If I have the same source of logs indexed in two separate Splunk environments, is there a way to only use up the license for one site?

[DavidHourani]

Hello dear Splunkers,

So I have two Splunk environments, one of which is in country A and another in country B.

Country A has 30 G license and country B has 300G license.

I have the same source of logs being indexed on both sites and its using up 10GB from both licenses. Is there a way to have this source use up only 10G from one site only without merging both licenses and still have the data going into both Splunk instances?

Thank you!

Regards,
David

[martin_mueller · Accepted solution]

If a log is indexed twice it will consume license twice, regardless of where the license master sits.

To avoid double licensing you would have to avoid double indexing, for example by setting up a multi-site cluster that replicates the index buckets after indexing - and thus after licensing.

[martin_mueller]

You could segregate your logs into separate clusters for example.
You duplicate log goes into a cluster with sites in A and B, the other logs remain in the already existing clusters. SHs in A search the old A cluster and the new cluster, SHs in B search the old B cluster and the new cluster.

If I were you I'd just swallow the extra license hit instead of making your environment needlessly complex. As I'm sure you know costs per GB scale down quickly the more license you have, so a few GB extra on top of an existing license don't really cost that much. Compare that to the added maintenance costs, hardware, network, power, etc. and you should get a much higher figure than a few percent added to your license.

However, what's really the best choice for your specific environment is impossible to tell through Splunk Answers, I'd recommend consulting with Splunk Professional Services or your local Splunk Partner for a final verdict.

[DavidHourani]

Thanks Martin.

[DavidHourani]

Thank you for your answer Martin. can you give me some clarification on that.

By setting up a multi-site cluster all my indexes will get replicated right ? I mean is it possible to select which indexes I want to replicated across this multi site. Also, by setting up a multi site between country A and B wouldn't it break the already existing multisite within country B ?