the 500MB/day indexing volume of the free splunk

New Member


Let's suppose that my free splunk server will receive more that 500MB/day of syslog messages (through the TCP data input). What will happen with the data exceeding the 500MB/day ?


-- Cosmih

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

If you exceed your free license 4 times in a 20 day rolling window, your instance will continue to index, but you will not be able to search your data until you change your license.