Getting Data In

Added a large file and now "Daily indexing volume limit exceeded."

charlesg
New Member

I am still on a trial of the enterprise version. I have one central splunk server and several forwarders setup.

This morning Splunk says: Daily indexing volume limit exceeded.

Can I back track and remove something?

I have one file that was added directly as a input to splunk that generated a lot of traffic. I tried sourcetype=<> | delete but it seems to struggle deleting >20M events.

Is it something I'm doing wrong?

Can I setup Splunk to prune indexed data older than X and I just missed that setting somewhere?

Thanks.

0 Karma

ftk
Motivator

Unfortunately there is no way to reverse/unindex data that caused you to violate the license. Search should still work, as should indexing -- you can violate the license a few times in any given 30 day period and still have a working system.

Even if you adjust retention times, this will not affect your indexing license. The licensing model is based on daily index volume, not total indexed volume over all time.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...