Guys : after checking documentation, and available answers on the topic, but nothing found, I would like to ask what I though was "obvious", but someone from a technical group is saying it is not so ... so here is the situation :
A customer buys a 1GB/day license, I understood that it means they can "load" into Splunk (regardless of indexes and the rest of Splunk internals) up to 1GB/day of non-compressed customer data (logs, config files, command outputs, etc, etc, etc.; i.e. "non structured data")
QUESTIONS :
1.- Is this statament correct ?
2.- Lets say the customer loads today a "one time" old data file of 400MB, which has old data from multiple days (each event of this old data has its timestamp) : will Splunk account (for licensing volume) 400MB to todays volumen OR will it account the 400MB splitted in the earlier days proportionally per day (according to each day "contribution" to the total 400MB ?
3.- What happens to the daily volume of data (for licensing purposes) if the customer runs reports, searches, or any action to make use of the already loaded data (that could imply indexing / reindexing some of the data), but NEVER input any new data in any form ? Could this change (increase) the "data volume" for licensing ?
My confusion comes from a comment (from a technical guy) that is saying that 3 can actually increase the data volume registered for that day in the Splunk usage ...
Cheers
