Getting Data In

Multiple indexes and license limits

steve
Path Finder

Does data indexed in two separate indexes count twice against the license limit?

Tags (2)
0 Karma
1 Solution

gekoner
Communicator

Sorta. All data being indexed, no matter which Index it goes into is being counted toward your license. EXCEPT data you put into summary indexes, and also all events going into the internal indexes are NOT counted towards your license.(Kristian Kolb)
If you are indexing the same data twice. I.e. if the same data is going to Index1 and Index2, then ALL data is counted against your license. So in that sense your data is counted twice.

see this doc - 1http://docs.splunk.com/Documentation/Splunk/4.3/Admin/HowSplunklicensingworks
Specifically, “Splunk licenses specify how much data you can index per calendar day…”

I'd recommend you download and install the Deployment Monitor App. This will really help you get an idea of what data you are indexing, and from where, and how it is being counted against your license.
1http://docs.splunk.com/Documentation/Splunk/latest/Admin/Manageyourlicenses

View solution in original post

kristian_kolb
Ultra Champion

gekoner is right, but you should know that stuff you put into summary indexes, and also all events going into the internal indexes are NOT counted towards your license.

/k

gekoner
Communicator

Sorta. All data being indexed, no matter which Index it goes into is being counted toward your license. EXCEPT data you put into summary indexes, and also all events going into the internal indexes are NOT counted towards your license.(Kristian Kolb)
If you are indexing the same data twice. I.e. if the same data is going to Index1 and Index2, then ALL data is counted against your license. So in that sense your data is counted twice.

see this doc - 1http://docs.splunk.com/Documentation/Splunk/4.3/Admin/HowSplunklicensingworks
Specifically, “Splunk licenses specify how much data you can index per calendar day…”

I'd recommend you download and install the Deployment Monitor App. This will really help you get an idea of what data you are indexing, and from where, and how it is being counted against your license.
1http://docs.splunk.com/Documentation/Splunk/latest/Admin/Manageyourlicenses

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Developer Spotlight with Eduard Lekanne

From Network Engineer to Building Agentic AI for Splunk Eduard Lekanne has been architecting technology ...

From Data Landing to Insight

Search Across More of Your Data Ecosystem The data you need may live in Splunk, high-volume machine data, ...

Mastering Threat Intelligence in ES 8.5, Splunk AI Assistant v2, and More from Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...