Enforce indexing quota/limit by Host?

[NK_1]

Is there a way to configure Splunk to enforce indexing quoatas by Host? e.g. Do not index more than 250MB per day for Host X. Do not index more than 100MB per day for Host Y. etc.

Helps prevent quota overuse by non-critical systems.

[jbsplunk]

You can set up license pools that will alert you if a pool goes over its allocated quota, that way you can check your volume to see where the added data is coming from with some idea about the source of the events. However, it is not going to stop indexing from that particular pool. As gkanapathy pointed out, that functionality does not exist.

[NK_1]

I hear that in v4.2 and later, there is the notion of License Pooling... allows a Corporation with a 100GB indexing quota/license/limit to sub-divide that and maybe assign a 10GB quota to the QA Department, so that Production hosts logging is not affected if QA goes wild with indexing and exhausts their quota?

[gkanapathy · Accepted solution]

No there is not currently such functionality.