How does reindexing data count against the license?

[mdzaman]

Does the licensing usage calculation take into account (a) the date the indexed data is from or (b) the date when the data is indexed?

I need to delete some data from the past year and reindex it. If I delete that data and re-index it, does the data count against the license for those past dates or for the current date?

If they're attributed to the day on which it's indexed, what are the consequences of going 100x over my license limit on one day as the result of re-indexing?

[lloydknight · Accepted solution]

Hello @mdzaman,

Licensing in Splunk is very straightforward. It is still a GB per day regardless of reindexing previously deleted data.

Example:
Your License: 100GB

Say for example you're currently indexing a 90GB/day today then you decided to re-index your previously deleted indexed data, the reindexed data will add up to your current 90GB/day license utilization.

If you're currently using Splunk Enterprise 6.5 or later, I highly suggest you contact Splunk and request for the "No-enforcement license" to remove your worries on exceeding your current license.

See link below for more details on the NEL
https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/TypesofSplunklicenses

Hope it helps!

Thanks!

[kunalmao]

The data will count against your current license , it does not matter when the data was ingested before, once you delete index and reindex it the charge will be on your current license usage. My tip (picked up in admin class) in here would be reindex all the data in one day as you will only get a warning for it and not a violation.

"One might as well be hanged for a sheep as a lamb"

Assuming you have a 1 GB license , so indexing 2 gb or indexing 100 gb will result in same violation if it is done on the same day.