All Apps and Add-ons

License Duplicate

ahmedhassanean
Explorer

Dears,

i have scenario where i have three nodes
node one master and indexer and searh head
node two indexer and search head
node three heavy forwarder

all three node are configure as license slave for node 1

now i have configure node three heavy forwarder to forwardandindex locally then send data to node one and two
but in license i can see that license count double is that normal

?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Yes it's normal because you index twice your logs, it's the same thing to send logs to two different Indexers without autoloadbalancing.
To not duplicate license consuption the onlu way is not index locally and use remote indexed events also For local search.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...