Deployment Architecture

License issue with clustering

kengilmour
Path Finder

Hello,

I'm enjoying the new clustering feature with Splunk, however I seem to have hit a snag with the license.

One of the log servers I was using was previously just a normal syslog server, however our main Splunk server has run out of IO so I've had to distribute searches across multiple servers.

I've set the new Splunk server to import data from the local machine to an index with the same name as the index on the master server. Thinking that this would be duplicated data and this would not count for the license issue seems to have completely blown my license and created a violation.

How do I get the server to recognise that it's the same as the old data and not consume all the license? Is there a Splunk Time Machine?

Regards,

Ken

0 Karma

kengilmour
Path Finder

I figured it out - to use delete you need to pipe the command into delete

your_command | delete

Drainy
Champion

This isn't correct. Once indexed using the delete command will not free up the licence used. To "Correct" the situation means to reduce your indexing levels back to normal. Vishal has the more informed answer.

0 Karma

kengilmour
Path Finder

Yes but it says I can correct this before midnight to avoid a violation. How do i "Correct" the situation? I assume I can just delete the new logs? When I try the delete command as admin it just searches for the word "delete" within my results.

0 Karma

Vishal_Patel
Splunk Employee
Splunk Employee

Not sure how you "imported" your data onto new indexer, but i'm guess the data was fed in such a manner that caused it to go through the normal input pipeline to the indexer. In this case, Splunk just considers this new data (it has no way to determine if you've already indexed this data previously).

Moving forward, you can/should simply load balance your data all your indexers in your cluster. Any replication that happens for the purpose of clustering won't be double counted by license master.

0 Karma

kengilmour
Path Finder

Yes but it says I can correct this before midnight to avoid a violation. How do i "Correct" the situation? I assume I can just delete the new logs? When I try the delete command as admin it just searches for the word "delete" within my results.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...