Enterprise search head and free search peer

[antollinim]

Hello,

I have an enterprise license in one Splunk instance. I would like to add a second Splunk server running with a Free license in order for it to act as a search peer in a distributed search.

The distributed search would be initiated by the server with the Enterprise license (it will act as the search head). Would this configuration work? Will this violate any license?

Thanks Mario

[Simeon]

Splunk "free" does not have the distributed search features enabled. In order to use this functionality you must have the enterprise version.

If you are indexing data across both servers, Splunk can split your license so both servers will function with enterprise functionality. However, the split in volume will need to be allocated to each specific server within the license.

http://www.splunk.com/base/Documentation/latest/Installation/MoreAboutSplunkWithAFreeLicense