If we are licensed for 200 GB a day and we send 100 GB of raw data. Is it how much we send Splunk or how much we index with Splunk that counts against our daily license?
https://splunk-sizing.appspot.com/#ar=5&cf=0.16&cr=6&gbi=200&i=2&if=0.28&v=9
It is based on the amount of raw external data that the indexer ingests into its indexing pipeline, after any filtering. It is not based on the amount of compressed data that gets written to disk. Reference: https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/HowSplunklicensingworks#How_data_is_metered
By the amount you index.
It's how much you index with Splunk per day.
By sending, I'm assuming you are sending data to nullQueue?
