All Apps and Add-ons

License Duplicate

ahmedhassanean
Explorer

Dears,

i have scenario where i have three nodes
node one master and indexer and searh head
node two indexer and search head
node three heavy forwarder

all three node are configure as license slave for node 1

now i have configure node three heavy forwarder to forwardandindex locally then send data to node one and two
but in license i can see that license count double is that normal

?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Yes it's normal because you index twice your logs, it's the same thing to send logs to two different Indexers without autoloadbalancing.
To not duplicate license consuption the onlu way is not index locally and use remote indexed events also For local search.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...