Are Splunk licenses based on compressed or uncompressed data?

[msrkr]

We are in the process of getting Splunk licenses and just want to know whether Splunk licenses are based on compressed or uncompressed data.
Is there any place where I can look for this information?

[s2_splunk]

How Splunk Licensing works.

Splunk Enterprise licenses specify how much data you can index per calendar day.

Note it doesn't say it specifies how much disk space your data equates to once indexed.
Compression is a network and storage optimization we do to save on transmission bandwidth and storage footprint and is unrelated to indexing volume metering.
Hopefully, this is the evidence you are looking for.

[richgalloway]

License volume is measured before compression.

[cpetterborg]

It is based on uncompressed data. If you bring in a byte of uncompressed data and it is indexed, that byte counts against your license.

I don't know where that is spelled out specifically, but that is the way it works.

[msrkr]

Is there any place i can look for evidence.

[mattymo]

https://www.splunk.com/en_us/products/pricing.html?utm_expid=.OPF1ZinsTb2yA-taml2MNw.0&utm_referrer=...

[MuS]

How about the docs page http://docs.splunk.com/Documentation/Splunk/latest/Admin/HowSplunklicensingworks on licensing

cheers, MuS

[richgalloway]

This section from http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/WhatSplunkdoeswithyourdata should be the evidence you need. It says that compression happens after indexing, which implies after license volume computation.

In the indexing pipeline, Splunk software performs additional processing, including:

Breaking all events into segments that can then be searched. You can determine the level of segmentation, which affects indexing and searching speed, search capability, and efficiency of disk compression. Building the index data structures. Writing the raw data and index files to disk, **where post-indexing compression occurs**.

[emphasis added]

[s2_splunk]

FYI, I have initiated a doc update to make that more explicit in the docs on how licensing works. Not the first time this question comes up.

[cpetterborg]

Evidence? Do you mean verification? See this for additional comments about this:

https://answers.splunk.com/answers/481410/does-splunk-count-the-incoming-uncompressed-data-o.html

@richgalloway has also given you his answer here, which is the same. I don't know where you can find the exact explanation, except maybe in the license agreement that you sign, and I'm not sure if it is there, though I suspect it is.

[msrkr]

Evidence that splunk license is based on uncompressed data.