Deployment Architecture

Duplicating Events without license impact

shocko
Contributor

Guys, I have Splunk Enterprise 6.1.4 (don't ask why I haven't upgraded. I have my reasons !). I have several forwarders (7.x) forwarding to an indexer in this infrastructure but I also wish to forward a subset of this data to my Splunk free instance. How to do this:

  • forward directly from forwarder (messy as need firewall rules to my free instance etc.)
  • forward from indexer

Wondering if I do it from the indexer do I get hit with a double license cost at my existing indexer?

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @shocko,
if the events in the free license are less that 500MB/day, you'll pay only on the main installation, otherwise, you'll pay twice in both your situations.
To not pay twice, you have to configure an Indexers' Cluster (not with free license!).

Beware using a newest version of UFs than Indexers, there could be problems and Splunk Support could not help you..

Ciao.
Giuseppe

shocko
Contributor

Yes indeed they amount to ~ 200 MB so Splunk Free will do. I was wondering though how to configure the indexer to index and forward.

0 Karma

gcusello
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...