Getting Data In

Multiple indexes and license limits

steve
Path Finder

Does data indexed in two separate indexes count twice against the license limit?

Tags (2)
0 Karma
1 Solution

gekoner
Communicator

Sorta. All data being indexed, no matter which Index it goes into is being counted toward your license. EXCEPT data you put into summary indexes, and also all events going into the internal indexes are NOT counted towards your license.(Kristian Kolb)
If you are indexing the same data twice. I.e. if the same data is going to Index1 and Index2, then ALL data is counted against your license. So in that sense your data is counted twice.

see this doc - 1http://docs.splunk.com/Documentation/Splunk/4.3/Admin/HowSplunklicensingworks
Specifically, “Splunk licenses specify how much data you can index per calendar day…”

I'd recommend you download and install the Deployment Monitor App. This will really help you get an idea of what data you are indexing, and from where, and how it is being counted against your license.
1http://docs.splunk.com/Documentation/Splunk/latest/Admin/Manageyourlicenses

View solution in original post

kristian_kolb
Ultra Champion

gekoner is right, but you should know that stuff you put into summary indexes, and also all events going into the internal indexes are NOT counted towards your license.

/k

gekoner
Communicator

Sorta. All data being indexed, no matter which Index it goes into is being counted toward your license. EXCEPT data you put into summary indexes, and also all events going into the internal indexes are NOT counted towards your license.(Kristian Kolb)
If you are indexing the same data twice. I.e. if the same data is going to Index1 and Index2, then ALL data is counted against your license. So in that sense your data is counted twice.

see this doc - 1http://docs.splunk.com/Documentation/Splunk/4.3/Admin/HowSplunklicensingworks
Specifically, “Splunk licenses specify how much data you can index per calendar day…”

I'd recommend you download and install the Deployment Monitor App. This will really help you get an idea of what data you are indexing, and from where, and how it is being counted against your license.
1http://docs.splunk.com/Documentation/Splunk/latest/Admin/Manageyourlicenses

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...

Ditch the Manual Grind: Building AI Agents with Splunk

Ditch the Manual Grind: Building AI Agents with Splunk Let’s be real: your team’s time is being eaten alive. ...

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...