Is it normal behavior for JSON labels, not just actual key/value data, to be counted against license usage and how to prevent this?

[albertohontoria]

Hi friends

I have a question. I have an app that formats output as json and sends it to Splunk. Real data of each event is 512Bytes only, but I have detected that Splunks counts all event data, even json labels for license usage.

Real data is approximately 1 GB/day, but with json labels, it's consuming 15GB/day and exceeding license usage.

Is this a normal behavior? Is there a way to solve it and not consume so much of our license daily?

Regards

[martin_mueller · Accepted solution]

Splunk counts the size of an event, regardless of its content... so yeah, this is expected behaviour. There is no notion of "real data" contained within the events, all data is treated equally for licensing purposes.

If feasible without impeding usability, you could shorten your JSON labels. However, self-describing data will always be larger than data with an implicit structure. It's a tradeoff between size and ease of use.

[martin_mueller]

Example of what?

[albertohontoria]

Unfortunately there is no way in the App to shorten JSON labels. I'll try to send the data as raw data with static structure instead of json, and format it in splunk.

If you have any example it can help me a lot

Regards and thanks for the reponse