Monitoring Splunk

What is the 'stash' sourcetype for in the PCI Application

jambajuice
Communicator

I have been monitoring our license consumption and the 'stash' sourcetype is showing up consistently. I've poked around in the config files and I fount this in the inputs.conf in the default folder of the SplunkPCIComplianceSuite:

[udp://519] index=pci_notable sourcetype=stash

What is this sourcetype for and does it count against our license? And what would cause it to index 15 GB on any given day, particularly when we have a 5 GB license.

Thx.

Craig

Tags (1)

I-Man
Communicator

I believe this is the sourcetype for the Summary Indexing Function of Splunk. All of my Summary indexed data has the sourcetype stash. Splunk comes with some reports that automatically populate into the Summary Index. Additionally, from what people say on this forum, Summary Indexed data does not count against your license usage.

http://answers.splunk.com/questions/214/summary-indexing-impact-on-license-volume

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...