Archive
Highlighted

the 500MB/day indexing volume of the free splunk

New Member

Hi,

Let's suppose that my free splunk server will receive more that 500MB/day of syslog messages (through the TCP data input). What will happen with the data exceeding the 500MB/day ?

Thanks,

-- Cosmih

Tags (2)
0 Karma
Highlighted

Re: the 500MB/day indexing volume of the free splunk

Splunk Employee
Splunk Employee

If you exceed your free license 4 times in a 20 day rolling window, your instance will continue to index, but you will not be able to search your data until you change your license.