Splunk DB Connect: After establishing a connection to the database, where is the database data stored in Splunk?

[ankithreddy777]

We have installed Splunk DB Connect on one search head. After establishing the connection and identities, where is the indexed data stored on Splunk (search head or on indexers)? How is the license usage calculated?

[nabeel652]

The data is stored on the indexers. DBConnect will just run your queries and if successful will forward data to the indexers/indexer group you have set in outputs.conf file.

Any data that is indexed is licensed. Any compressed data sent to indexers is decompressed and indexed. The licensing is only applied after data is decompressed and indexed.