Installation

If I have the same source of logs indexed in two separate Splunk environments, is there a way to only use up the license for one site?

DavidHourani
Super Champion

Hello dear Splunkers,

So I have two Splunk environments, one of which is in country A and another in country B.

Country A has 30 G license and country B has 300G license.

I have the same source of logs being indexed on both sites and its using up 10GB from both licenses. Is there a way to have this source use up only 10G from one site only without merging both licenses and still have the data going into both Splunk instances?

Thank you!

Regards,
David

Labels (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If a log is indexed twice it will consume license twice, regardless of where the license master sits.

To avoid double licensing you would have to avoid double indexing, for example by setting up a multi-site cluster that replicates the index buckets after indexing - and thus after licensing.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If a log is indexed twice it will consume license twice, regardless of where the license master sits.

To avoid double licensing you would have to avoid double indexing, for example by setting up a multi-site cluster that replicates the index buckets after indexing - and thus after licensing.

martin_mueller
SplunkTrust
SplunkTrust

You could segregate your logs into separate clusters for example.
You duplicate log goes into a cluster with sites in A and B, the other logs remain in the already existing clusters. SHs in A search the old A cluster and the new cluster, SHs in B search the old B cluster and the new cluster.

If I were you I'd just swallow the extra license hit instead of making your environment needlessly complex. As I'm sure you know costs per GB scale down quickly the more license you have, so a few GB extra on top of an existing license don't really cost that much. Compare that to the added maintenance costs, hardware, network, power, etc. and you should get a much higher figure than a few percent added to your license.

However, what's really the best choice for your specific environment is impossible to tell through Splunk Answers, I'd recommend consulting with Splunk Professional Services or your local Splunk Partner for a final verdict.

0 Karma

DavidHourani
Super Champion

Thanks Martin.

0 Karma

DavidHourani
Super Champion

Thank you for your answer Martin. can you give me some clarification on that.

By setting up a multi-site cluster all my indexes will get replicated right ? I mean is it possible to select which indexes I want to replicated across this multi site. Also, by setting up a multi site between country A and B wouldn't it break the already existing multisite within country B ?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...