Can anyone point me to official documentation where it says that the internal index is not counted against your Splunk license?
thanks
Does it mean that if you send all your indexed data to the _internal index, you will never get any license infringement ?
You can find it in the Admin Manual for versions 5.0.7 and earlier in the About License Violations
section How to Avoid License Violations
paragraph. I'm not sure why they don't mention it Splunk 6+, but with regard to the reference in earlier versions it was removed in current versions because if internal indexes are not counted against the license they they should not be included in the LURV, which replaced the index volume status dashboard
.
http://docs.splunk.com/Documentation/Splunk/5.0.7/Admin/Aboutlicenseviolations