Splunk License Violations Best practises?

[SS1]

Hi Everyone,

What are the best practices to follow in the event of 90% license usage? Can we take any precautionary measures so that the license usage doesn't reach maximum? I don't think disabling the specific index is a good idea since it might cause issues.

[gcusello]

HI @SS1,

if you're working at the 90% of your license, in my opinion, you have to do the following things:

• at first see if the 90% is a peak or usual,
• thess plan your work to understand if you have to add more sources or not,
• then analyze your logs to understand which are the sources more relevant,
• between them you should understand if you can discard something of these logs (e.g. some EventCodes in wineventlogs) remembering that if you discard something, you cannot use it! (for more infos about discard logs see at https://docs.splunk.com/Documentation/Splunk/8.0.6/Forwarding/Routeandfilterdatad#Filter_event_data_...),
• if the discarded logs are relevant (so you reduced your license consuption), continue with your normal work, if instead you cannor reduce quite your license consuption, the only choice is to buy additional license,
• in the past, a violation blocked Splunk searches (not indexing), now instead you have only the annoying message "you're in violation..." but no blocks,
• anyway a violation is when you exceed your license for five times, not only one.

Ciao.

Giuseppe