Knowledge Management

Populating summary index using collect command is counted for license volume?

melonman
Motivator

Hi

I need to run a series of summary generating searches, one followed by another.
e.g.
summary search1 generates summary data from raw, and stores the summary data in summary index1
summary search2 generates summary data from summary index1, and stores the summary data in summary index2
summary search3 generates summary data from summary index2, and stores the summary data in summary index3

Normally, I could set cron schedule for search1, 2, 3 with enough time between searches.
However, it is difficult to determine how long I need to wait before starting the following searches.

And my question is
1) Can I configure a series or sequences of searches (batch search orchestration...?)
2) If I need to write a script that runs searches sequentially,
could I use collect command and still the summary index is NOT counted for daily license usage volume?

Thanks,

Tags (2)
0 Karma
1 Solution

anupjishnu
Path Finder

I had the same exact question and what I have been told by Professional Services is that using "collect" is actually working on already indexed records and so will not be counted towards daily license usage.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

No it does not.

Documentation: (First par, Note section, OR just simple search for 'summary indexing')
http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Aboutlicenseviolations

Related question
http://answers.splunk.com/answers/12127/do-multiple-summary-indexes-affect-license-usage.html

0 Karma

anupjishnu
Path Finder

I had the same exact question and what I have been told by Professional Services is that using "collect" is actually working on already indexed records and so will not be counted towards daily license usage.

DavidHourani
Super Champion

I downvoted this post because this is wrong... it depends on the sourcetype used. if the "stash" sourcetype is modified then it will count against the license

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...