|
Why does the Splunk server show up as the only host indexing? We're running 3.x and our free lic is shot because it looks like Splunk is indexing itself. Is this "summary index" stuff? According to the source report, it's /opt/splunk/var/log/splunk/license_a ?? New users aren't allowed to use the image tag? Really....... |
|
in 3x summary indexing counted against your license. It's mainly an artifactof how we licensed. I woukd HIGHLY recommend upgrading to 4.x. 4.1 makes 3.x look like a chump. And summary indexing doesn't count against your license. |
|
Internal data does not count against license. Summary indexing does, but if you're running 3.x, it's unlikely that you're accidentally running summary indexes without knowing it. Possibly you have downloaded and enabled something like the Unix app on your system. |
