What is the 'stash' sourcetype for in the PCI Application

[jambajuice]

I have been monitoring our license consumption and the 'stash' sourcetype is showing up consistently. I've poked around in the config files and I fount this in the inputs.conf in the default folder of the SplunkPCIComplianceSuite:

[udp://519] index=pci_notable sourcetype=stash

What is this sourcetype for and does it count against our license? And what would cause it to index 15 GB on any given day, particularly when we have a 5 GB license.

Thx.

Craig

[I-Man]

I believe this is the sourcetype for the Summary Indexing Function of Splunk. All of my Summary indexed data has the sourcetype stash. Splunk comes with some reports that automatically populate into the Summary Index. Additionally, from what people say on this forum, Summary Indexed data does not count against your license usage.

http://answers.splunk.com/questions/214/summary-indexing-impact-on-license-volume