I know that since 4.1 summary indexing does not count against license anymore. However, what if I have multiple summary indexes?
According to this answer, I'd say more indexes would not affect the license, but just looked for a confirmation...
E.g.
The last two sum-indexes would reside on a dedicate job server (with forwarding license).
Would this configuration affect license usage?
Thanks
Adding more summary indexes will not affect license usage. No summary indexed data will count against the license.
Adding more summary indexes will not affect license usage. No summary indexed data will count against the license.
Thanks Stephen,
Paolo
Wrong! If you overwrite the original sourcetype created by "|collect " (stash) it will count towards your licence.
Can Splunk please clarify? Is it true that, if sourcetype is changed to anything other than "stash", summary indexed data would count against license usage?