n00b question - splunk server is only host with indexing volume according to lic report

[fgsit]

Why does the Splunk server show up as the only host indexing? We're running 3.x and our free lic is shot because it looks like Splunk is indexing itself. Is this "summary index" stuff? According to the source report, it's /opt/splunk/var/log/splunk/license_a ??

http://imgur.com/bTcPl.png

New users aren't allowed to use the image tag? Really.......

[gkanapathy]

Internal data does not count against license. Summary indexing does, but if you're running 3.x, it's unlikely that you're accidentally running summary indexes without knowing it. Possibly you have downloaded and enabled something like the Unix app on your system.

[dskillman]

in 3x summary indexing counted against your license. It's mainly an artifactof how we licensed. I woukd HIGHLY recommend upgrading to 4.x. 4.1 makes 3.x look like a chump. And summary indexing doesn't count against your license.