Knowledge Management

n00b question - splunk server is only host with indexing volume according to lic report

New Member

Why does the Splunk server show up as the only host indexing? We're running 3.x and our free lic is shot because it looks like Splunk is indexing itself. Is this "summary index" stuff? According to the source report, it's /opt/splunk/var/log/splunk/license_a ??

http://imgur.com/bTcPl.png

New users aren't allowed to use the image tag? Really.......

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Internal data does not count against license. Summary indexing does, but if you're running 3.x, it's unlikely that you're accidentally running summary indexes without knowing it. Possibly you have downloaded and enabled something like the Unix app on your system.

0 Karma

Splunk Employee
Splunk Employee

in 3x summary indexing counted against your license. It's mainly an artifactof how we licensed. I woukd HIGHLY recommend upgrading to 4.x. 4.1 makes 3.x look like a chump. And summary indexing doesn't count against your license.