Does Splunk Ingestion license count the metadata into calculation?

[kristen]

When logs arrive heavyforwarder, the forwarder may add some metadata into it based on the rule.

For example,

1. I have Syslog forwarder keeps on writing logs into the Heavy forwarder's disk space.

2. Heavyforwarder monitor logs written into various directories, e.g. [monitor:///var/log/remote/source_type_a/*.log]

3. Heavy forwarder add the source_type and host of the log, when it is indexing.

E.g. if it is forwarding the log from /var/log/remote/source_type_a/*.log, it add the sourcetype of log as source_type_a

Does these meta data also count into the indexer license limit?

[gcusello]

Hi @kristen,

no, license is countered on the raw log really indexed, not metedata.

In other words, if you filter your raw logs before indexing the filtered logs aren't countered.

Ciao.

Giuseppe