Getting Data In

splunk forwarder license

apro
Path Finder

Hi,

Like to quick check on how splunk forwarder license works...

  • forwarder license type is displayed as Enterprise?
  • forwarder has a license level of 1MB?
  • in that case our forwarder already has some violations..what if it exceeds 3/5 violations?
  • it has expiration date and days remaining. so after it expires how do we obtain the new forwarder license?
0 Karma

apro
Path Finder

Thanks.This is a concern initially because if we have deploy large number of forwarders each with different expiration and violations,then we may have some problem tracking them..

0 Karma

Starlette
Contributor

Not sure why mzorzi sends you to the dark,,his initial answer were 100% wrong,,,and you can stuck with gkanapathy's comments for forwarders as well.
see http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F for the different fucntions...
forwarders are input, parsing pipelines,,,,NO indexing no licensestuff!!!!

gkanapathy
Splunk Employee
Splunk Employee
  1. Forwarder license is Enterprise. It should not be your regular license, but the $SPLUNK_HOME/etc/splunk-forwarder.license file that is shipped with every Splunk package. You can just copy this file to splunk.license.

  2. Yes it is. 1MB is just a minimum license. Forwarders don't actually need any licensing, since they don't index.

  3. Doesn't matter. Violating a license (because some amount does get indexed) results in search being disabled. Forwarders don't perform search.

  4. The forwarder license should not be expiring any time soon. It also doesn't matter in practice, again because once it expires, only search is disabled. Forwarders don't perform search.

heterodyned
Path Finder

Should the splunk forwarder license have the same expiration date as that of the indexer from where the splunk-forwarder-license is copied or it doesnt matter ?

0 Karma

mzorzi
Splunk Employee
Splunk Employee

Light Forwarders don't perform search/index, Forwarders do (they are Indexers with a defined stanza in outputs.conf ). I assumed in the question above apro referred to Forwarders.

0 Karma

mzorzi
Splunk Employee
Splunk Employee

  1. Forwarder License is the same as Indexer License.

  2. No, you have an unlocking license, delivered to reset violation.

  3. You need a new Production or a new Larger Trial License.

  4. Please contact support@splunk.com or your sale reference.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...