Splunk Search

Which indexes count towards the 500mb daily limit?

paycorp
Engager

Hello,

I was wondering which indexes are included in the daily 500mb limit of the free version?

Is it just the main one or ALL of them including _internal and os etc...?

Thanks,

Tags (2)
0 Karma

Ayn
Legend

Indexing in all non-internal indexes counts against the license, except for summary indexing which is 'free'.

Non-internal indexes are generally the ones not starting with an underscore when you look at a fresh Splunk installation (that is, you can't create your own index with a leading underscore and get free indexing there 😉 )

Ayn
Legend

Hopefully someone from Splunk can chime in with an authoritative answer here.

My guess would be that internal status of indexes is hardcoded, otherwise it would be all too easy to give yourself free indexing.

0 Karma

jonuwz
Influencer

Obvious next question .....

What makes an internal index internal ? 🙂 Is it hardcoded in the binary ?

Do any add-ons ship with extra internal indexes ?

While, isInternal is exposed in

https://localhost:8089/servicesNS/nobody/search/data/indexes/

there's no setter function in the POST.

Academic research only of course...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...