Splunk Enterprise

How is indexing daily amount configured?

scottrunyon
Contributor

I upgraded Splunk Enterprise to 8.1.8 from 8.0.6.   I am now getting messages where 45 days are allowed over 60 days to go over the indexing limit.   Looking at the indexing, the largest amount are from internal Splunk.  I have a single instance. 

The first three indexes are internal Splunk

scottrunyon_0-1643204935918.png

The largest source is the Splunk Metrics log

scottrunyon_1-1643205121484.png

And lastly, the sourcetypes splunk_metrics_log and splunkd are a major portion of indexed data

scottrunyon_2-1643205251691.png

My question is, why is the internal Splunk processes counting towards my indexing?    

Regards,

Scott Runyon

 

 

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

it shouldn't count toward your license.

What you see with this url (change localhost if needed) "http://localhost:8000/en-US/manager/search/licenseusage"

r. Ismo

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...