Installation

How does reindexing data count against the license?

mdzaman
Explorer

Does the licensing usage calculation take into account (a) the date the indexed data is from or (b) the date when the data is indexed?

I need to delete some data from the past year and reindex it. If I delete that data and re-index it, does the data count against the license for those past dates or for the current date?

If they're attributed to the day on which it's indexed, what are the consequences of going 100x over my license limit on one day as the result of re-indexing?

Labels (1)
0 Karma
1 Solution

lloydknight
Builder

Hello @mdzaman,

Licensing in Splunk is very straightforward. It is still a GB per day regardless of reindexing previously deleted data.

Example:
Your License: 100GB

Say for example you're currently indexing a 90GB/day today then you decided to re-index your previously deleted indexed data, the reindexed data will add up to your current 90GB/day license utilization.

If you're currently using Splunk Enterprise 6.5 or later, I highly suggest you contact Splunk and request for the "No-enforcement license" to remove your worries on exceeding your current license.

See link below for more details on the NEL
https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/TypesofSplunklicenses

Hope it helps!

Thanks!

View solution in original post

lloydknight
Builder

Hello @mdzaman,

Licensing in Splunk is very straightforward. It is still a GB per day regardless of reindexing previously deleted data.

Example:
Your License: 100GB

Say for example you're currently indexing a 90GB/day today then you decided to re-index your previously deleted indexed data, the reindexed data will add up to your current 90GB/day license utilization.

If you're currently using Splunk Enterprise 6.5 or later, I highly suggest you contact Splunk and request for the "No-enforcement license" to remove your worries on exceeding your current license.

See link below for more details on the NEL
https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/TypesofSplunklicenses

Hope it helps!

Thanks!

View solution in original post

kunalmao
Communicator

The data will count against your current license , it does not matter when the data was ingested before, once you delete index and reindex it the charge will be on your current license usage. My tip (picked up in admin class) in here would be reindex all the data in one day as you will only get a warning for it and not a violation.

"One might as well be hanged for a sheep as a lamb"

Assuming you have a 1 GB license , so indexing 2 gb or indexing 100 gb will result in same violation if it is done on the same day.

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!