Populating summary index using collect command is counted for license volume?

[melonman]

Hi

I need to run a series of summary generating searches, one followed by another.
e.g.
summary search1 generates summary data from raw, and stores the summary data in summary index1
summary search2 generates summary data from summary index1, and stores the summary data in summary index2
summary search3 generates summary data from summary index2, and stores the summary data in summary index3

Normally, I could set cron schedule for search1, 2, 3 with enough time between searches.
However, it is difficult to determine how long I need to wait before starting the following searches.

And my question is
1) Can I configure a series or sequences of searches (batch search orchestration...?)
2) If I need to write a script that runs searches sequentially,
could I use collect command and still the summary index is NOT counted for daily license usage volume?

Thanks,

[somesoni2]

No it does not.

Documentation: (First par, Note section, OR just simple search for 'summary indexing')
http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Aboutlicenseviolations

Related question
http://answers.splunk.com/answers/12127/do-multiple-summary-indexes-affect-license-usage.html

[anupjishnu · Accepted solution]

I had the same exact question and what I have been told by Professional Services is that using "collect" is actually working on already indexed records and so will not be counted towards daily license usage.

[DavidHourani]

I downvoted this post because this is wrong... it depends on the sourcetype used. if the "stash" sourcetype is modified then it will count against the license