Installation

Splunk licensing accounting : how does it really work ?

arturo
Explorer

Guys : after checking documentation, and available answers on the topic, but nothing found, I would like to ask what I though was "obvious", but someone from a technical group is saying it is not so ... so here is the situation :

A customer buys a 1GB/day license, I understood that it means they can "load" into Splunk (regardless of indexes and the rest of Splunk internals) up to 1GB/day of non-compressed customer data (logs, config files, command outputs, etc, etc, etc.; i.e. "non structured data")

QUESTIONS :

1.- Is this statament correct ? 2.- Lets say the customer loads today a "one time" old data file of 400MB, which has old data from multiple days (each event of this old data has its timestamp) : will Splunk account (for licensing volume) 400MB to todays volumen OR will it account the 400MB splitted in the earlier days proportionally per day (according to each day "contribution" to the total 400MB ? 3.- What happens to the daily volume of data (for licensing purposes) if the customer runs reports, searches, or any action to make use of the already loaded data (that could imply indexing / reindexing some of the data), but NEVER input any new data in any form ? Could this change (increase) the "data volume" for licensing ?

My confusion comes from a comment (from a technical guy) that is saying that 3 can actually increase the data volume registered for that day in the Splunk usage ...

Cheers

Tags (1)

arturo
Explorer

Thanks Stephen !

Very clear ...

Saludos

0 Karma

sideview
SplunkTrust
SplunkTrust

Note - it's a small thing but it's best to comment by clicking 'add comment' on an answer or on a question, rather than posting an answer that's really a comment.

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

License accounting is based solely on arrival time. Those 400MB will be associated with the midnight-to-midnight period that the data was loaded in. Moreover, the volume calculation is not based at all on reports, searches or other action, only the initial load of the raw data.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...