Installation

How to limit the daily volume of a specific index?

sysprg1
Explorer

I have one system which is the indexer, but there are multiple indexes (based upon projects)
Different projects have purchased licenses so I want to limit the indexes to various daily limits.
For example project A has purchased a 5Gig license and project B has purchased a 10Gig license.
I have project A data going to index X and project B data going to index Y.
Since both licenses are put into the auto_generated_pool_enterprise there is 15Gig volume allowed.
I want to limit project A (index X) to 5Gig per day and project B (index Y) to 10Gig per day.

If Project A (index X) gets more than 5Gig in a day, I don't want it to consume the other available license since that project didn't purchase it. I don't want to use a disk limit.

How can I limit the daily volume of a specific index?

Thanks,

Labels (2)

jasonbew
Engager

This would be useful to a lot of people I think, ie one app starts indexing abnormal volumes impacting the platform, it would be useful to be able to cap volumes per index to avoid the platform not indexing further data for other apps.

0 Karma

harsmarvania57
Ultra Champion

No, you cannot. Same answer given by MarioM

0 Karma

deepthi5
Path Finder

Even i am searching for the exact scenario to restrict the index by volume did some one find a way to do this

0 Karma

MarioM
Motivator

you cannot...license and license pooling are per indexer not per indexes.

The only option is to split your project per indexer.

vbalasubramania
New Member

is this still the case ? I see this response as of Sep 2012 and Iam using 6.1 fo rnow and ready to upgrade to 6.2 and am in the wsame exact scenario the original poster has raised.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...