Is there a license requirement for 100GB/day data ingestion or indexing?

[rajeev_ku]

Hi,

I have a confusion about Splunk licensing, below is the concern.

I want to purchase license to digest 100GB data per day. In this case, do we need to purchase a license for 100GB or the size of compressed raw data in Splunk indexer (which is 60GB)?

Thanks
Rajeev

[sduff_splunk · Accepted solution]

The license is based on the actual volume size, that is, the amount of data being indexed, not the compressed volume.

In your situation, you would need a 100GB/day license.

[rajeev_ku]

Thanks for prompt response!

[skoelpin]

To add onto this.. I would get an additional 20% so your not maxing out the license and have some room for growth.

[rajeev_ku]

Correct, for poduction.