All Apps and Add-ons

Phantom license page- What is the difference between Phantom License Information and Splunk License Information?

vinoth_raj
Path Finder

Hi guys,

 

In the license page for the Splunk Phantom , What is the difference between the "PHANTOM LICENSE INFORMATION" & "SPLUNK LICENSE INFORMATION". I assume the  "SPLUNK LICENSE INFORMATION" is about the amount of data that we can fetch from Splunk Enterprise and and ingest into the  Splunk Phantom.

Am I correct?

Labels (1)
0 Karma

smurf
Communicator

Hi,

From what I understand:

The Phantom one is your license for the Phantom itself.

The Splunk one is for the included Splunk Enterprise install. You can find it at $PHANTOM_HOME/splunk/

From the documentation:

If Splunk SOAR (On-premises) is installed as a stand-alone product, it includes a version of Splunk Enterprise as the internal search engine. You can also configure Splunk SOAR (On-premises) to use an external Splunk instance for searching. A Splunk SOAR (On-premises) cluster also requires an external Splunk Enterprise instance.

You can find more here https://docs.splunk.com/Documentation/SOARonprem/6.0.0/Install/ExternalSplunk 

 

smurf

Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...