All Apps and Add-ons

Index one input locally and then forward all inputs - what is counted on my license

New Member


I read

and think about:

"Index one input locally and then forward all inputs"

How does this affect my licensed volume. Basically I'm processing the same date twice.

Does I have to pay this volume twice? This may affect my planning ...



0 Karma


It will impact the license if they are sharing the same LM. If the local instance is of a differnt LM, then theortically no. But if they are sharing the same License, then yes.

Remember, those HFs (that are usually not configured for indexing data) will NEED enterprise license to have the capability of indexing data before forwarding meaning this data will have to pass through the license meter before being written to disk thus innevetibly consuming your license.

On that manual you shared, it states certain caveats that you should be aware of if you are utalising HFs such as:

*If you set indexAndForward to "true" and then filter out some data through forwardedindex blacklist attributes, the forwarder does not forward the blacklisted data, but it does still index the data.

I hope this helps.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...