Data squashing impact on data monitoring

When data exceeds a certain threshold limit defined in server.conf, Splunk squashes host and source fields in license usage logs. This decreases the memory usage and reduces the total number of events and load on the indexers and licensing manager.

Splunk automatically "squashes" fields in license usage logs when data exceeds the threshold limit in server.conf.

Squashing only impacts host and source fields. It has no impact on metrics for index and source type.

Metrics summaries will include a message similar to the following if an individual span contains any squashed data:

"Squashing has occurred during the Current time selected. You may see inaccurate reporting of the volume data per host and source level. Host and source values are automatically squashed and represented as "squashed" in volume metrics reporting when squashing occurs."

This means license usage logs were squashed during time period and you will see those host and source represented as "squashed" on the dashboard.

To avoid squashing, configure the squashing thresholds to a higher number. For more details, see squash_threshold setting in server.conf.