Getting Data In

double indexing, does it count towards your license limit

riggas01
New Member

if i send all syslog data to one splunk enterprise instance to be indexed and then it is forwarded onto another splunk enterprise instance.

Is the second splunk instance smart enough to know this data has already been indexed and doesnt count towards your daily license quota?

Thanks

Tags (1)
0 Karma

adonio
Ultra Champion
0 Karma

micahkemp
Champion

It will absolutely hit your index volume a second time, assuming you are forwarding via syslog or splunk output.

You can make use of summary indexing or collect to search and index the results of said search, which won't hit your license cost again, but you don't want to do this for large amounts of data as a means to have two copies of all your data.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...