All Apps and Add-ons

Does Splunk on Splunk and Splunk App for Unix and Linux increase license usage if installed on search head and indexers?

rishma
Explorer

I have distributed splunk environment. Does Splunk on Splunk, *NIX app increase license usage if installed on SH, Indexers? If yes, How much license increase is expected per searchhead and indexer?

1 Solution

hexx
Splunk Employee
Splunk Employee

Yes, the scripted inputs of both of those apps will generate data that counts against your daily license quota anywhere they are configured to run.

For S.o.S, we have found that the ps_sos.sh scripted input typically generates 10 to 50MB / day / instance, depending on how busy the instance is (more searches -> more processes to record) and the interval configured for the script (the default of 5s is fairly aggressive).

View solution in original post

hexx
Splunk Employee
Splunk Employee

Yes, the scripted inputs of both of those apps will generate data that counts against your daily license quota anywhere they are configured to run.

For S.o.S, we have found that the ps_sos.sh scripted input typically generates 10 to 50MB / day / instance, depending on how busy the instance is (more searches -> more processes to record) and the interval configured for the script (the default of 5s is fairly aggressive).

hexx
Splunk Employee
Splunk Employee

Hard to say. I would expect the *nix app to consume more than that if you turn on all inputs. Again, keep in mind that you can adjust the scripts' run interval to mitigate that.

0 Karma

rishma
Explorer

Thank you. Is it same for *NIX app as well?

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...