External data that getting routed to the _internal index of Splunk also contributes to license usage

Applicability

Description

In an attempt to bypass license consumption, Splunk users route external data such as log files or network events, to the Splunk _internal index.

Resolution

Splunk identifies the type of data based on the origin (eg. TCP, UDP or Splunk _audit, interospection etc)  and calculates license usage based on the volume of external data ingested, not the index.

Here is how the process works :

1. When external data is ingested into Splunk through inputs (e.g., monitor, forwarder, HTTP Event Collector), Splunk records the volume of raw data ingested. License usage is calculated based on the raw size of external data processed, regardless of whether the data is routed to internal indexes (like _internal) or custom indexes.
   
   
2. Internal indexes are reserved for Splunk’s operational data (e.g., system logs, audit logs), which are not subject to license calculation. However, when external data (e.g., server logs, application logs) is routed to the _internal index, Splunk tracks its source of the data and method of ingestion, recognizing it as external or internal data. Therefore, it still consumes license even if stored in an internal index. 
   
   

Best Practice:
In order to avoid confusion, it is recommended to store external data in designated indexes and reserve internal indexes (like _internal) for Splunk’s system logs only.

Related Links

How Splunk Enterprise licensing works