How can I monitor license usage on multiple instances?

[JWBailey]

Good afternoon,

I have multiple splunk instances set up using a license master / slave configuration with multiple license pools configured. I have the usage report at the license master level, but what is the best way for the admin of the slave Splunk instance to track their license usage? I have seen some information about adding the license master as a search peer. Where can I find details about this? How can I ensure the slave instance can only see statistics on itself instance, and not any of the other license pools?

Thanks,

[masonmorales · Accepted solution]

Follow this guide: http://docs.splunk.com/Documentation/Splunk/6.2.5/DistSearch/Forwardsearchheaddata

It says search head, but it works for license masters, heavy forwarders, etc. as well. This will allow you to send the license usage data that the the license master generates to your indexers. You can then search your license utilization data from your search head.

[martin_mueller]

As it ships, no. A user that can read index=_internal can read all license usage data.

You could put in a bit of configuration thought to change that... quick ideas include exporting each segment of the license data into separate summary indexes and granting search permissions on that, running dashboards with pre-built searches in an admin user context without giving the users access to _internal at all, using search filter restrictions, etc.

[masonmorales]

Hi @JWBailey if this solution worked for you, could you please select "Accept Answer"?

[JWBailey]

Does this solution allow me to segment the data, and limit access to just the relevant pools? I do not want splunk users of license pool A to see data on license pool B.

Thanks,

[masonmorales]

I think this is technically a second question but I'm happy to help. Just to clarify: You don't want users from pool A to see license data from pool B? Or you don't want users with data in pool A to see any data that was indexed as part of pool B? You might want to drop in IRC as there are probably going to be follow-up questions about how your environment and RBAC are setup.

[JWBailey]

Sorry for the confusion, I can provide additional clarification.

I am the admin of a splunk instance and a license master. I have other separate splunk instances in my environment that are license slaves to my license master. I have created license pools and assigned the secondary indexers to use the pools. This way I can manage the amount of license these child splunk instances can consume.

I do not manage these smaller splunk instances outside of providing the licensing. I am looking for a way that the appropriate administrators of a smaller instance can access their license usage information, without giving them information they should not have. I do not want the administrator of a splunk instance that is using license pool B, to have visibility into my primary splunk instance, or any information about license pool C.

I am only speaking about license information, not regular indexed data.

In other words:
I manage the organization's overall splunk instance, responsible for collecting infrastructure logs, and I manage a license master as well. My sales team has a unique application that generates logs that are of no concern to me but the sales team needs. They have implemented a new splunk instance, collect their app logs, and manage it on their own. They asked me if I could spare a 1GB license so they did not need to purchase their own. I created a new 1GB license pool, configured their indexer to use that license pool, and validated the sales team's indexer can communicate.

Now I would like for the sales team to be able to monitor their own license usage, without giving them the ability to see what is happening in master license pool. If I had another group within my organization with this same setup, I do not want my sales team to have visibility into their license pool either.

I hope the clarifies what I am looking for.

[martin_mueller]

If you add a search peer, the search head gains full visibility into all the peer's data.