Getting Data In

Enforce indexing quota/limit by Host?

Path Finder

Is there a way to configure Splunk to enforce indexing quoatas by Host? e.g. Do not index more than 250MB per day for Host X. Do not index more than 100MB per day for Host Y. etc.

Helps prevent quota overuse by non-critical systems.

Tags (3)
1 Solution

Splunk Employee
Splunk Employee

No there is not currently such functionality.

View solution in original post

Splunk Employee
Splunk Employee

You can set up license pools that will alert you if a pool goes over its allocated quota, that way you can check your volume to see where the added data is coming from with some idea about the source of the events. However, it is not going to stop indexing from that particular pool. As gkanapathy pointed out, that functionality does not exist.

Path Finder

I hear that in v4.2 and later, there is the notion of License Pooling... allows a Corporation with a 100GB indexing quota/license/limit to sub-divide that and maybe assign a 10GB quota to the QA Department, so that Production hosts logging is not affected if QA goes wild with indexing and exhausts their quota?

Splunk Employee
Splunk Employee

No there is not currently such functionality.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!