On my 4.0.9 instance, I keep getting notifications that I have exceeded the license volume. The only indexing I'm doing on this instance is summary indexing, and that doesn't count towards the volume, right?
When I search for the top sources for my search head, it only includes _internal and summary index data.
Summary indexing IS NOT free in the 4.0.9 & earlier versions. This changed in the latest releases, so for 4.0.10, 4.1.x and later, it IS free.
The _internal index is not counted towards your overall volume
If you have a search-head pre 4.0.10, and you want to run summary index searches on it, you will need an Enterprise license. For 4.0.10 and later, you can use the forwarder license in $SPLUNK_HOME/etc
We need some updating of documentation: http://www.splunk.com/base/Documentation/4.0.10/ReleaseNotes/4.0.10
As of Splunk version 4.0.10, summary index searches do not count towards your indexed data volume. (SPL-29515)
Thanks, I've edited the original answer, I didn't realize this had recently been applied to the 4.0.x code branch.
On 4.2, the forwarder license can not be used for a search head, so the search head has to be hooked up to your license master.
It will then show any license violations that the license master shows (annoyingly.)