Getting Data In

Limit indexing per device a day

neelamssantosh
Contributor

Is there any configuration to customise the data consumption per device per day.
Eg: 5devices sending logs to 1Indexer, restrict 5GB per device/day

Tags (3)
0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

The only way to stop collecting data from a monitor stanza is to change the inputs.conf and then restart Splunk. You don't want to have to do that on your indexer... But you could bounce a heavy forwarder frequently without loss of data. A heavy forwarder used as a relay, or more specifically... an instance of Splunk built to accept inputs, forward the data to your main indexer, monitor the volume and trigger an alert on your device quotas - where the result of the alert is a script that edits the stanza in inputs.conf changing disabled=true to disabled=false and then causes Splunk to restart.

This isn't an ideal set up (forcibly restarting anything with frequency), which is why if you explain your needs, neelamssantosh, we can perhaps come up with something more clear for you.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

NOUMSSI
Builder

Hi,

Each version of splunk comes with his own license and each license has define data volume consumption per device per day. You can't modified this file to increase the define volume.

The only ways to increase this volume are whether you buy a new license or you add more licences on the existing license,Hi,

Each version of splunk has his own license and each license has a define data volume consumption per device per day. You can't encrease this volume but you can decrease it. The only ways to encrease it are whether you buy another license or you add new licenses.

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

It's possible... but not practical as the indexed volume size is governed per index and not per device (source). So there is no magic setting unfortunately. Before I lay it all out, it would be helpful if you explained why you're trying to do this... can you elaborate on the reason you want to cut off devices? what kind of devices are you talking about?

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...