my idea is to install a high availability system to work with splunk, according to that idea we will need to obtain two licenses of splunk?
Please see: http://docs.splunk.com/Documentation/Splunk/latest/Installation/Highavailabilityreferencearchitectur...
and note this:
There are many ways you can implement
specific aspects of this architecture.
For guidance, talk with Splunk
Professional Services.This second solution has the advantage
that it depends less on the
capabilities of your underlying
storage system. On the downside, it
requires double the hardware (since
you're doubling the indexers), as well
as a license for twice the indexing
volume (since you're indexing
everything twice).
If you want true HA, then yes, your going to need to have an indexer set up in HA to act as a license server. Sales can provide you with a HA specific license, iirc, at a reduced cost. Don't quote me on that particular piece.