Splunk server index over usage

[jbthomas1975]

Is it standard for the Splunk server itself to be over 50% of the daily indexing total? In our production environment, we are starting run over the daily and simply because of the splunk server itself. I understand its what does the heavy lifting, but its hard to base how much licensing you may need when you dont know how to gauge what the server will utilize

[VatsalJagani]

@jbthomas1975 - Are you looking at the license usage by host??

How much is the usage by Splunk servers in GB?

[tscroggins]

Hi @jbthomas1975,

What are you collecting from your Splunk host?

Internal indexes--_audit, _internal, _introspection, _metrics, etc.--don't count against ingest-based licensing but do factor into capacity planning.