How to limit the daily volume of a specific index?


I have one system which is the indexer, but there are multiple indexes (based upon projects)
Different projects have purchased licenses so I want to limit the indexes to various daily limits.
For example project A has purchased a 5Gig license and project B has purchased a 10Gig license.
I have project A data going to index X and project B data going to index Y.
Since both licenses are put into the auto_generated_pool_enterprise there is 15Gig volume allowed.
I want to limit project A (index X) to 5Gig per day and project B (index Y) to 10Gig per day.

If Project A (index X) gets more than 5Gig in a day, I don't want it to consume the other available license since that project didn't purchase it. I don't want to use a disk limit.

How can I limit the daily volume of a specific index?


Labels (2)


This would be useful to a lot of people I think, ie one app starts indexing abnormal volumes impacting the platform, it would be useful to be able to cap volumes per index to avoid the platform not indexing further data for other apps.

0 Karma


No, you cannot. Same answer given by MarioM

0 Karma

Path Finder

Even i am searching for the exact scenario to restrict the index by volume did some one find a way to do this

0 Karma


you cannot...license and license pooling are per indexer not per indexes.

The only option is to split your project per indexer.

New Member

is this still the case ? I see this response as of Sep 2012 and Iam using 6.1 fo rnow and ready to upgrade to 6.2 and am in the wsame exact scenario the original poster has raised.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...