Limit indexing per device a day

[neelamssantosh]

Is there any configuration to customise the data consumption per device per day.
Eg: 5devices sending logs to 1Indexer, restrict 5GB per device/day

[rsennett_splunk]

The only way to stop collecting data from a monitor stanza is to change the inputs.conf and then restart Splunk. You don't want to have to do that on your indexer... But you could bounce a heavy forwarder frequently without loss of data. A heavy forwarder used as a relay, or more specifically... an instance of Splunk built to accept inputs, forward the data to your main indexer, monitor the volume and trigger an alert on your device quotas - where the result of the alert is a script that edits the stanza in inputs.conf changing disabled=true to disabled=false and then causes Splunk to restart.

This isn't an ideal set up (forcibly restarting anything with frequency), which is why if you explain your needs, neelamssantosh, we can perhaps come up with something more clear for you.

[NOUMSSI]

Hi,

Each version of splunk comes with his own license and each license has define data volume consumption per device per day. You can't modified this file to increase the define volume.

The only ways to increase this volume are whether you buy a new license or you add more licences on the existing license,Hi,

Each version of splunk has his own license and each license has a define data volume consumption per device per day. You can't encrease this volume but you can decrease it. The only ways to encrease it are whether you buy another license or you add new licenses.

[rsennett_splunk]

It's possible... but not practical as the indexed volume size is governed per index and not per device (source). So there is no magic setting unfortunately. Before I lay it all out, it would be helpful if you explained why you're trying to do this... can you elaborate on the reason you want to cut off devices? what kind of devices are you talking about?