Duplicating Events without license impact

[shocko]

Guys, I have Splunk Enterprise 6.1.4 (don't ask why I haven't upgraded. I have my reasons !). I have several forwarders (7.x) forwarding to an indexer in this infrastructure but I also wish to forward a subset of this data to my Splunk free instance. How to do this:

• forward directly from forwarder (messy as need firewall rules to my free instance etc.)
• forward from indexer

Wondering if I do it from the indexer do I get hit with a double license cost at my existing indexer?

[gcusello]

HI @shocko,
if the events in the free license are less that 500MB/day, you'll pay only on the main installation, otherwise, you'll pay twice in both your situations.
To not pay twice, you have to configure an Indexers' Cluster (not with free license!).

Beware using a newest version of UFs than Indexers, there could be problems and Splunk Support could not help you..

Ciao.
Giuseppe

[shocko]

Yes indeed they amount to ~ 200 MB so Splunk Free will do. I was wondering though how to configure the indexer to index and forward.

[gcusello]

HI @shocko,
see at https://docs.splunk.com/Documentation/Splunk/8.0.1/Forwarding/Routeandfilterdatad#Configure_routing

Ciao.
Giuseppe