Installation

How does reindexing data count against the license?

mdzaman
Explorer

Does the licensing usage calculation take into account (a) the date the indexed data is from or (b) the date when the data is indexed?

I need to delete some data from the past year and reindex it. If I delete that data and re-index it, does the data count against the license for those past dates or for the current date?

If they're attributed to the day on which it's indexed, what are the consequences of going 100x over my license limit on one day as the result of re-indexing?

Labels (1)
0 Karma
1 Solution

lloydknight
Builder

Hello @mdzaman,

Licensing in Splunk is very straightforward. It is still a GB per day regardless of reindexing previously deleted data.

Example:
Your License: 100GB

Say for example you're currently indexing a 90GB/day today then you decided to re-index your previously deleted indexed data, the reindexed data will add up to your current 90GB/day license utilization.

If you're currently using Splunk Enterprise 6.5 or later, I highly suggest you contact Splunk and request for the "No-enforcement license" to remove your worries on exceeding your current license.

See link below for more details on the NEL
https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/TypesofSplunklicenses

Hope it helps!

Thanks!

View solution in original post

lloydknight
Builder

Hello @mdzaman,

Licensing in Splunk is very straightforward. It is still a GB per day regardless of reindexing previously deleted data.

Example:
Your License: 100GB

Say for example you're currently indexing a 90GB/day today then you decided to re-index your previously deleted indexed data, the reindexed data will add up to your current 90GB/day license utilization.

If you're currently using Splunk Enterprise 6.5 or later, I highly suggest you contact Splunk and request for the "No-enforcement license" to remove your worries on exceeding your current license.

See link below for more details on the NEL
https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/TypesofSplunklicenses

Hope it helps!

Thanks!

kunalmao
Communicator

The data will count against your current license , it does not matter when the data was ingested before, once you delete index and reindex it the charge will be on your current license usage. My tip (picked up in admin class) in here would be reindex all the data in one day as you will only get a warning for it and not a violation.

"One might as well be hanged for a sheep as a lamb"

Assuming you have a 1 GB license , so indexing 2 gb or indexing 100 gb will result in same violation if it is done on the same day.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...