An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data is 300 GB per day. To minimize license issues, what is the best way to add 10 TB of histori

The correct answer is C. Add all 10 TB in a single 24 hour period.. With a 500 GB/day license and 300 GB of regular daily ingest, adding 200 GB/day for 50 days (option D) puts the admin right at the 500 GB threshold every single day for 50 days-any measurement variance or minor spike would trigger repeated warnings. Adding 2.5 TB/day for 5 days (

Splunk Deployment and Licensing

Question

An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data is 300 GB per day. To minimize license issues, what is the best way to add 10 TB of historical data to the index?

Options

ABuy a bigger Splunk license.
BAdd 2.5 TB each day for the next 5 days.
CAdd all 10 TB in a single 24 hour period.
DAdd 200 GB of historical data each day for 50 days.

How the community answered

(38 responses)

A
16% (6)
B
5% (2)
C
71% (27)
D
8% (3)

Explanation

With a 500 GB/day license and 300 GB of regular daily ingest, adding 200 GB/day for 50 days (option D) puts the admin right at the 500 GB threshold every single day for 50 days-any measurement variance or minor spike would trigger repeated warnings. Adding 2.5 TB/day for 5 days (option B) generates 5 warnings immediately, hitting the violation threshold. Adding all 10 TB in a single 24-hour period (option C) results in exactly one license warning for that day, then operations return to normal at 300 GB/day. Because Splunk Enterprise allows up to 5 warnings in a rolling 30-day window before enforcing a violation, accepting one controlled warning is the safest strategy.

Topics

#Splunk licensing#Historical data ingestion#License management#Data volume

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice