Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Indexed Data
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How much data an event takes up depends on how much data is associated with the event.
You can index 500MB/day on the free and trial licence. When you exceed this limit you are given a warning that you have exeeded your limit. You can get 5 of these warnings each month. After the fifth warning Splunk will stop indexing new data for the rest of the month. You can still search in the data you already have indexed, by no new data will be indexed into splunk until you either purchase a licence or a new month comes along.
So to answer the question in your comment, yes, you can index 400MB today and 400MB tomorrow without getting a licence warning. There is no limit on the amount of data indexed into Splunk other that the size of your HDD.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How much data an event takes up depends on how much data is associated with the event.
You can index 500MB/day on the free and trial licence. When you exceed this limit you are given a warning that you have exeeded your limit. You can get 5 of these warnings each month. After the fifth warning Splunk will stop indexing new data for the rest of the month. You can still search in the data you already have indexed, by no new data will be indexed into splunk until you either purchase a licence or a new month comes along.
So to answer the question in your comment, yes, you can index 400MB today and 400MB tomorrow without getting a licence warning. There is no limit on the amount of data indexed into Splunk other that the size of your HDD.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks for the info rje.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The License usage states that 500MB/perDay so can i index 400MB of data today & 400MB of Data tomorrow.
Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud
Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know
October Community Champions: A Shoutout to Our Contributors!
