splunk cloud kv_mode=json vs indexed_extractions=json license usage

[nordinethales]

Hello,

I would like to know if there is a consumption gap between this 2 indexation mode in the splunk cloud license usage. I mean, which one will cost the most, with structured log(json).
What I understand:

indexed_extractions=json ==> fields are extracted at index time and could increase the size of tsidx and so license usage and cost

kv_mode=json ==> fields extracted at search time, and should not impact license usage.

Am I correct?
Thanks for your confirmation

Regards

Nordine

[PickleRick]

As far as I remember, the license consumption for Cloud in the ingest-based option is the same as on-prem one which means the event is measured by its _raw part just prior to indexing. This means that:

1) However you modify your event prior to indexing it in terms of the raw event contents (like cutting out some headers or unnecessary trailing parts) will affect your license usage

2) Indexed fields which are saved in the tsidx files but are not "exploding" your _raw event contents do not affect your license usage.

Having said that - indexed extractions are very rarely the way to go but not for license-related reasons.

[livehybrid · Accepted solution]

Hi @nordinethales

Splunk Cloud ingestion (assuming you have an ingest based license, not SVC license) is based on the raw uncompressed data size ingested, rather than indexed fields, apart from metrics which are each counted as 150 bytes.

For storage this is also based on the uncompressed raw ingest. 

For more info check out https://help.splunk.com/en/splunk-cloud-platform/get-started/service-terms-and-policies/9.3.2411/inf...

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Prewin27]

@nordinethales 

You are correct, there might be significant difference in Splunk Cloud license usage between INDEXED_EXTRACTIONS=json and KV_MODE=json

INDEXED_EXTRACTIONS=json - Fields are extracted at index time and stored, which increases the size and license usage
KV_MODE=json - Fields are only extracted at search time, so license usage is based on the raw data size.

Also you can refer this #https://splunk.github.io/splunk-add-on-for-crowdstrike-fdr/fieldextractions/

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!