Stop usage when it reaches 500MB

[anil1575]

I have free license splunk.
Licensed daily volume 500 MB- How do I stop usage when it reaches 500MB?,

Is there a way to stop indexing when it reaches 500 MB?

[MuS]

Hi anil1575,

No, there is no such feature in Splunk. It will continue to index, but it will get you a license violation http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Aboutlicenseviolations

There could be a way to stop Splunk at all if it reaches near the 500Mb limit....create a script that pulls the license info over REST and stop the service/process....but then Splunk is stopped completely and you would not be able to search any more.

Like the docs states http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Aboutlicenseviolations#How_to_avoid_license_... , if you're reaching your license limit try reducing the volume sent or get yourself a bigger license.

cheers, MuS