Getting Data In

Multiple indexes and license limits

steve
Path Finder

Does data indexed in two separate indexes count twice against the license limit?

Tags (2)
0 Karma
1 Solution

gekoner
Communicator

Sorta. All data being indexed, no matter which Index it goes into is being counted toward your license. EXCEPT data you put into summary indexes, and also all events going into the internal indexes are NOT counted towards your license.(Kristian Kolb)
If you are indexing the same data twice. I.e. if the same data is going to Index1 and Index2, then ALL data is counted against your license. So in that sense your data is counted twice.

see this doc - 1http://docs.splunk.com/Documentation/Splunk/4.3/Admin/HowSplunklicensingworks
Specifically, “Splunk licenses specify how much data you can index per calendar day…”

I'd recommend you download and install the Deployment Monitor App. This will really help you get an idea of what data you are indexing, and from where, and how it is being counted against your license.
1http://docs.splunk.com/Documentation/Splunk/latest/Admin/Manageyourlicenses

View solution in original post

kristian_kolb
Ultra Champion

gekoner is right, but you should know that stuff you put into summary indexes, and also all events going into the internal indexes are NOT counted towards your license.

/k

gekoner
Communicator

Sorta. All data being indexed, no matter which Index it goes into is being counted toward your license. EXCEPT data you put into summary indexes, and also all events going into the internal indexes are NOT counted towards your license.(Kristian Kolb)
If you are indexing the same data twice. I.e. if the same data is going to Index1 and Index2, then ALL data is counted against your license. So in that sense your data is counted twice.

see this doc - 1http://docs.splunk.com/Documentation/Splunk/4.3/Admin/HowSplunklicensingworks
Specifically, “Splunk licenses specify how much data you can index per calendar day…”

I'd recommend you download and install the Deployment Monitor App. This will really help you get an idea of what data you are indexing, and from where, and how it is being counted against your license.
1http://docs.splunk.com/Documentation/Splunk/latest/Admin/Manageyourlicenses

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...