All Apps and Add-ons

Index one input locally and then forward all inputs - what is counted on my license

robertschenk
New Member

Hello,

I read https://docs.splunk.com/Documentation/Splunk/8.0.2/Forwarding/Routeandfilterdatad#Perform_selective_...

and think about:

"Index one input locally and then forward all inputs"

How does this affect my licensed volume. Basically I'm processing the same date twice.

Does I have to pay this volume twice? This may affect my planning ...

Cheers

Robert

0 Karma

mguhad
Communicator

It will impact the license if they are sharing the same LM. If the local instance is of a differnt LM, then theortically no. But if they are sharing the same License, then yes.

Remember, those HFs (that are usually not configured for indexing data) will NEED enterprise license to have the capability of indexing data before forwarding meaning this data will have to pass through the license meter before being written to disk thus innevetibly consuming your license.

On that manual you shared, it states certain caveats that you should be aware of if you are utalising HFs such as:
https://docs.splunk.com/Documentation/Splunk/8.0.2/Forwarding/Routeandfilterdatad#Perform_selective_...

*If you set indexAndForward to "true" and then filter out some data through forwardedindex blacklist attributes, the forwarder does not forward the blacklisted data, but it does still index the data.

I hope this helps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...