topic Does cloned data double license usage? in Splunk Enterprise

Does cloned data double license usage?

jonp — Wed, 08 Mar 2023 14:34:28 GMT

In a Splunk Enterprise instance, will configuring a universal forwarder to clone all event logs to two indexers result in double the license usage?

The intent is for all events to be mirrored in two separate indexes.

Re: Does cloned data double license usage?

richgalloway — Wed, 08 Mar 2023 16:23:14 GMT

Yes, it will increase your ingestion license consumption. The indexers don't know the data is cloned so it's not treated specially.

Re: Does cloned data double license usage?

jonp — Wed, 08 Mar 2023 17:37:15 GMT

Thanks.

Is there a way to accomplish the same intent without increasing license consumption? Such as utilizing a heavy forwarder to ingest the events, then send the data to two indexers?

Re: Does cloned data double license usage?

richgalloway — Wed, 08 Mar 2023 19:39:18 GMT

What are you trying to accomplish by sending the same data to two indexes? Once we understand that we can offer suggestions.