How splunk calculate license?

[sympatiko]

Hi,

I just want to ask how the enterprise license will be calculated by splunk. I have a 5gb license. My current setup is I have a 3 indexers without any internet access, only the search head can access internet. If I used the search head as the master license, is the splunk only looks for master license? Meaning Indexers is not recommended to directly connected to internet?

Thanks,

[chanfoli · Accepted solution]

Internet connectivity has nothing to do with the metering of your daily indexing volume. Basically, when data gets indexed by an indexer, it counts towards your daily total. See here for more:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/HowSplunklicensingworks

[sympatiko]

Hi chanfoli,

Thanks for the details. How about the license violation? How splunk will detect that one for excess charges?

[chanfoli]

It is pretty simple. If your inputs cause your indexers to index more data than your license allows, more than 4 times in a rolling 30 day period, you won't be able to search your indexes. This is explained in detail here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Aboutlicenseviolations

[sympatiko]

Thanks mate! Much appreciated!