As I asked, if I setup a blacklist to deny some logs, does the dropped logs still occupy the license quota?
Hi @lllidan,
Splunk License is counted on dayly indexed logs, this means that all the logs that you don't index (e.g. filtering) aren't added to the license consuption, but they are also non useful!
Blacklisting some logs, you don't index them so you don't use license.
Ciao.
Giuseppe
Hi @lllidan,
Splunk License is counted on dayly indexed logs, this means that all the logs that you don't index (e.g. filtering) aren't added to the license consuption, but they are also non useful!
Blacklisting some logs, you don't index them so you don't use license.
Ciao.
Giuseppe
thanks a lot.