squash_threshold = <positive integer> * Periodically the indexer must report to license manager the data indexed broken down by source, sourcetype, host, and index. If the number of distinct (source, sourcetype, host, index) tuples grows over the 'squash_threshold', the (host, source) values are squashed and only a breakdown by (sourcetype, index) is reported. This is to prevent explosions in memory + license_usage.log lines. * This is an advanced setting. Set it only after consulting a Splunk Support engineer. * This needs to be set on license peers as well as the license manager. * Default: 2000
... View more