Hi
This is a trivial question, but maybe someone has a really good answer to prevent the uncontrolled growth of license usage.
In our case we have some forwarders and index some logfiles.
Now a problem comes up and the admin decide to set a more meaningful tracelevel for the monitored logfile. Instead of 100MB per day this log produces 5 GB per day and the admin is happy to see the failure but I'm sweating because the license exeeded the maximum.
The first idea is, to tell the admins, please stop the splunk deamon, set your traces and after you have finished the troubleshooting, delete the logs and start the deamon again.
But I fear he doesn't remember my words the next time a problem comes up.
So do you have a more pragmatical way to prevent the uncontrolled license growth.
Thanks
Rob
... View more