Knowledge Management

Summary indexes licensing usage: Is it counted against the license?

klim
Path Finder

I see in the docs splunk doc that summary indexing does not count against your license. It also says that summary indexes are built via transforming searches over event data. 

If I use a scheduled report that does not use a transforming command and saves the data to an index will that count against the license? Ie I want to extract a subset of data from the main index and save certain fields to a new index so that a role doesn't have access to all the data.

Labels (1)
Tags (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Quoting from the docs:

All summarized data has a special default source type. Events summarized in a summary events index have a source type of stash. Metric data points summarized in a summary metrics index have a source type of mcollect_stash.

If you use commands like collect or mcollect to change these source types to anything other than stash (for events) or mcollect_stash (for metric data points), you will incur license usage charges for those events or metric data points

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...