Installation

Indexed data and Licensing

andrey2007
Contributor

For example i have 15 GB archive of log files, if my license for 1Gb per day, may i index my archive and work with it in Splunk? For examle, i will index 1 GB every day during 15 days, then i want to work with my indexed data which volume is 15 GB, can i do this?

Tags (1)
0 Karma

Ayn
Legend

Oh certainly. The license limit is definitely not on the total amount of data in the index, the limit is on how much you are allowed per day.

Additionally you could even put all the 15GB of logs into Splunk on day 1 - you will get a license violation warning, but as long as you have less than 5 warnings in a rolling 30-day period you'll be fine (see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutlicenseviolations ).

Ayn
Legend

No problem. Could you please mark my answer as accepted? Thanks!

0 Karma

andrey2007
Contributor

Thank you.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...