Getting Data In

Is it normal behavior for JSON labels, not just actual key/value data, to be counted against license usage and how to prevent this?

albertohontoria
Path Finder

Hi friends

I have a question. I have an app that formats output as json and sends it to Splunk. Real data of each event is 512Bytes only, but I have detected that Splunks counts all event data, even json labels for license usage.

Real data is approximately 1 GB/day, but with json labels, it's consuming 15GB/day and exceeding license usage.

Is this a normal behavior? Is there a way to solve it and not consume so much of our license daily?

Regards

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Splunk counts the size of an event, regardless of its content... so yeah, this is expected behaviour. There is no notion of "real data" contained within the events, all data is treated equally for licensing purposes.

If feasible without impeding usability, you could shorten your JSON labels. However, self-describing data will always be larger than data with an implicit structure. It's a tradeoff between size and ease of use.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Splunk counts the size of an event, regardless of its content... so yeah, this is expected behaviour. There is no notion of "real data" contained within the events, all data is treated equally for licensing purposes.

If feasible without impeding usability, you could shorten your JSON labels. However, self-describing data will always be larger than data with an implicit structure. It's a tradeoff between size and ease of use.

martin_mueller
SplunkTrust
SplunkTrust

Example of what?

0 Karma

albertohontoria
Path Finder

Unfortunately there is no way in the App to shorten JSON labels. I'll try to send the data as raw data with static structure instead of json, and format it in splunk.

If you have any example it can help me a lot

Regards and thanks for the reponse

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...