Splunk free license, maximum sizes per day of data

[royimad]

i need to know is if i'm sending 10 MB file to splunk instance free license from a universal forwarder and splunk only index the changes in that logs ( the delta changes ) would it count the total size of the logs as computed or just the changes in that logs?

[kristian_kolb · Accepted solution]

The normal behaviour is that the forwarder keeps track of the file and sends only 'new' events onwards to the indexer. (pretty much like 'tail' in nix)

http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories

/k