Getting Data In

Regarding requirement when splunk free license

New Member

Q1, I know it is indexed MAX 500MB per 1 day when using splunk free license.
In this case, regargding limit, it indicates an indexed data, NOT imported data from each servers?

Q2, In the Q1, if imported data was exceeded over 500MB and indexed data is less 500MB,
Can I use Splunk free license forever? In that case, how can I filter data when I index data?

Regarding security logs for Windows, there are many logs.
I want to import all logs from each servers to Splunk server but I don't want to index only failure logs without success logs.
In this case, can I filter?

0 Karma

0 Karma



Q1 - How will you import data from other servers? Data is already indexed?

You cant store data in Splunk server without indexing.

You can filter success logs while forwarding and indexing the data using props and transforms.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>