Indexed data and Licensing

[andrey2007]

For example i have 15 GB archive of log files, if my license for 1Gb per day, may i index my archive and work with it in Splunk? For examle, i will index 1 GB every day during 15 days, then i want to work with my indexed data which volume is 15 GB, can i do this?

[Ayn]

Oh certainly. The license limit is definitely not on the total amount of data in the index, the limit is on how much you are allowed per day.

Additionally you could even put all the 15GB of logs into Splunk on day 1 - you will get a license violation warning, but as long as you have less than 5 warnings in a rolling 30-day period you'll be fine (see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutlicenseviolations ).

[Ayn]

No problem. Could you please mark my answer as accepted? Thanks!

[andrey2007]

Thank you.