Installation

Are Splunk licenses based on compressed or uncompressed data?

msrkr
Explorer

We are in the process of getting Splunk licenses and just want to know whether Splunk licenses are based on compressed or uncompressed data.
Is there any place where I can look for this information?

Labels (1)

s2_splunk
Splunk Employee
Splunk Employee

How Splunk Licensing works.

Splunk Enterprise licenses specify how much data you can index per calendar day.

Note it doesn't say it specifies how much disk space your data equates to once indexed.
Compression is a network and storage optimization we do to save on transmission bandwidth and storage footprint and is unrelated to indexing volume metering.
Hopefully, this is the evidence you are looking for.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

License volume is measured before compression.

---
If this reply helps you, Karma would be appreciated.

cpetterborg
SplunkTrust
SplunkTrust

It is based on uncompressed data. If you bring in a byte of uncompressed data and it is indexed, that byte counts against your license.

I don't know where that is spelled out specifically, but that is the way it works.

0 Karma

msrkr
Explorer

Is there any place i can look for evidence.

0 Karma

MuS
SplunkTrust
SplunkTrust
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This section from http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/WhatSplunkdoeswithyourdata should be the evidence you need. It says that compression happens after indexing, which implies after license volume computation.

In the indexing pipeline, Splunk software performs additional processing, including:

Breaking all events into segments that can then be searched. You can determine the level of segmentation, which affects indexing and searching speed, search capability, and efficiency of disk compression. Building the index data structures. Writing the raw data and index files to disk, **where post-indexing compression occurs**.

[emphasis added]

---
If this reply helps you, Karma would be appreciated.
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

FYI, I have initiated a doc update to make that more explicit in the docs on how licensing works. Not the first time this question comes up.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Evidence? Do you mean verification? See this for additional comments about this:

https://answers.splunk.com/answers/481410/does-splunk-count-the-incoming-uncompressed-data-o.html

@richgalloway has also given you his answer here, which is the same. I don't know where you can find the exact explanation, except maybe in the license agreement that you sign, and I'm not sure if it is there, though I suspect it is.

0 Karma

msrkr
Explorer

Evidence that splunk license is based on uncompressed data.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...