Light trial description says 5GB/day for 30 days, however, the app enforces a per file limit of 500MB. Thoughts?

[doucette]

The Splunk Light trial description (https://www.splunk.com/en_us/download/splunk-light.html) says you can index up to 5GB per day for 30 days, however, the app allows for only a 500MB file to be indexed. Does this assume multiple devices all creating files smaller than 500MB? I'm using 30-day files, less than 5GB each, from a single device for testing.

[rbittner_splunk · Accepted solution]

Thanks for clarifying. There is a limit on the size of a file that you can upload to Splunk via the "File upload" of the "Add Data" feature. To access larger files it is probably easier to use the "Monitor Files and Directories" method for getting data into Splunk. The "File Upload" is really intended for small files.

The limit here is on file size and is unrelated to the daily indexing limit in Splunk Light.

Hope this helps.

[ddrillic]

Doucette, it goes by the daily index volume and 500MB/day is the quota. If you index gradually, you can index quite a bit. Just keep it under 500MB/day.

Free vs. Enterprise

shows -

Maybe somehow there is a confusion which relates to Splunk Cloud...