Setup Index limit on daily basis

[anirudhk]

Hi,

Is there any way to setup a limit on index on a daily basis. We have a few projects and associated index for each project and would like to restrict the index intake based on the projects/index.

Thanks
Anirudh

[jbsplunk]

You could set up a license master with a pool, putting the indexers which index data for project x into pool x. This would mean a license violation is incurred for the pool which sends more data than is allowed. As lukejadamec points out, you don't want to stop indexing data because that's really just kicking the can down the road. Once you start indexing data again, you're going to index all of that data you'd missed until that point and the current data.

[lukejadamec]

No. I've never seen a setting that tell Splunk to stop indexing data based on volume. This is probably because of the way Splunk monitors logs: If Splunk were to stop indexing at some time during the day, the logs would continue to populate regardless, so on the next day Splunk would just start where it left off.