All Apps and Add-ons

License Duplicate

ahmedhassanean
Explorer

Dears,

i have scenario where i have three nodes
node one master and indexer and searh head
node two indexer and search head
node three heavy forwarder

all three node are configure as license slave for node 1

now i have configure node three heavy forwarder to forwardandindex locally then send data to node one and two
but in license i can see that license count double is that normal

?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Yes it's normal because you index twice your logs, it's the same thing to send logs to two different Indexers without autoloadbalancing.
To not duplicate license consuption the onlu way is not index locally and use remote indexed events also For local search.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...