All Apps and Add-ons

Is it possible to route events to particular license pool based on host or index name?

Path Finder

We have a situation where we want to have multiple pools in our license master and each pool should index data from specific host.
We don't want multiple indexer OR license master to achieve this.
Please let me know if such scenarios are possible.

0 Karma

Splunk Employee
Splunk Employee

Not like that. license pools are used to segregate indexers volume.

Eventually, with a heavy forwarder routing some data to specific indexers, and attach the indexers to a specific license pool, you could achieve that. But this is a bit of a burden to maintain, maybe not worth it.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...