Hello, We've been downloading between 200 and 250 MB of logs and adding them to Splunk every day. Yesterday we downloaded 218MB, and this morning when I came in, I had a "indexing volume exceeded" warning. Now my free license says I can index up to 500MB a day. The only explanation for the warning would be if 500MB "indexed" doesn't necessarily mean 500MB of logs. How does Splunk calculate the "indexing volume" and what would that translate in terms of log size? ... View more

I need help figuring out this one This is the search: host="myhost" | spath | top agent.browser I get 311 matching events This is the table of results: agent.browser count percent 1 IE 206 66.237942 2 Safari 146 46.945338 3 Firefox 141 45.337621 4 Chrome 116 37.299035 5 Mobile Safari 8 2.572347 6 Chrome Frame 4 1.286174 Note that if you sum up all the counts, it adds to 622, which is exactly twice the number of matching events. Also if you click one of the rows, example IE, you go to a search page: host="Games-Team-Mac" | spath | search agent.browser="IE" Which shows you 103 events, which is half the count. So it seems i really only have 311 event, but for some reason the counts are counting them twice. Why? The only difference between these and other searches that work is that these logs are json format, so I'm using spath. ... View more