when a setup a blacklist in input.conf, will it decrease the usage of license?

[lllidan]

As I asked, if I setup a blacklist to deny some logs, does the dropped logs still occupy the license quota?

[gcusello · Accepted solution]

Hi @lllidan,
Splunk License is counted on dayly indexed logs, this means that all the logs that you don't index (e.g. filtering) aren't added to the license consuption, but they are also non useful!
Blacklisting some logs, you don't index them so you don't use license.

Ciao.
Giuseppe

[lllidan]

thanks a lot.