Knowledge Management

n00b question - splunk server is only host with indexing volume according to lic report

fgsit
New Member

Why does the Splunk server show up as the only host indexing? We're running 3.x and our free lic is shot because it looks like Splunk is indexing itself. Is this "summary index" stuff? According to the source report, it's /opt/splunk/var/log/splunk/license_a ??

http://imgur.com/bTcPl.png

New users aren't allowed to use the image tag? Really.......

Tags (2)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Internal data does not count against license. Summary indexing does, but if you're running 3.x, it's unlikely that you're accidentally running summary indexes without knowing it. Possibly you have downloaded and enabled something like the Unix app on your system.

0 Karma

dskillman
Splunk Employee
Splunk Employee

in 3x summary indexing counted against your license. It's mainly an artifactof how we licensed. I woukd HIGHLY recommend upgrading to 4.x. 4.1 makes 3.x look like a chump. And summary indexing doesn't count against your license.

Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...