topic Re: Divide Splunk Enterprise license in Splunk Enterprise

Divide Splunk Enterprise license

dkr3500 — Wed, 21 Feb 2024 20:20:43 GMT

Hello,

I'm looking to buy a single 5GB/day or 6GB/day Splunk Enterprise license and then divide that license up into about 30 smaller licenses for my different production use cases. Are there any limits to the license divisions from Splunk support? As in, will Splunk support limit the number of times I can divide a license - can I divide my 5GB license into 30 smaller licenses or is there a limit to how many divisions they'll do?

Relatedly, is there a limit to how small (in terms of daily ingestion) they'll divide my smaller licenses into? For example, I have a few production standalone instances where I would only require 60MB/day for licensing...

I've heard mixed answers to this license division question - from Splunk sales reps and Fezzes, so I'm not sure what the truth is anymore, especially now that Cisco owns Splunk.

Thank you.

Re: Divide Splunk Enterprise license

richgalloway — Wed, 21 Feb 2024 20:36:17 GMT

Cisco does not own Splunk, yet.

The community unlikely to have a better answer than Sales or fezzes. Your account team should have the answer for you or be able to get it.

Re: Divide Splunk Enterprise license

dkr3500 — Wed, 21 Feb 2024 20:42:55 GMT

Thank you @richgalloway. Our sales rep said that if we buy a 5GB/day or 6GB/day license, the smallest they (the sales department) will divide that is into 1GB/day license chunks.

However, I know for a fact that a Splunk support ticket can be submitted to divide an existing license into smaller than 1GB/day chunks. So I'm just trying to reconcile these two different sources: does the sales department have a different set of rules they follow; and does the Splunk customer support have different rules for this? Has anything changed since I last divided a license many years ago?

Re: Divide Splunk Enterprise license

richgalloway — Wed, 21 Feb 2024 21:02:47 GMT

It's possible the policy has changed over the years. Again, the account team should be your source for answers to license questions. Specifically ask them if Support will further divide the license.

Re: Divide Splunk Enterprise license

PickleRick — Wed, 21 Feb 2024 21:07:29 GMT

1. We can't answer sales question. Only sales people can do that reliably. Obviously sales questions answer will depend heavily on the size of what you'd be talking about. And quite frankly, 6GB/day is not a very big license.

2. Even if they were willing to split, remember that even Splunk Free is relatively "big" compared to what you're trying to get.

3. What might be most reasonable is to install your license on a license manager, split your license into separate stacks and connect your license peers to that LM so that you manage all your indexers from a single entitlement.

Re: Divide Splunk Enterprise license

jotne — Thu, 22 Feb 2024 07:21:34 GMT

As PickleRick write, why not use the 500MB/day Free license?

5GB/30 = 166MB/day, much less then 500MB Free.

The Free license do have some limitation that may give problem.

Another solution is to point all the small Splunk setup to the same license. Then they will all use of the same 5GB license.

Re: Divide Splunk Enterprise license

PickleRick — Thu, 22 Feb 2024 07:44:59 GMT

No. I'm not suggesting to use the free license. It has too many limitations for most production uses.

I'm just pointing out that even Free license is relatively "big" compared to the "sublicenses" the OP wants.

Of course simple attaching of multiple environments to a single license master will work but without splitting the license into separate licensing stacks will result in a "shared license" which means that if one node for some reason should exhaust the license, it would violate the license for all nodes.