btool.log licenseusage.log mongod.log splunkdstdout.log
conf.log metrics.log remotesearches.log splunkduiaccess.log
access.log metrics.log.1 scheduler.log splunkd-utility.log
djangoerror.log metrics.log.2 searchhistory.log webaccess.log
djangoservice.log metrics.log.3 splunkdaccess.log webservice.log
metrics.log metrics.log.4 splunkd.log

Tags (1)
0 Karma


thank you for all of you. I would like to accept all of your answers. Can I accept all or need to accept one?

0 Karma

Splunk Employee
Splunk Employee

Hi @ananthan123 - Please accept the best answer so your question will be marked as resolved. But you can up-vote the other answers as well, that way these users will know you're appreciative of their help 🙂 Thanks and Happy Splunking!


answering to your question:

  1. by default 30 seconds, you can modify it changing the autoLBFrequency parameter in forwarder's outputs.conf (see,
  2. all indexed logs affect license usage, it's possible to filter data before indexing (see and the filtered logs doesn't affect license.
  3. Internal Splunk logs don't affect license.


0 Karma

Splunk Employee
Splunk Employee

The log files in index=_internal do not count against your license quota. See What Splunk software logs about itself in the Troubleshooting Manual for more information about Splunk platform logging.

For all practical purposes, the forwarder works continuously. There are some attributes related to timeout intervals and load balancing that you can set in the outputs.conffile. See Configure forwarding with outputs.conf in the Forwarder Manual.


hello there,
everything that is being indexed in internal indexes, meaning indexes that starts with an "_" (underscore) will not count against your license.
everything that is on the forwarder /var/log/splunk/ will not count against your license as default monitor for it is to go to internal indexes.
forwarder will tail files and send them to splunk. if you are using "monitor" for inputs, there is no interval set. when new line is added to the monitored file, the forwarder reads it and sends it to indexer.
hope it helps

0 Karma