squash_threshold = <positive integer>
* Periodically the indexer must report to license manager
the data indexed broken down by source, sourcetype, host, and index. If
the number of distinct (source, sourcetype, host, index) tuples grows over
the 'squash_threshold', the (host, source) values are squashed and only a
breakdown by (sourcetype, index) is reported. This is to prevent explosions in
memory + license_usage.log lines.
* This is an advanced setting. Set it only after consulting a Splunk
Support engineer.
* This needs to be set on license peers as well as the license
manager.
* Default: 2000
* If this helps, please upvote or accept solution if it solved *
