Will the Splunk DB Connect app eat up my monthly index cap we have as part of our license?

[ra01]

I'm an analyst not a sysadmin, but I'm looking into proposing we use Splunk DB Connect. The one concern I'm trying to learn about is will it affect the monthly index cap limit we have as part of our license?

I couldn't find anything mentioned in the documentation.

[richgalloway]

DB Connect won't affect your index any more than any other app. It all depends on how you use it. Just like you would be judicious about the log data you index (ignore DEBUG-level events, for example) so, too, should you be judicious about what you index using DB Connect.

[ra01]

one of our tech guys asked me "how much data will you be indexing with that app?"

Can you help me think about how to answer him?

[richgalloway]

Our admins often ask that question. We then look at the source, see how much data is there, how much of that we want to index, add it up, and that's our answer.

Use your favorite SQL client to run sample queries against your database. See how much you get back and build your index estimate from that.