Does Splunk on Splunk and Splunk App for Unix and Linux increase license usage if installed on search head and indexers?

[rishma]

I have distributed splunk environment. Does Splunk on Splunk, *NIX app increase license usage if installed on SH, Indexers? If yes, How much license increase is expected per searchhead and indexer?

[hexx · Accepted solution]

Yes, the scripted inputs of both of those apps will generate data that counts against your daily license quota anywhere they are configured to run.

For S.o.S, we have found that the ps_sos.sh scripted input typically generates 10 to 50MB / day / instance, depending on how busy the instance is (more searches -> more processes to record) and the interval configured for the script (the default of 5s is fairly aggressive).

[hexx]

Hard to say. I would expect the *nix app to consume more than that if you turn on all inputs. Again, keep in mind that you can adjust the scripts' run interval to mitigate that.

[rishma]

Thank you. Is it same for *NIX app as well?