On my 4.0.9 instance, I keep getting notifications that I have exceeded the license volume. The only indexing I'm doing on this instance is summary indexing, and that doesn't count towards the volume, right?
When I search for the top sources for my search head, it only includes _internal and summary index data.
Summary indexing IS NOT free in the 4.0.9 & earlier versions. This changed in the latest releases, so for 4.0.10, 4.1.x and later, it IS free.
The _internal index is not counted towards your overall volume
If you have a search-head pre 4.0.10, and you want to run summary index searches on it, you will need an Enterprise license. For 4.0.10 and later, you can use the forwarder license in $SPLUNK_HOME/etc
On 4.2, the forwarder license can not be used for a search head, so the search head has to be hooked up to your license master.
It will then show any license violations that the license master shows (annoyingly.)
Summary indexing IS NOT free in the 4.0.9 & earlier versions. This changed in the latest releases, so for 4.0.10, 4.1.x and later, it IS free.
The _internal index is not counted towards your overall volume
If you have a search-head pre 4.0.10, and you want to run summary index searches on it, you will need an Enterprise license. For 4.0.10 and later, you can use the forwarder license in $SPLUNK_HOME/etc
Thanks, I've edited the original answer, I didn't realize this had recently been applied to the 4.0.x code branch.
We need some updating of documentation: http://www.splunk.com/base/Documentation/4.0.10/ReleaseNotes/4.0.10
As of Splunk version 4.0.10, summary index searches do not count towards your indexed data volume. (SPL-29515)