I have free license splunk.
Licensed daily volume 500 MB- How do I stop usage when it reaches 500MB?,
Is there a way to stop indexing when it reaches 500 MB?
Hi anil1575,
No, there is no such feature in Splunk. It will continue to index, but it will get you a license violation http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Aboutlicenseviolations
There could be a way to stop Splunk at all if it reaches near the 500Mb limit....create a script that pulls the license info over REST and stop the service/process....but then Splunk is stopped completely and you would not be able to search any more.
Like the docs states http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Aboutlicenseviolations#How_to_avoid_license_... , if you're reaching your license limit try reducing the volume sent or get yourself a bigger license.
cheers, MuS