Getting Data In

Added a large file and now "Daily indexing volume limit exceeded."

charlesg
New Member

I am still on a trial of the enterprise version. I have one central splunk server and several forwarders setup.

This morning Splunk says: Daily indexing volume limit exceeded.

Can I back track and remove something?

I have one file that was added directly as a input to splunk that generated a lot of traffic. I tried sourcetype=<> | delete but it seems to struggle deleting >20M events.

Is it something I'm doing wrong?

Can I setup Splunk to prune indexed data older than X and I just missed that setting somewhere?

Thanks.

0 Karma

ftk
Motivator

Unfortunately there is no way to reverse/unindex data that caused you to violate the license. Search should still work, as should indexing -- you can violate the license a few times in any given 30 day period and still have a working system.

Even if you adjust retention times, this will not affect your indexing license. The licensing model is based on daily index volume, not total indexed volume over all time.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...