Splunk has historically used term licenses that have a fixed daily max data volume. So, let's say that you buy a 1-year Splunk license that lets you index 15 GB/day for $1,000 (I'm making this number up to explain this - please contact sales for actual pricing)...
You can index up to 15 GB/day, every day, for the term of the license (1 year in this example). If you index 5 GB one day and 10 GB the next day, the cost of your license remains the same. You are buying the license based on the maximum amount of data that you plan to bring into Splunk every day for the term of the license.
So, in this scenario, let's say you have a very steady data stream and you send 15 GB of data into Splunk every day for 365 days. Your cost to do that was $1,000 for the entire year, and you ingested 15 GB x 365 days = 5475 GB of data for that $1,000. If you want monthly cost, divide the $1000 you paid for the year by 12 = $83.33/month.
If you exceed the 15 GB/day cap in any 24 hour period, you will get a license warning. If you get multiple license warnings, you end up with a license violation which prevents you from executing searches. You then have to contact Support and ask them for a reset key to clear the violation. If you violate the license multiple times throughout the year, your sales rep will tell you that you need to buy a bigger license. So, it's important to buy a license with enough daily capacity for the amount of data you plan to ingest. Any Splunk Sales rep can help you with this, but that's essentially how licensing has worked in the past.
All that said, we have new licensing models available that do not have a daily data ingestion cap. I'd encourage you to visit https://www.splunk.com/en_us/software/pricing.html for more information or contact Splunk sales to get a few quotes for your environment.
... View more