License issue with clustering

[kengilmour]

Hello,

I'm enjoying the new clustering feature with Splunk, however I seem to have hit a snag with the license.

One of the log servers I was using was previously just a normal syslog server, however our main Splunk server has run out of IO so I've had to distribute searches across multiple servers.

I've set the new Splunk server to import data from the local machine to an index with the same name as the index on the master server. Thinking that this would be duplicated data and this would not count for the license issue seems to have completely blown my license and created a violation.

How do I get the server to recognise that it's the same as the old data and not consume all the license? Is there a Splunk Time Machine?

Regards,

Ken

[kengilmour]

I figured it out - to use delete you need to pipe the command into delete

your_command | delete

[Drainy]

This isn't correct. Once indexed using the delete command will not free up the licence used. To "Correct" the situation means to reduce your indexing levels back to normal. Vishal has the more informed answer.

[kengilmour]

Yes but it says I can correct this before midnight to avoid a violation. How do i "Correct" the situation? I assume I can just delete the new logs? When I try the delete command as admin it just searches for the word "delete" within my results.

[Vishal_Patel]

Not sure how you "imported" your data onto new indexer, but i'm guess the data was fed in such a manner that caused it to go through the normal input pipeline to the indexer. In this case, Splunk just considers this new data (it has no way to determine if you've already indexed this data previously).

Moving forward, you can/should simply load balance your data all your indexers in your cluster. Any replication that happens for the purpose of clustering won't be double counted by license master.

[kengilmour]

Yes but it says I can correct this before midnight to avoid a violation. How do i "Correct" the situation? I assume I can just delete the new logs? When I try the delete command as admin it just searches for the word "delete" within my results.