Hey guys,
Do spaces in logs count against licensing? for example
url=https://www.google.com
vs
url = https://www.google.com
thanks,
-Daniel
Splunk is licensed in bytes that land into an index per day, it doesn't matter if those bytes are spaces or a pile of poo, they're still bytes.
Now, the key here is "land in an index"... prior to landing, you can use TRANSFORMs or SEDCMD, and to help you keep the crap out of Splunk, (that said, trying to trim meaningless spaces, and leave meaningful spaces this way might give you a bit of a headache).
You may be interested in cerby's .conf 2014 talk about Keeping the Junk out of Splunk. Slides Recording
Splunk is licensed in bytes that land into an index per day, it doesn't matter if those bytes are spaces or a pile of poo, they're still bytes.
Now, the key here is "land in an index"... prior to landing, you can use TRANSFORMs or SEDCMD, and to help you keep the crap out of Splunk, (that said, trying to trim meaningless spaces, and leave meaningful spaces this way might give you a bit of a headache).
You may be interested in cerby's .conf 2014 talk about Keeping the Junk out of Splunk. Slides Recording
Reading the first part of this answer I had to thought of this http://splunkreactions.tumblr.com/post/140342252890/can-we-save-on-license-if-we-use-a-smaller-font 🙂