Does Splunk count Threat feeds towards the data usage? For example: if I download 1G of threat feed data every day, will I blow my data feed budget?
Splunk counts anything that is indexed. If you are referencing downloaded threat data for Splunk Enterprise Security, that goes into KVstore and lookup tables which is not an index so it is not a license usage thing.
