Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Indexed Data
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How much data an event takes up depends on how much data is associated with the event.
You can index 500MB/day on the free and trial licence. When you exceed this limit you are given a warning that you have exeeded your limit. You can get 5 of these warnings each month. After the fifth warning Splunk will stop indexing new data for the rest of the month. You can still search in the data you already have indexed, by no new data will be indexed into splunk until you either purchase a licence or a new month comes along.
So to answer the question in your comment, yes, you can index 400MB today and 400MB tomorrow without getting a licence warning. There is no limit on the amount of data indexed into Splunk other that the size of your HDD.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How much data an event takes up depends on how much data is associated with the event.
You can index 500MB/day on the free and trial licence. When you exceed this limit you are given a warning that you have exeeded your limit. You can get 5 of these warnings each month. After the fifth warning Splunk will stop indexing new data for the rest of the month. You can still search in the data you already have indexed, by no new data will be indexed into splunk until you either purchase a licence or a new month comes along.
So to answer the question in your comment, yes, you can index 400MB today and 400MB tomorrow without getting a licence warning. There is no limit on the amount of data indexed into Splunk other that the size of your HDD.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks for the info rje.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The License usage states that 500MB/perDay so can i index 400MB of data today & 400MB of Data tomorrow.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...
The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise
Data Management Digest – September 2026
