I'm an analyst not a sysadmin, but I'm looking into proposing we use Splunk DB Connect. The one concern I'm trying to learn about is will it affect the monthly index cap limit we have as part of our license?
I couldn't find anything mentioned in the documentation.
DB Connect won't affect your index any more than any other app. It all depends on how you use it. Just like you would be judicious about the log data you index (ignore DEBUG-level events, for example) so, too, should you be judicious about what you index using DB Connect.
--- If this reply helps you, an upvote would be appreciated.