Installation

Do spaces in logs count against your license?

daniel333
Builder

Hey guys,

Do spaces in logs count against licensing? for example

url=https://www.google.com
vs
url = https://www.google.com

thanks,
-Daniel

Labels (1)
0 Karma
1 Solution

acharlieh
Influencer

Splunk is licensed in bytes that land into an index per day, it doesn't matter if those bytes are spaces or a pile of poo, they're still bytes.

Now, the key here is "land in an index"... prior to landing, you can use TRANSFORMs or SEDCMD, and to help you keep the crap out of Splunk, (that said, trying to trim meaningless spaces, and leave meaningful spaces this way might give you a bit of a headache).

You may be interested in cerby's .conf 2014 talk about Keeping the Junk out of Splunk. Slides Recording

View solution in original post

acharlieh
Influencer

Splunk is licensed in bytes that land into an index per day, it doesn't matter if those bytes are spaces or a pile of poo, they're still bytes.

Now, the key here is "land in an index"... prior to landing, you can use TRANSFORMs or SEDCMD, and to help you keep the crap out of Splunk, (that said, trying to trim meaningless spaces, and leave meaningful spaces this way might give you a bit of a headache).

You may be interested in cerby's .conf 2014 talk about Keeping the Junk out of Splunk. Slides Recording

MuS
SplunkTrust
SplunkTrust

Reading the first part of this answer I had to thought of this http://splunkreactions.tumblr.com/post/140342252890/can-we-save-on-license-if-we-use-a-smaller-font 🙂

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...