Getting Data In

Best way to load archived applcation log files without exceeding license?

neilli
Engager

Our daily license is 15GB we use about 10GB on average.
However I want to load our archived application log files which is probably 300gb. I have been doing about 10gb a day but this exceeds our license and if we get 5 violations in 30 days it will lock us out (as far as I know)

How best should I load the archived data?
Should I ask for a temporary increased limit?
Do as much as I can in one day and repeat for 4 days? (I can probably load 50 GB in a day) Blowing well past the limit each day.
Or split the loads so that I only load 4-5 GB a day and try to stay under the license

0 Karma

adonio
Ultra Champion

hello there,

index it all at once on a single day.
you will have a single violation ... if you exceed your limit, ask for a reset key

hope it helps

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...