Index one input locally and then forward all inputs - what is counted on my license

[robertschenk]

Hello,

I read https://docs.splunk.com/Documentation/Splunk/8.0.2/Forwarding/Routeandfilterdatad#Perform_selective_...

and think about:

"Index one input locally and then forward all inputs"

How does this affect my licensed volume. Basically I'm processing the same date twice.

Does I have to pay this volume twice? This may affect my planning ...

Cheers

Robert

[mguhad]

It will impact the license if they are sharing the same LM. If the local instance is of a differnt LM, then theortically no. But if they are sharing the same License, then yes.

Remember, those HFs (that are usually not configured for indexing data) will NEED enterprise license to have the capability of indexing data before forwarding meaning this data will have to pass through the license meter before being written to disk thus innevetibly consuming your license.

On that manual you shared, it states certain caveats that you should be aware of if you are utalising HFs such as:
https://docs.splunk.com/Documentation/Splunk/8.0.2/Forwarding/Routeandfilterdatad#Perform_selective_...

*If you set indexAndForward to "true" and then filter out some data through forwardedindex blacklist attributes, the forwarder does not forward the blacklisted data, but it does still index the data.

I hope this helps.