All Apps and Add-ons

License Duplicate

ahmedhassanean
Explorer

Dears,

i have scenario where i have three nodes
node one master and indexer and searh head
node two indexer and search head
node three heavy forwarder

all three node are configure as license slave for node 1

now i have configure node three heavy forwarder to forwardandindex locally then send data to node one and two
but in license i can see that license count double is that normal

?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Yes it's normal because you index twice your logs, it's the same thing to send logs to two different Indexers without autoloadbalancing.
To not duplicate license consuption the onlu way is not index locally and use remote indexed events also For local search.
Bye.
Giuseppe

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...