licensing question concerning fields from HEC?

[daniel333]

All,

Just curious if "cool-fields" are billed against our license in the example below?

curl -k  https://hec.domain.com:8088/services/collector/event -H "Authorization: Splunk a2c4cf57-8e67-4a5a-8c72-8649004bc8cf" \
  -d '{"event": "Hello=world!","sourcetype": "cool-fields", "fields": {"device": "macbook", "users": ["joe", "bob"]}}'

[mayurr98]

Hello

As long as it is indexing in Splunk it will billed be against your license.Its straight-forward, if you are indexing raw, then it will count against your license except for the metadata fields and replicated data.

Summary indexing and metric rollup summaries do not count against your license. Internal indexes, such as _internal and _introspection, also do not count against your license.

Refer this
https://answers.splunk.com/answers/581441/how-is-the-splunk-license-measured.html
https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/HowSplunklicensingworks

[Sukisen1981]

@mayurr98 says is right. the HEC indexes event over HTTP into a index that you provide in the configuration , as such whatever data you sent across the HEC will be indexed and will be billed