Summary indexing impact on license volume

[benstraw]

Will using summary indexes impact my total indexing volume and my license?

[matt · Accepted solution]

Yes. Summary indexes do count toward your total daily indexing volume. From a license perspective summary indexes are no different than the main index. The only indexed data that does not count towards your license are Splunk's own log files.

[Labbemiche]

https://docs.splunk.com/Documentation/Splunk/8.2.2/Knowledge/Usesummaryindexing Does summary indexing count against your license?

Summary indexing data volume is not counted against your license, even if you have multiple summary indexes.

All summarized data has a special default source type. Events summarized in a summary events index have a source type of stash. Metric data points summarized in a summary metrics index have a source type of mcollect_stash.

If you use commands like collect or mcollect to change these source types to anything other than stash (for events) or mcollect_stash (for metric data points), you will incur license usage charges for those events or metric data points.

[the_wolverine · Accepted solution]

As of version 4.0.10 and 4.1, summary indexed data DOES NOT count against your license!

[lukejadamec]

which is true?

Do they or do they not count against volume?

[matt · Accepted solution]

Yes. Summary indexes do count toward your total daily indexing volume. From a license perspective summary indexes are no different than the main index. The only indexed data that does not count towards your license are Splunk's own log files.

[lakromani]

I downvoted this post because this is old and now wrong information

[proletariat99]

I downvoted this post because this is plain ol' wrong.

[jtrucks]

This is no longer true.

[lukejadamec]

which is true?

Do they or do they not count against volume?