Knowledge Management

Summary indexing impact on license volume

benstraw
Splunk Employee
Splunk Employee

Will using summary indexes impact my total indexing volume and my license?

Tags (2)
2 Solutions

matt
Splunk Employee
Splunk Employee

Yes. Summary indexes do count toward your total daily indexing volume. From a license perspective summary indexes are no different than the main index. The only indexed data that does not count towards your license are Splunk's own log files.

View solution in original post

the_wolverine
Champion

As of version 4.0.10 and 4.1, summary indexed data DOES NOT count against your license!

View solution in original post

Labbemiche
Engager

https://docs.splunk.com/Documentation/Splunk/8.2.2/Knowledge/Usesummaryindexing Does summary indexing count against your license?

Summary indexing data volume is not counted against your license, even if you have multiple summary indexes.

All summarized data has a special default source type. Events summarized in a summary events index have a source type of stash. Metric data points summarized in a summary metrics index have a source type of mcollect_stash.

If you use commands like collect or mcollect to change these source types to anything other than stash (for events) or mcollect_stash (for metric data points), you will incur license usage charges for those events or metric data points.

0 Karma

the_wolverine
Champion

As of version 4.0.10 and 4.1, summary indexed data DOES NOT count against your license!

lukejadamec
Super Champion

which is true?

Do they or do they not count against volume?

0 Karma

matt
Splunk Employee
Splunk Employee

Yes. Summary indexes do count toward your total daily indexing volume. From a license perspective summary indexes are no different than the main index. The only indexed data that does not count towards your license are Splunk's own log files.

lakromani
Builder

I downvoted this post because this is old and now wrong information

0 Karma

proletariat99
Communicator

I downvoted this post because this is plain ol' wrong.

0 Karma

jtrucks
Splunk Employee
Splunk Employee

This is no longer true.

--
Jesse Trucks
Minister of Magic

lukejadamec
Super Champion

which is true?

Do they or do they not count against volume?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...