Which of the following types of data count against the license daily quota?

The correct answer is D. Windows internal logs. Windows internal logs (such as Windows Event Logs, Security logs, and Application logs) forwarded into Splunk DO count against the daily license quota because they are new data being indexed by Splunk. Replicated data (A) does NOT count - in an indexer cluster, data replicated to

Splunk Deployment and Licensing

Question

Options

AReplicated data
Bsplunkd logs
CSummary index data
DWindows internal logs

How the community answered

(18 responses)

B
6% (1)
D
94% (17)

Explanation

Windows internal logs (such as Windows Event Logs, Security logs, and Application logs) forwarded into Splunk DO count against the daily license quota because they are new data being indexed by Splunk. Replicated data (A) does NOT count - in an indexer cluster, data replicated to peer nodes is not double-counted against the license. Splunkd logs (B) are Splunk's own internal operational logs written to the _internal index and are exempt from license counting. Summary index data (C) generated by scheduled summary searches is typically exempt from license counting since it is derived from data already counted when originally indexed.

Topics

#Splunk licensing#License quota#Data ingestion#Internal data exclusion

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice