Does Splunk keep indexing ingestion after exceeding the limit?

[kristen]

By 7pm, I checked the daily quota usage, that it has already reached ~115% usage of the quota, and then over last 30 days, almost every day we use 140% of the Splunk license limit.

However, logs ingesting in the period of 8pm-00am are still being seen. It does not seem to discard the logs after it exceeds. What is the harm if the indexing ingestion limit reaches?

[gcusello · Accepted solution]

Hi @kristen,

if you're exceeding the limit but you aren't in violation, you can continue to ingest logs and to search them.

If you exceed the limit and you're in violation (it's highlighted to you in the system messages) the log indexing continues, but you can run only searches on the _internal index, and all the other searches are blocked until you upload an unblock code, supplied by Splunk Support.

Violation is when you exceed the limit more than 45 times in 60 solar days.

You can find more infos at https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Aboutlicenseviolations

Ciao.

Giuseppe