Adding to @richgalloway 's answer - depending on your plan, you're either paying for the computing resources you use (workload pricing) which means that the more work your environment can perform (more indexing workload, but more importanty - more and "heavier" searches), the more you pay. Or ingest-based pricing which means that the more data you're indexing _per day_, the more you pay. You don't pay separately for the data you've already indexed so deleting an existing index doesn't affect your costs or for an app just because it's installed (Splunk premium apps is a separate story). Uninstalling an app - either. (unless it's a case where - for example - you use workload-based pricing and an app contains many saved searches). ... View more