Regarding requirement when splunk free license

[05500]

Q1, I know it is indexed MAX 500MB per 1 day when using splunk free license.
In this case, regargding limit, it indicates an indexed data, NOT imported data from each servers?

Q2, In the Q1, if imported data was exceeded over 500MB and indexed data is less 500MB,
Can I use Splunk free license forever? In that case, how can I filter data when I index data?

Regarding security logs for Windows, there are many logs.
I want to import all logs from each servers to Splunk server but I don't want to index only failure logs without success logs.
In this case, can I filter?

[gyslainlatsa]

hi,
following this link:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/TypesofSplunklicenses#Free_license

[Arun_N_007]

Hi,

Q1 - How will you import data from other servers? Data is already indexed?

You cant store data in Splunk server without indexing.

You can filter success logs while forwarding and indexing the data using props and transforms.