- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I know that since 4.1 summary indexing does not count against license anymore. However, what if I have multiple summary indexes?
According to this answer, I'd say more indexes would not affect the license, but just looked for a confirmation...
E.g.
- summary -> the defauls summary index, residing on the search head.
- summary1h -> stores results of scheduled aggregations having resolution of 1 hour, data kept for 1 month
- summary1d -> stores results of scheduled aggregations having resolution of 1 day, data kept for 3 months
The last two sum-indexes would reside on a dedicate job server (with forwarding license).
Would this configuration affect license usage?
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Adding more summary indexes will not affect license usage. No summary indexed data will count against the license.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Adding more summary indexes will not affect license usage. No summary indexed data will count against the license.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Thanks Stephen,
Paolo
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Wrong! If you overwrite the original sourcetype created by "|collect " (stash) it will count towards your licence.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Can Splunk please clarify? Is it true that, if sourcetype is changed to anything other than "stash", summary indexed data would count against license usage?
