Why is my Splunk License daily volume usage count 0 MB?

[imranshs]

My doubt is that I can see,My Volume used today = 0 MB ( 0%  of quota ). Why It's showing as 0 MB, I tried many queries using search head and still not increasing the daily volume count.

Indexer name	splunk
License expiration	24 Dec 2022, 19:55:17
Licensed daily volume	500 MB
Volume used today	0 MB (0% of quota)

My understanding is that When I run any search query and it will fetch the data from the indexer, Which will be added to the Volume used data count. Could you please help me more as seems I am missing something here?

Really sorry for this basic question as I am unable to get any help over the internet/Splunk documenation on this part.

[imranshs]

Thanks for the reply I was confused because I learned that, we should keep the search head time limit should be as low as possible otherwise it will fetch more data from the indexer against your queries and as a result will consume your daily data limit and when if you breach for 3 times in 30 days then your license will be terminated..

[richgalloway]

You were misinformed.  You can fetch data from your indexers as much as you like.  Fetching less performs better, but there is no limit. 

Your license limit applies to data sent *in* to the indexers. 

Breaching your license will not cause it to be terminated.  At the worst, you will not be allowed to search, but data will still be ingested.

[richgalloway · Accepted solution]

What exactly are you looking at when you see "My Volume used today"?  What you did you do to get it?

Searching has no effect on the volume used.  The volume measured is that of the data stored that day.