Security

Are splunk logs counted toward our license limit?

firasarabo
Path Finder

Hi, looking at volume indexed I see quite few MB of indexed splunk logs, the question is are these indexing counted toward our license? below are the log files I am talking about.

/apps/tparty/splunk/var/log/splunk/web_access.log 0.256985665 
/apps/tparty/splunk/var/log/splunk/splunkd_access.log 23.090337752 
/apps/tparty/splunk/var/log/splunk/splunkd.log.1 23.761911393 
/apps/tparty/splunk/var/log/splunk/splunkd.log 101.839995384 
/apps/tparty/splunk/var/log/splunk/scheduler.log 4.307683944 
/apps/tparty/splunk/var/log/splunk/metrics.log.5 23.704051972 
/apps/tparty/splunk/var/log/splunk/metrics.log.4 23.704115867 
/apps/tparty/splunk/var/log/splunk/metrics.log.3 18.331140518 
/apps/tparty/splunk/var/log/splunk/metrics.log.2 23.706820488 
/apps/tparty/splunk/var/log/splunk/metrics.log.1 21.531718254 
/apps/tparty/splunk/var/log/splunk/metrics.log 6.729707730 
/apps/tparty/splunk/etc/apps/sample_app/logs/maillog.1 5.304664611 
/apps/tparty/splunk/etc/apps/sample_app/logs/maillog 2.542978287 

Thanks, Firas

Ron_Naken
Splunk Employee
Splunk Employee

The Splunk internal data does not count towards your license.

firasarabo
Path Finder

that is good to know thanks!

then what start -> index activity -> indexing volume used for? what I need to find out is how much indexing counted toward our license each source, source type or host is forwarding.

Thanks,
Firas

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Actual licensed-counted volume is different and only reported once per day in the internal license_audit.log file. You can see it by index=_internal source=*license_audit.log | timechart span=1d sum(todaysBytesIndexed) by host. There is additional and different information in version 4.2, btw.

gkanapathy
Splunk Employee
Splunk Employee

The dashboards will show internal and non-licensed volume, but it just isn't counted against license.

0 Karma

firasarabo
Path Finder

any reason why it shows on (start -> index activity -> indexing Volume) ? I thought that this view will list all indexed logs.

a related question, from other posts I know that SPLUNK will not re-index rotated log files, why do I see them in this view(start -> index activity -> indexing Volume) as a separate indexed logs?

series sum(MB)

/logs/dsngw.log.1 398.334282874
/logs/dsngw.log.3 398.013719557
/logs/dsngw.log.2 394.660317424
/logs/dsngw.log.4 354.173194881

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...