Getting Data In

Enforce indexing quota/limit by Host?

NK_1
Path Finder

Is there a way to configure Splunk to enforce indexing quoatas by Host? e.g. Do not index more than 250MB per day for Host X. Do not index more than 100MB per day for Host Y. etc.

Helps prevent quota overuse by non-critical systems.

Tags (3)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

No there is not currently such functionality.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

You can set up license pools that will alert you if a pool goes over its allocated quota, that way you can check your volume to see where the added data is coming from with some idea about the source of the events. However, it is not going to stop indexing from that particular pool. As gkanapathy pointed out, that functionality does not exist.

NK_1
Path Finder

I hear that in v4.2 and later, there is the notion of License Pooling... allows a Corporation with a 100GB indexing quota/license/limit to sub-divide that and maybe assign a 10GB quota to the QA Department, so that Production hosts logging is not affected if QA goes wild with indexing and exhausts their quota?

gkanapathy
Splunk Employee
Splunk Employee

No there is not currently such functionality.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...