Deployment Architecture

Duplicating Events without license impact

shocko
Path Finder

Guys, I have Splunk Enterprise 6.1.4 (don't ask why I haven't upgraded. I have my reasons !). I have several forwarders (7.x) forwarding to an indexer in this infrastructure but I also wish to forward a subset of this data to my Splunk free instance. How to do this:

  • forward directly from forwarder (messy as need firewall rules to my free instance etc.)
  • forward from indexer

Wondering if I do it from the indexer do I get hit with a double license cost at my existing indexer?

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @shocko,
if the events in the free license are less that 500MB/day, you'll pay only on the main installation, otherwise, you'll pay twice in both your situations.
To not pay twice, you have to configure an Indexers' Cluster (not with free license!).

Beware using a newest version of UFs than Indexers, there could be problems and Splunk Support could not help you..

Ciao.
Giuseppe

shocko
Path Finder

Yes indeed they amount to ~ 200 MB so Splunk Free will do. I was wondering though how to configure the indexer to index and forward.

0 Karma

gcusello
SplunkTrust
SplunkTrust
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!